diff --git a/internal/cmd/base/base.go b/internal/cmd/base/base.go
index 9bafa937a..be32ec75a 100644
--- a/internal/cmd/base/base.go
+++ b/internal/cmd/base/base.go
@@ -3,7 +3,6 @@ package base
 import (
 	"bytes"
 	"context"
-	"encoding/base64"
 	"encoding/json"
 	"flag"
 	"fmt"
@@ -16,6 +15,7 @@ import (
 	"sync"
 	"syscall"
 
+	"github.com/btcsuite/btcutil/base58"
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/authtokens"
 	"github.com/hashicorp/boundary/sdk/recovery"
@@ -224,9 +224,9 @@ func (c *Command) Client(opt ...Option) (*api.Client, error) {
 				token = ""
 			}
 			if token != "" {
-				tokenBytes, err := base64.RawStdEncoding.DecodeString(token)
-				if err != nil {
-					c.UI.Error(fmt.Sprintf("Error unmarshaling stored token from system credential store: %s", err))
+				tokenBytes := base58.Decode(token)
+				if len(tokenBytes) == 0 {
+					c.UI.Error("Zero length token after decoding stored token from system credential store")
 				} else {
 					var authToken authtokens.AuthToken
 					if err := json.Unmarshal(tokenBytes, &authToken); err != nil {
diff --git a/internal/cmd/commands/authenticate/password.go b/internal/cmd/commands/authenticate/password.go
index 355ec3d86..cbeeb9add 100644
--- a/internal/cmd/commands/authenticate/password.go
+++ b/internal/cmd/commands/authenticate/password.go
@@ -1,13 +1,13 @@
 package authenticate
 
 import (
-	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"os"
 	"strings"
 	"time"
 
+	"github.com/btcsuite/btcutil/base58"
 	"github.com/hashicorp/boundary/api/authmethods"
 	"github.com/hashicorp/boundary/internal/cmd/base"
 	"github.com/hashicorp/vault/sdk/helper/password"
@@ -156,7 +156,7 @@ func (c *PasswordCommand) Run(args []string) int {
 			c.UI.Error(fmt.Sprintf("Error marshaling auth token to save to system credential store: %s", err))
 			return 1
 		}
-		if err := keyring.Set("HashiCorp Boundary Auth Token", tokenName, base64.RawStdEncoding.EncodeToString(marshaled)); err != nil {
+		if err := keyring.Set("HashiCorp Boundary Auth Token", tokenName, base58.Encode(marshaled)); err != nil {
 			c.UI.Error(fmt.Sprintf("Error saving auth token to system credential store: %s", err))
 			return 1
 		}
diff --git a/internal/cmd/commands/proxy/proxy.go b/internal/cmd/commands/proxy/proxy.go
index 680f4175b..f7f6771ce 100644
--- a/internal/cmd/commands/proxy/proxy.go
+++ b/internal/cmd/commands/proxy/proxy.go
@@ -4,7 +4,6 @@ import (
 	"crypto/ed25519"
 	"crypto/tls"
 	"crypto/x509"
-	"encoding/base64"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -14,6 +13,7 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/btcsuite/btcutil/base58"
 	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/cmd/base"
@@ -141,9 +141,9 @@ func (c *Command) Run(args []string) int {
 		c.flagAuth = string(authBytes)
 	}
 
-	marshaled, err := base64.RawStdEncoding.DecodeString(c.flagAuth)
-	if err != nil {
-		c.UI.Error(fmt.Errorf("Unable to decode authorization string: %w", err).Error())
+	marshaled := base58.Decode(c.flagAuth)
+	if len(marshaled) == 0 {
+		c.UI.Error("Zero length authorization information after decoding")
 		return 1
 	}
 
diff --git a/internal/servers/controller/handler.go b/internal/servers/controller/handler.go
index d413aec09..a184f2236 100644
--- a/internal/servers/controller/handler.go
+++ b/internal/servers/controller/handler.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"crypto/rand"
 	"crypto/x509"
-	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -15,6 +14,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/btcsuite/btcutil/base58"
 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/globals"
@@ -408,7 +408,7 @@ func jobTestingHandler(c *Controller) http.Handler {
 			return
 		}
 
-		if _, err := w.Write([]byte(base64.RawStdEncoding.EncodeToString(marshaled))); err != nil {
+		if _, err := w.Write([]byte(base58.Encode(marshaled))); err != nil {
 			errorResp(err)
 			return
 		}
diff --git a/sdk/recovery/recovery.go b/sdk/recovery/recovery.go
index 0d0df976a..e8c82dc0e 100644
--- a/sdk/recovery/recovery.go
+++ b/sdk/recovery/recovery.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/btcsuite/btcutil/base58"
 	wrapping "github.com/hashicorp/go-kms-wrapping"
 	"github.com/hashicorp/go-uuid"
 	"google.golang.org/protobuf/proto"
@@ -57,7 +58,7 @@ func formatToken(ctx context.Context, wrapper wrapping.Wrapper, info *Info) (str
 		return "", fmt.Errorf("error marshaling encrypted blob: %w", err)
 	}
 
-	return fmt.Sprintf("r_%s", base64.RawStdEncoding.EncodeToString(marshaledBlob)), nil
+	return fmt.Sprintf("r_%s", base58.Encode(marshaledBlob)), nil
 }
 
 func ParseRecoveryToken(ctx context.Context, wrapper wrapping.Wrapper, token string) (*Info, error) {
@@ -70,9 +71,9 @@ func ParseRecoveryToken(ctx context.Context, wrapper wrapping.Wrapper, token str
 	}
 	token = strings.TrimPrefix(token, "r_")
 
-	marshaledBlob, err := base64.RawStdEncoding.DecodeString(token)
-	if err != nil {
-		return nil, fmt.Errorf("error base64-decoding token: %w", err)
+	marshaledBlob := base58.Decode(token)
+	if len(marshaledBlob) == 0 {
+		return nil, fmt.Errorf("length zero after base58-decoding token")
 	}
 
 	blobInfo := new(wrapping.EncryptedBlobInfo)