Base32 Encoder / Decoder
100% private — runs on your device, never uploaded. Works offline once loaded.
Encode plain text to RFC 4648 Base32 or decode a Base32 string back to readable text, with full UTF-8 support. Everything runs locally in your browser.
What Base32 is and how it works
Base32 encodes binary data using just 32 printable characters — the uppercase letters A–Z and the digits 2–7 in the RFC 4648 alphabet. It works by taking your data 5 bits at a time (2^5 = 32) and mapping each group to one character. Because 5 bits do not divide evenly into 8-bit bytes, the encoder buffers bits until it has enough, then pads the final output with = characters so the length is always a multiple of eight.
This tool encodes your text as UTF-8 bytes first, then runs that RFC 4648 process, so any character — accented letters, CJK text, emoji — survives a full encode-then-decode round trip intact.
Base32 vs Base64 — why choose Base32
Base64 is more compact (it packs 6 bits per character instead of 5), so why would anyone use Base32? The answer is human-friendliness and case-insensitivity. Base32 deliberately omits easily-confused characters and uses only uppercase letters and a safe subset of digits, which makes it robust when data has to be typed, read aloud, or handled by systems that do not preserve case.
That is why Base32 shows up in places Base64 does not: TOTP two-factor secrets (the codes you scan into an authenticator app), some DNS and email systems, and identifiers that people occasionally need to enter by hand. The trade-off is size — Base32 output is roughly 60% larger than the original bytes, versus about 33% for Base64.
When you will actually need this
The most common reason developers reach for a Base32 converter is debugging authenticator / 2FA secrets, which are shared as Base32 strings. Decoding one lets you inspect the raw shared secret; encoding lets you produce a test secret. It also comes up when working with systems that emit Base32-encoded tokens, hashes, or identifiers and you need to see the underlying value.
- Inspecting or generating TOTP/HOTP secret keys
- Decoding Base32 identifiers from logs or APIs
- Encoding binary-derived data for case-insensitive, hand-typable transport
- Learning and testing how RFC 4648 padding behaves
Padding and common gotchas
The trailing = signs are padding, not part of the data — this decoder ignores them, so you can paste a string with or without padding and still get the right result. It also strips whitespace, which helps when a secret has been wrapped across lines or grouped into readable chunks.
Base32 is case-insensitive on decode: lowercase input is upgraded to uppercase automatically. If you paste a string containing a character outside the A–Z / 2–7 alphabet (for example the digits 0, 1, 8 or 9), the decoder will flag it rather than silently produce garbage.
Frequently asked questions
Why is Base32 output longer than Base64?
Base32 encodes only 5 bits per character while Base64 encodes 6, so it needs more characters to represent the same data — about 60% overhead versus roughly 33% for Base64. The upside is case-insensitivity and fewer confusable characters.
What are the = signs at the end?
They are padding that keeps the encoded length a multiple of eight characters. They carry no data, and this decoder accepts your string with or without them.
Can I decode a 2FA / TOTP secret with this?
Yes. Authenticator secrets are Base32 strings, so pasting one in Decode mode reveals the raw bytes. Note the result may contain non-printable bytes since the secret is binary, not text.
Does it support lowercase Base32?
On decode, yes — lowercase letters are converted to uppercase automatically before decoding. Encoded output is always uppercase per the RFC 4648 standard.
Why did my decode show an error?
The input contained a character outside the Base32 alphabet (A–Z and 2–7). The digits 0, 1, 8 and 9 are not valid — 0 and 1 are excluded because they look like O and I.
Is any data sent to a server?
No. Both encoding and decoding are performed in your browser using local JavaScript — nothing leaves your device.
Advertisement