Base32 Encoder / Decoder
Encode or decode Base32 strings easily. Use this tool to convert between readable text and Base32 for safe data transfer or storage with human-readable format.
Input Settings
No input entered
Converts as you type
Encoded Result
Encoded result will appear here
Start typing on the left — conversion is instant
About Base32 Encoder / Decoder
Base32 encoding uses a 32-character set consisting of uppercase letters A-Z and digits 2-7, making it more human-readable and less error-prone than other encoding schemes. This tool provides seamless conversion between plain text and Base32 format, which is particularly useful when case-insensitive encoding is required or when avoiding confusing characters like 0, 1, 8, and 9.
Why use a Base32 Encoder / Decoder?
Base32 encoding is ideal for situations where data needs to be transmitted through case-insensitive systems or when human readability is important. It's commonly used in TOTP authentication codes, DNS records, and systems where users might need to manually type encoded values, as it eliminates easily confused characters.
Who is it for?
Security professionals implementing two-factor authentication, system administrators managing DNS records, developers working with QR codes, and anyone needing a more user-friendly encoding format will benefit from this tool. It's especially valuable for applications where end-users might need to manually enter encoded strings.
How to use the tool
Choose 'Encode' (bytes to Base32) or 'Decode' (Base32 back to bytes)
In Encode mode, pick the input format: 'Text (UTF-8)' for readable text, or 'Hex bytes' for raw key material such as a 2FA secret
Type or paste into the input box - the conversion runs as you type, there is no button to press
When decoding, paste the Base32 exactly as your provider shows it: lowercase, grouped with spaces or hyphens, padded or unpadded all work
Read the result on the right - decoded output shows as UTF-8 text when the bytes are valid text, and the 'Hex' toggle shows the raw bytes (the usual case for 2FA secrets)
Check the byte count under the result to confirm the length: a 16-character Base32 TOTP secret is 10 bytes, a 32-character one is 20 bytes
Click Copy to copy whichever view is on screen, or Clear to start over
Frequently Asked Questions
How do I encode/decode Base32?
Pick Encode or Decode, then type or paste — the conversion runs live as you type. This is a text-in/text-out tool; there is no file upload. Encoding works on UTF-8 bytes, so accented and non-Latin text (café, 日本) encodes and round-trips exactly, and you can switch the input to 'Hex bytes' to encode raw key material. Decoding accepts Base32 the way people actually transcribe it — lowercase, grouped with spaces or hyphens, with or without '=' padding — and rejects anything else with the reason: the bad character and its position, a truncated final group, or malformed padding. Output uses the RFC 4648 alphabet, A-Z and 2-7.
What is Base32?
Base32 is a binary-to-text encoding defined in RFC 4648, using 32 characters: A-Z and 2-7. Designed to be unambiguous in handwritten/printed/spoken form — the character set avoids 0/O, 1/l/I, U/V confusions. Each Base32 character holds 5 bits, so 5 input bytes produce 8 output characters. Less compact than Base64 (60% size inflation vs Base64's 33%), but more human-friendly for use cases where humans transcribe codes.
Is Base32 encryption or secure?
**No — Base32 is NOT encryption.** Like Base64, it's a trivially-reversible binary-to-text encoding, not a security primitive. Anyone can decode Base32 with any programming language. Used for safe-encoding of TOTP secrets (2FA), but the security of TOTP comes from the secret itself being random, not from the Base32 encoding. Don't store secrets in Base32 thinking it's encrypted — it's not. For security, use proper encryption.
Is my data sent to a server when I encode?
No — encoding/decoding runs entirely in your browser via JavaScript. Your input never reaches a server, never gets logged. Verify in DevTools' Network tab: zero HTTP requests during encoding. Safe for inspecting TOTP secrets, content-hash debugging, and any binary-to-text workflow where you don't want third-party logging.
Why use Base32 instead of Base64?
Three reasons. (1) Human-readability — Base32's character set avoids look-alike characters (0/O, 1/I/l). When users must transcribe or speak the encoding (e.g., reading a 2FA setup key aloud), Base32 is less error-prone. (2) Case-insensitivity — Base32 is uppercase-only by convention, so case errors don't matter. Base64 is case-sensitive. (3) Domain conventions — TOTP/HOTP (RFC 4648, RFC 6238) specifically use Base32 for secret encoding. Disadvantages: 60% size inflation vs Base64's 33%.
How is Base32 used in 2FA / TOTP setup?
When you set up TOTP (Google Authenticator, Authy, 1Password), the service shows a Base32 secret, typically 16 or 32 characters, displayed in lowercase groups like 'jbsw y3dp ehpk 3pxp'. Paste it into Decode exactly as shown — spaces, hyphens, lowercase and missing padding are all normalised — and you get the raw secret bytes. Read them in the Hex view: random key bytes are almost never valid UTF-8 text. 16 characters decode to 10 bytes, 32 characters to 20 bytes (the 160-bit HMAC-SHA1 secret RFC 6238 assumes). Going the other way, Encode with the 'Hex bytes' input turns a raw key into the Base32 an authenticator expects. The tool handles the secret itself — it does not parse otpauth:// URIs, scan QR codes, or generate 6-digit codes.
What's the difference between RFC 4648 Base32 and Crockford Base32?
RFC 4648 (the standard): uses A-Z and 2-7. Case-insensitive in practice but conventionally uppercase. Padding uses '='. Crockford Base32 (alternative): uses 0-9 and A-Z minus I/L/O/U (avoiding ambiguous characters more aggressively). No padding. Allows lowercase aliases for some uppercase chars. Used in some database systems and identifiers. This tool uses RFC 4648 (the dominant standard); for Crockford, you'd need a different encoder. The two are not directly compatible.
When should I use Base32?
Three common cases. (1) TOTP/HOTP 2FA setup — the standard for encoding shared secrets. (2) Content-addressable storage IDs where humans inspect/transcribe — some systems prefer Base32 over Base64 for that reason. (3) Identifiers in DNS or filesystems where case-sensitivity is problematic. For binary embedding in text (JSON, email, URIs), Base64 is more common and more compact. For general purposes, prefer Base64 unless you have a specific need for Base32's human-friendliness.
Share This Tool
Found this tool helpful? Share it with others who might benefit from it!
💡 Help others discover useful tools! Sharing helps us keep these tools free and accessible to everyone.