diff --git a/appl/ftp/ftp/gssapi.c b/appl/ftp/ftp/gssapi.c
index 604d5240d..ceed5e987 100644
--- a/appl/ftp/ftp/gssapi.c
+++ b/appl/ftp/ftp/gssapi.c
@@ -213,7 +213,7 @@ gss_adat(void *app_data, void *buf, size_t len)
 	free(bindings);
 
     if(output_token.length) {
-	if(base64_encode(output_token.value, output_token.length, &p) < 0) {
+	if(rk_base64_encode(output_token.value, output_token.length, &p) < 0) {
 	    reply(535, "Out of memory base64-encoding.");
 	    return -1;
 	}
@@ -421,7 +421,7 @@ gss_auth(void *app_data, char *host)
 	    input.length = 0;
 	}
 	if (output_token.length != 0) {
-	    base64_encode(output_token.value, output_token.length, &p);
+	    rk_base64_encode(output_token.value, output_token.length, &p);
 	    gss_release_buffer(&min_stat, &output_token);
 	    n = command("ADAT %s", p);
 	    free(p);
@@ -444,7 +444,7 @@ gss_auth(void *app_data, char *host)
 	    } else {
 		p+=5;
 		input.value = malloc(strlen(p));
-		input.length = base64_decode(p, input.value);
+		input.length = rk_base64_decode(p, input.value);
 	    }
 	} else {
 	    if(code != 235) {
diff --git a/appl/ftp/ftp/security.c b/appl/ftp/ftp/security.c
index 86c73a168..431800993 100644
--- a/appl/ftp/ftp/security.c
+++ b/appl/ftp/ftp/security.c
@@ -348,7 +348,7 @@ sec_read_msg(char *s, int level)
     int return_code;
 
     buf = malloc(strlen(s));
-    len = base64_decode(s + 4, buf); /* XXX */
+    len = rk_base64_decode(s + 4, buf); /* XXX */
 
     len = (*mech->decode)(app_data, buf, len, level);
     if(len < 0)
@@ -386,7 +386,7 @@ sec_vfprintf(FILE *f, const char *fmt, va_list ap)
 	printf("Failed to encode command.\n");
 	return -1;
     }
-    if(base64_encode(enc, len, &buf) < 0){
+    if(rk_base64_encode(enc, len, &buf) < 0){
 	free(enc);
 	printf("Out of memory base64-encoding.\n");
 	return -1;
@@ -469,7 +469,7 @@ adat(char *auth_data)
     if(mech && !sec_complete) {
 	void *buf = malloc(strlen(auth_data));
 	size_t len;
-	len = base64_decode(auth_data, buf);
+	len = rk_base64_decode(auth_data, buf);
 	(*mech->adat)(app_data, buf, len);
 	free(buf);
     } else
@@ -554,7 +554,7 @@ void mec(char *msg, enum protection_level level)
 	reply(501, "Failed to allocate %lu", (unsigned long)buf_size);
 	return;
     }
-    len = base64_decode(msg, buf);
+    len = rk_base64_decode(msg, buf);
     command_prot = level;
     if(len == (size_t)-1) {
 	free(buf);
diff --git a/appl/test/http_client.c b/appl/test/http_client.c
index 1f56bb614..24c4e6e2d 100644
--- a/appl/test/http_client.c
+++ b/appl/test/http_client.c
@@ -392,7 +392,7 @@ main(int argc, char **argv)
 		    if (len == 0)
 			errx(1, "invalid Negotiate token");
 		    input_token.value = emalloc(len);
-		    len = base64_decode(&h[i], input_token.value);
+		    len = rk_base64_decode(&h[i], input_token.value);
 		    if (len < 0)
 			errx(1, "invalid base64 Negotiate token %s", &h[i]);
 		    input_token.length = len;
@@ -475,9 +475,9 @@ main(int argc, char **argv)
 		if (output_token.length) {
 		    char *neg_token;
 
-		    base64_encode(output_token.value,
-				  output_token.length,
-				  &neg_token);
+		    rk_base64_encode(output_token.value,
+				     output_token.length,
+				     &neg_token);
 
 		    asprintf(&headers[num_headers++], "Authorization: Negotiate %s",
 			     neg_token);
diff --git a/kdc/connect.c b/kdc/connect.c
index 9083b85f1..52c8f5ee0 100644
--- a/kdc/connect.c
+++ b/kdc/connect.c
@@ -681,7 +681,7 @@ handle_http_tcp (krb5_context context,
 	free(data);
 	return -1;
     }
-    len = base64_decode(t, data);
+    len = rk_base64_decode(t, data);
     if(len <= 0){
 	const char *msg =
 	    " 404 Not found\r\n"
diff --git a/kuser/kdigest.c b/kuser/kdigest.c
index cd4ec1b99..c53815104 100644
--- a/kuser/kdigest.c
+++ b/kuser/kdigest.c
@@ -485,7 +485,7 @@ ntlm_server_init(struct ntlm_server_init_options *opt,
      *
      */
 
