diff --git a/lang/funcs/datetime.go b/lang/funcs/datetime.go
index 2e2cc13b8..cef5e763e 100644
--- a/lang/funcs/datetime.go
+++ b/lang/funcs/datetime.go
@@ -67,7 +67,6 @@ func Timestamp() (cty.Value, error) {
 //
 // The result is a string, also in RFC 3339 format, representing the result
 // of adding the given direction to the given timestamp.
-
 func TimeAdd(timestamp cty.Value, duration cty.Value) (cty.Value, error) {
 	return TimeAddFunc.Call([]cty.Value{timestamp, duration})
 }
diff --git a/lang/funcs/encoding.go b/lang/funcs/encoding.go
new file mode 100644
index 000000000..f3385030e
--- /dev/null
+++ b/lang/funcs/encoding.go
@@ -0,0 +1,42 @@
+package funcs
+
+import (
+	"encoding/base64"
+	"fmt"
+
+	"github.com/zclconf/go-cty/cty"
+	"github.com/zclconf/go-cty/cty/function"
+)
+
+// Base64DecodeFunc constructs a function that decodes a string containing a base64 sequence.
+var Base64DecodeFunc = function.New(&function.Spec{
+	Params: []function.Parameter{
+		{
+			Name: "str",
+			Type: cty.String,
+		},
+	},
+	Type: function.StaticReturnType(cty.String),
+	Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+		s := args[0].AsString()
+		sDec, err := base64.StdEncoding.DecodeString(s)
+		if err != nil {
+			return cty.UnknownVal(cty.String), fmt.Errorf("failed to decode base64 data '%s'", s)
+		}
+
+		return cty.StringVal(string(sDec)), nil
+	},
+})
+
+// Base64Decode decodes a string containing a base64 sequence.
+//
+// Terraform uses the "standard" Base64 alphabet as defined in
+// [RFC 4648 section 4](https://tools.ietf.org/html/rfc4648#section-4).
+//
+// Strings in the Terraform language are sequences of unicode characters rather
+// than bytes, so this function will also interpret the resulting bytes as
+// UTF-8. If the bytes after Base64 decoding are _not_ valid UTF-8, this function
+// produces an error.
+func Base64Decode(str cty.Value) (cty.Value, error) {
+	return Base64DecodeFunc.Call([]cty.Value{str})
+}
diff --git a/lang/funcs/encoding_test.go b/lang/funcs/encoding_test.go
new file mode 100644
index 000000000..dd4ea9acc
--- /dev/null
+++ b/lang/funcs/encoding_test.go
@@ -0,0 +1,48 @@
+package funcs
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/zclconf/go-cty/cty"
+)
+
+func TestBase64Decode(t *testing.T) {
+	tests := []struct {
+		String cty.Value
+		Want   cty.Value
+		Err    bool
+	}{
+		{
+			cty.StringVal("YWJjMTIzIT8kKiYoKSctPUB+"),
+			cty.StringVal("abc123!?$*&()'-=@~"),
+			false,
+		},
+		{ // Invalid base64 data decoding
+			cty.StringVal("this-is-an-invalid-base64-data"),
+			cty.UnknownVal(cty.String),
+			true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("base64decode(%#v)", test.String), func(t *testing.T) {
+			got, err := Base64Decode(test.String)
+
+			if test.Err {
+				if err == nil {
+					t.Fatal("succeeded; want error")
+				}
+				return
+			} else {
+				if err != nil {
+					t.Fatalf("unexpected error: %s", err)
+				}
+			}
+
+			if !got.RawEquals(test.Want) {
+				t.Errorf("wrong result\ngot:  %#v\nwant: %#v", got, test.Want)
+			}
+		})
+	}
+}
diff --git a/lang/functions.go b/lang/functions.go
index 3ec24e741..5af8f1b0c 100644
--- a/lang/functions.go
+++ b/lang/functions.go
@@ -30,7 +30,7 @@ func (s *Scope) Functions() map[string]function.Function {
 		s.funcs = map[string]function.Function{
 			"abs":          stdlib.AbsoluteFunc,
 			"basename":     funcs.BasenameFunc,
-			"base64decode": unimplFunc, // TODO
+			"base64decode": funcs.Base64DecodeFunc,
 			"base64encode": unimplFunc, // TODO
 			"base64gzip":   unimplFunc, // TODO
 			"base64sha256": unimplFunc, // TODO