diff --git a/src/tools/clu_base64.c b/src/tools/clu_base64.c
index 00561f3..6667ee5 100644
--- a/src/tools/clu_base64.c
+++ b/src/tools/clu_base64.c
@@ -227,7 +227,7 @@ int wolfCLU_Base64Setup(int argc, char** argv)
             }
         }
     }
-    else if (ret == WOLFSSL_SUCCESS) {
+    else if (ret == WOLFCLU_SUCCESS && !decode) {
         /* For encoding */
         /* Calculate output size */
         if (Base64_Encode(input, inputSz, NULL, &outputSz) != LENGTH_ONLY_E) {
diff --git a/tests/base64/base64-test.sh b/tests/base64/base64-test.sh
index a4a4aac..0ca04f6 100755
--- a/tests/base64/base64-test.sh
+++ b/tests/base64/base64-test.sh
@@ -48,6 +48,17 @@ fi
 
 rm -rf testp7.der
 
+# base64 encode round-trip test
+run "base64 -in certs/server-key.der -out test-b64-encoded.b64"
+run "base64 -d -in test-b64-encoded.b64 -out test-b64-decoded.der"
+diff certs/server-key.der test-b64-decoded.der > /dev/null 2>&1
+if [ $? != 0 ]; then
+    echo "base64 encode/decode round-trip failed"
+    rm -f test-b64-encoded.b64 test-b64-decoded.der
+    exit 99
+fi
+rm -f test-b64-encoded.b64 test-b64-decoded.der
+
 #check stdin input
 RESULT=`cat certs/signed.p7b | ./wolfssl base64`
 if [ $? != 0 ]; then