-    base64_encode(data.data, data.length, &s);
+    rk_base64_encode(data.data, data.length, &s);
     free(data.data);
     printf("type2=%s\n", s);
     free(s);
@@ -498,7 +498,7 @@ ntlm_server_init(struct ntlm_server_init_options *opt,
     if (ret)
 	krb5_err(context, 1, ret, "krb5_ntlm_init_get_opaque");
 
-    base64_encode(opaque.data, opaque.length, &s);
+    rk_base64_encode(opaque.data, opaque.length, &s);
     krb5_data_free(&opaque);
     printf("opaque=%s\n", s);
     free(s);
diff --git a/lib/base/db.c b/lib/base/db.c
index ec415bcb1..6559c840d 100644
--- a/lib/base/db.c
+++ b/lib/base/db.c
@@ -1115,7 +1115,7 @@ heim_string_t to_base64(heim_data_t data, heim_error_t *error)
     int ret;
 
     d = heim_data_get_data(data);
-    ret = base64_encode(d->data, d->length, &b64);
+    ret = rk_base64_encode(d->data, d->length, &b64);
     if (ret < 0 || b64 == NULL)
 	goto enomem;
     s = heim_string_ref_create(b64, free);
@@ -1141,7 +1141,7 @@ heim_data_t from_base64(heim_string_t s, heim_error_t *error)
     if (buf == NULL)
 	goto enomem;
 
-    len = base64_decode(heim_string_get_utf8(s), buf);
+    len = rk_base64_decode(heim_string_get_utf8(s), buf);
     d = heim_data_ref_create(buf, len, free);
     if (d == NULL)
 	goto enomem;
diff --git a/lib/base/json.c b/lib/base/json.c
index 1abf0e7a7..2ef371b97 100644
--- a/lib/base/json.c
+++ b/lib/base/json.c
@@ -184,7 +184,7 @@ base2json(heim_object_t obj, struct twojson *j)
 	    return EINVAL; /* JSON doesn't do binary */
 
 	data = heim_data_get_data(obj);
-	ret = base64_encode(data->data, data->length, &b64);
+	ret = rk_base64_encode(data->data, data->length, &b64);
 	if (ret < 0 || b64 == NULL)
 	    return ENOMEM;
 
@@ -410,7 +410,7 @@ parse_string(struct parse_ctx *ctx)
 			    ctx->error = heim_error_create_enomem();
 			    return NULL;
 			}
-			len = base64_decode(s, buf);
+			len = rk_base64_decode(s, buf);
 			if (len == -1) {
 			    free(buf);
 			    return o;
@@ -541,7 +541,7 @@ parse_dict(struct parse_ctx *ctx)
 		ctx->error = heim_error_create_enomem();
 		return NULL;
 	    }
-	    len = base64_decode(heim_string_get_utf8(v), buf);
+	    len = rk_base64_decode(heim_string_get_utf8(v), buf);
 	    heim_release(v);
 	    if (len == -1) {
 		free(buf);
diff --git a/lib/hdb/test_hdbkeys.c b/lib/hdb/test_hdbkeys.c
index ce4e59fa1..21c0a04a2 100644
--- a/lib/hdb/test_hdbkeys.c
+++ b/lib/hdb/test_hdbkeys.c
@@ -112,7 +112,7 @@ main(int argc, char **argv)
 
     krb5_free_context(context);
 
-    ret = base64_encode(data, length, &str);
+    ret = rk_base64_encode(data, length, &str);
     if (ret < 0)
 	errx(1, "base64_encode");
 
diff --git a/lib/hx509/file.c b/lib/hx509/file.c
index 4f7e87f07..5401af7a0 100644
--- a/lib/hx509/file.c
+++ b/lib/hx509/file.c
@@ -98,7 +98,7 @@ hx509_pem_write(hx509_context context, const char *type,
 	if (length > ENCODE_LINE_LENGTH)
 	    length = ENCODE_LINE_LENGTH;
 
-	l = base64_encode(p, length, &line);
+	l = rk_base64_encode(p, length, &line);
 	if (l < 0) {
 	    hx509_set_error_string(context, 0, ENOMEM,
 				   "malloc - out of memory");
@@ -255,7 +255,7 @@ hx509_pem_read(hx509_context context,
 	    }
 
