diff --git a/src/core/base64.c b/src/core/base64.c
index 05ff424f..7514c1fa 100644
--- a/src/core/base64.c
+++ b/src/core/base64.c
@@ -20,6 +20,8 @@ FILE_LICENCE ( GPL2_OR_LATER );
 
 #include <stdint.h>
 #include <string.h>
+#include <ctype.h>
+#include <errno.h>
 #include <assert.h>
 #include <ipxe/base64.h>
 
@@ -68,3 +70,86 @@ void base64_encode ( const uint8_t *raw, size_t len, char *encoded ) {
 	DBG_HDA ( 0, raw, len );
 	assert ( strlen ( encoded ) == base64_encoded_len ( len ) );
 }
+
+/**
+ * Base64-decode string
+ *
+ * @v encoded		Encoded string
+ * @v raw		Raw data
+ * @ret len		Length of raw data, or negative error
+ *
+ * The buffer must be large enough to contain the decoded data.  Use
+ * something like
+ *
+ *     char buf[ base64_decoded_max_len ( encoded ) ];
+ *
+ * to provide a buffer of the correct size.
+ */
+int base64_decode ( const char *encoded, uint8_t *raw ) {
+	const uint8_t *encoded_bytes = ( ( const uint8_t * ) encoded );
+	uint8_t *raw_bytes = ( ( uint8_t * ) raw );
+	uint8_t encoded_byte;
+	char *match;
+	int decoded;
+	unsigned int bit = 0;
+	unsigned int pad_count = 0;
+	size_t len;
+
+	/* Zero the raw data */
+	memset ( raw, 0, base64_decoded_max_len ( encoded ) );
+
+	/* Decode string */
+	while ( ( encoded_byte = *(encoded_bytes++) ) ) {
+
+		/* Ignore whitespace characters */
+		if ( isspace ( encoded_byte ) )
+			continue;
+
+		/* Process pad characters */
+		if ( encoded_byte == '=' ) {
+			if ( pad_count >= 2 ) {
+				DBG ( "Base64-encoded string \"%s\" has too "
+				      "many pad characters\n", encoded );
+				return -EINVAL;
+			}
+			pad_count++;
+			bit -= 2; /* unused_bits = ( 2 * pad_count ) */
+			continue;
+		}
+		if ( pad_count ) {
+			DBG ( "Base64-encoded string \"%s\" has invalid pad "
+			      "sequence\n", encoded );
+			return -EINVAL;
+		}
+
+		/* Process normal characters */
+		match = strchr ( base64, encoded_byte );
+		if ( ! match ) {
+			DBG ( "Base64-encoded string \"%s\" contains invalid "
+			      "character '%c'\n", encoded, encoded_byte );
+			return -EINVAL;
+		}
+		decoded = ( match - base64 );
+
+		/* Add to raw data */
+		decoded <<= 2;
+		raw_bytes[ bit / 8 ] |= ( decoded >> ( bit % 8 ) );
+		raw_bytes[ bit / 8 + 1 ] |= ( decoded << ( 8 - ( bit % 8 ) ) );
+		bit += 6;
+	}
+
+	/* Check that we decoded a whole number of bytes */
+	if ( ( bit % 8 ) != 0 ) {
+		DBG ( "Base64-encoded string \"%s\" has invalid bit length "
+		      "%d\n", encoded, bit );
+		return -EINVAL;
+	}
+	len = ( bit / 8 );
+
+	DBG ( "Base64-decoded \"%s\" to:\n", encoded );
+	DBG_HDA ( 0, raw, len );
+	assert ( len <= base64_decoded_max_len ( encoded ) );
+
+	/* Return length in bytes */
+	return ( len );
+}
diff --git a/src/include/ipxe/base64.h b/src/include/ipxe/base64.h
index 88c91563..5fe134dc 100644
--- a/src/include/ipxe/base64.h
+++ b/src/include/ipxe/base64.h
@@ -10,6 +10,7 @@
 FILE_LICENCE ( GPL2_OR_LATER );
 
 #include <stdint.h>
+#include <string.h>
 
 /**
  * Calculate length of base64-encoded data
@@ -21,6 +22,20 @@ static inline size_t base64_encoded_len ( size_t raw_len ) {
 	return ( ( ( raw_len + 3 - 1 ) / 3 ) * 4 );
 }
 
+/**
+ * Calculate maximum length of base64-decoded string
+ *
+ * @v encoded		Encoded string
+ * @v max_raw_len	Maximum length of raw data
+ *
+ * Note that the exact length of the raw data cannot be known until
+ * the string is decoded.
+ */
+static inline size_t base64_decoded_max_len ( const char *encoded ) {
+	return ( ( ( strlen ( encoded ) + 4 - 1 ) / 4 ) * 3 );
+}
+
 extern void base64_encode ( const uint8_t *raw, size_t len, char *encoded );
+extern int base64_decode ( const char *encoded, uint8_t *raw );
 
 #endif /* _IPXE_BASE64_H */
diff --git a/src/include/ipxe/errfile.h b/src/include/ipxe/errfile.h
index 28648136..c62a5b7d 100644
--- a/src/include/ipxe/errfile.h
+++ b/src/include/ipxe/errfile.h
@@ -53,6 +53,7 @@ FILE_LICENCE ( GPL2_OR_LATER );
 #define ERRFILE_vsprintf	       ( ERRFILE_CORE | 0x000d0000 )
 #define ERRFILE_xfer		       ( ERRFILE_CORE | 0x000e0000 )
 #define ERRFILE_bitmap		       ( ERRFILE_CORE | 0x000f0000 )
+#define ERRFILE_base64		       ( ERRFILE_CORE | 0x00100000 )
 
 #define ERRFILE_eisa		     ( ERRFILE_DRIVER | 0x00000000 )
 #define ERRFILE_isa		     ( ERRFILE_DRIVER | 0x00010000 )