Base32 Encoder
Base32 in the browser: RFC 4648 alphabet A–Z and 2–7, padding optional, UTF-8 text. This is what TOTP secrets, licence keys and case-insensitive IDs are made of.
About Base32 Encoder
Base32 per RFC 4648: the alphabet is A–Z plus 2–7, 32 characters. Five bits per character, so the same content runs about 60% longer than Base64 — what that buys is case-insensitivity and fewer misreads: 0, 1, 8 and 9 are deliberately absent so nothing can be confused with O, I, l or B. The design dates back to teleprinters and hand-copied strings.
Where you actually meet it is two-factor secrets. The secret inside a Google Authenticator or Authy otpauth:// link is Base32. Those keys have three habits, all handled here: no padding, case-insensitive, and grouped in fours with spaces (JBSW Y3DP EHPK 3PXP). Paste the whole thing; you do not need to strip spaces or add the equals signs yourself.
Encoding pads with = to a multiple of eight (RFC 4648 padding); decoding accepts it or not. Both are standard — systems differ on whether they bother.
A wrong length is an error, not garbage. With padding removed, the length modulo 8 can only be 0, 2, 4, 5 or 7, since five characters carry four bytes. A remainder of 1, 3 or 6 means a character went missing — the tool says so instead of confidently producing nonsense.
This is not Crockford Base32. That variant drops I, L, O and U, fills the gaps with 0–9, and carries a check symbol; it shows up in human-typed identifiers such as some payment order numbers. Feeding a Crockford string here reports an invalid character or decodes to different bytes. The two are not interchangeable.
Chinese is handled as UTF-8, not Latin-1. If the decoded bytes are not valid UTF-8 — ciphertext, a slice of an image — the result is shown as hex rather than a wall of replacement characters. Tick "Show decoded bytes as hex" to always see the raw bytes.
Base32 is an encoding, not encryption. Anyone can decode it; use the AES tool if you need secrecy.
Everything runs in the browser; nothing is uploaded.
Frequently asked questions
Why is Base32 so much longer than Base64?
Base32 carries 5 bits per character, Base64 carries 6. The same bytes come out about 60% longer, in exchange for case-insensitivity and no ambiguous characters.
Can I decode a Google Authenticator secret directly?
Yes. That secret is Base32; spaces and missing = are fine, since they are stripped and case is ignored.
Why does it say the length is wrong?
After removing padding, the length modulo 8 must be 0, 2, 4, 5 or 7. A remainder of 1, 3 or 6 means characters went missing — check that the copy is complete.
Does it decode Crockford Base32?
No. The Crockford variant uses a different alphabet (no I, L, O, U; 0–9 fill the gaps) plus a check symbol, and is not compatible with RFC 4648.
The result came out as hex?
That means the bytes are not valid UTF-8 — ciphertext or binary data. Untick the hex box to try it as text.
Can I use it to encrypt?
No. Base32 is only an encoding and anyone can reverse it. Use the AES tool for secrecy.