 	    p = emalloc(i);
-	    i = base64_decode(buf, p);
+	    i = rk_base64_decode(buf, p);
 	    if (i < 0) {
 		free(p);
 		goto out;
diff --git a/lib/ipc/server.c b/lib/ipc/server.c
index 2fcc548da..60efec88b 100644
--- a/lib/ipc/server.c
+++ b/lib/ipc/server.c
@@ -822,7 +822,7 @@ handle_http_tcp(struct client *c)
 	free(data);
 	return NULL;
     }
-    len = base64_decode(t, data);
+    len = rk_base64_decode(t, data);
     if(len <= 0){
 	const char *msg =
 	    " 404 Not found\r\n"
diff --git a/lib/kadm5/ad.c b/lib/kadm5/ad.c
index f53f2dfec..80807b084 100644
--- a/lib/kadm5/ad.c
+++ b/lib/kadm5/ad.c
@@ -1275,7 +1275,7 @@ kadm5_ad_randkey_principal(void *server_handle,
     {
 	char p[64];
 	krb5_generate_random_block(p, sizeof(p));
-	plen = base64_encode(p, sizeof(p), &password);
+	plen = rk_base64_encode(p, sizeof(p), &password);
 	if (plen < 0)
 	    return ENOMEM;
     }
diff --git a/lib/krb5/send_to_kdc.c b/lib/krb5/send_to_kdc.c
index fd8558f37..261b729c2 100644
--- a/lib/krb5/send_to_kdc.c
+++ b/lib/krb5/send_to_kdc.c
@@ -514,7 +514,7 @@ prepare_http(krb5_context context, struct host *host, const krb5_data *data)
 
     heim_assert(host->data.length == 0, "prepare_http called twice");
 
-    len = base64_encode(data->data, data->length, &str);
+    len = rk_base64_encode(data->data, data->length, &str);
     if(len < 0)
 	return ENOMEM;
 
diff --git a/lib/roken/base64-test.c b/lib/roken/base64-test.c
index 146e97e24..68cc6b5a4 100644
--- a/lib/roken/base64-test.c
+++ b/lib/roken/base64-test.c
@@ -58,7 +58,7 @@ main(int argc, char **argv)
     for(t = tests; t->data; t++) {
 	char *str;
 	int len;
-	len = base64_encode(t->data, t->len, &str);
+	len = rk_base64_encode(t->data, t->len, &str);
 	if(strcmp(str, t->result) != 0) {
 	    fprintf(stderr, "failed test %d: %s != %s\n", numtest,
 		    str, t->result);
@@ -66,7 +66,7 @@ main(int argc, char **argv)
 	}
 	free(str);
 	str = strdup(t->result);
-	len = base64_decode(t->result, str);
+o	len = rk_base64_decode(t->result, str);
 	if(len != t->len) {
 	    fprintf(stderr, "failed test %d: len %lu != %lu\n", numtest,
 		    (unsigned long)len, (unsigned long)t->len);
@@ -81,12 +81,12 @@ main(int argc, char **argv)
 
     {
 	char str[32];
-	if(base64_decode("M=M=", str) != -1) {
+	if(rk_base64_decode("M=M=", str) != -1) {
 	    fprintf(stderr, "failed test %d: successful decode of `M=M='\n",
 		    numtest++);
 	    numerr++;
 	}
-	if(base64_decode("MQ===", str) != -1) {
+	if(rk_base64_decode("MQ===", str) != -1) {
 	    fprintf(stderr, "failed test %d: successful decode of `MQ==='\n",
 		    numtest++);
 	    numerr++;
diff --git a/lib/roken/base64.c b/lib/roken/base64.c
index 394e9841c..6ee4899e5 100644
--- a/lib/roken/base64.c
+++ b/lib/roken/base64.c
@@ -52,7 +52,7 @@ pos(char c)
 }
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
-base64_encode(const void *data, int size, char **str)
+rk_base64_encode(const void *data, int size, char **str)
 {
     char *s, *p;
     int i;
@@ -121,7 +121,7 @@ token_decode(const char *token)
 }
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
-base64_decode(const char *str, void *data)
+rk_base64_decode(const char *str, void *data)
 {
     const char *p;
     unsigned char *q;
diff --git a/lib/roken/base64.h b/lib/roken/base64.h
index dfae4c13b..734a6b5d9 100644
--- a/lib/roken/base64.h
+++ b/lib/roken/base64.h
@@ -47,9 +47,9 @@
 #endif
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
-base64_encode(const void *, int, char **);
+rk_base64_encode(const void *, int, char **);
 
 ROKEN_LIB_FUNCTION int ROKEN_LIB_CALL
-base64_decode(const char *, void *);
+rk_base64_decode(const char *, void *);
 
 #endif
diff --git a/lib/roken/version-script.map b/lib/roken/version-script.map
index 1fb4d8d37..cffaeaa82 100644
--- a/lib/roken/version-script.map
+++ b/lib/roken/version-script.map
@@ -2,8 +2,6 @@ HEIMDAL_ROKEN_1.0 {
 	global:
 		arg_printusage;
 		arg_printusage_i18n;
-		base64_decode;
-		base64_encode;
 		cgetcap;
 		cgetclose;
 		cgetmatch;
@@ -36,6 +34,8 @@ HEIMDAL_ROKEN_1.0 {
 		print_units_table;
 		rk_asnprintf;
 		rk_asprintf;
+		rk_base64_decode;
+		rk_base64_encode;
 		rk_bswap16;
 		rk_bswap32;
 		rk_cgetent;