Base32 Encoder and Decoder

How it works

Type text into the left pane, or paste the Base32 string you want to decode, then pick Encode or Decode under Direction; the result appears on the right straight away. The word "foobar" becomes MZXW6YTBOI====== with the RFC 4648 alphabet: six bytes turn into ten characters, and the six = signs at the end are padding that rounds the string up to a multiple of eight. When decoding, lowercase, spaces and dashes are fine, so a two-factor setup key shown as "jbsw y3dp ehpk 3pxp" can be pasted as it is. If the decoded bytes are not readable text — 2FA secrets never are — the tool shows them as hex instead of printing garbage, and the result line says so. If the string contains a character outside the alphabet (the RFC alphabet has no 0, 1, 8 or 9), the tool does not guess; it tells you which position is wrong. Your text is processed inside your browser and is not sent anywhere.

This tool is also known as base32 decode, base32 encode, base32 decoder, decode totp secret, base32 to text.

What is Base32?

Base32 writes binary data using only 32 different characters. The data is cut into 5-bit pieces; each piece is a number from 0 to 31 and maps to one character of the alphabet, so five bytes (40 bits) make exactly eight characters. The standard is RFC 4648. Because it ignores letter case and avoids characters that are easy to confuse, it is used for keys that people type by hand, for 2FA setup codes and on case-insensitive file systems.

What is TOTP (time-based one-time password)?

TOTP is the method behind the six-digit code that an authenticator app shows every 30 seconds (RFC 6238). During setup the app and the website share a secret key, delivered inside the QR code or as a Base32 string you type in. From then on both sides compute the same code independently from that key and the current time. Anyone who knows the key can produce valid codes, so the Base32 string must be protected like a password.

What is the difference between Base32 and Base58?

Both avoid characters that people confuse, but they work differently. Base32 cuts the data into fixed 5-bit groups: every character maps to a fixed place in the data, there are blocks and padding, and letter case does not matter. Base58 reads the whole input as one large number and writes it in base 58; the result is shorter, but it is case-sensitive and, with no bit groups, slower to compute for long input. 2FA secrets use Base32; Bitcoin addresses and IPFS identifiers use Base58.

Decoding a 2FA secret: what you will see and what to watch out for

The setup key you type into Google Authenticator, Authy or a password manager instead of scanning the QR code is Base32: RFC 4648 alphabet, usually without padding and split into groups of four. Decoding it does not reveal a word or a password. You get 10 or 20 random bytes, which this tool prints as hex. That is expected: the key is the seed that the six-digit codes are calculated from.

Anyone who has this key can generate your codes, so treat it like a password. This page cannot send it anywhere, but do not keep the key in screenshots, email drafts or note apps either. Decoding is useful for one thing: checking that the key was copied correctly. A wrong length or a character outside the alphabet shows up immediately.

Which alphabet do you need?

If the string uses capital letters and the digits 2-7 only, it is RFC 4648 Base32: 2FA keys, some file names and DNS records use it. If it contains 0, 1, 8 or 9, it is probably base32hex or Crockford. base32hex keeps sort order — bytes that sort in order produce strings that sort in the same order — which is why databases pick it for keys.

Crockford Base32 was designed to be read and typed by people. It leaves out I, L and O, which look like 1 and 0, and drops U so that no accidental words appear. When decoding it reads I and L as 1 and O as 0, so a code misread over the phone still lands on the right bytes. Crockford has no padding, so the Padding setting has no effect with it.

• RFC 4648: ABCDEFGHIJKLMNOPQRSTUVWXYZ234567
• base32hex: 0123456789ABCDEFGHIJKLMNOPQRSTUV
• Crockford: 0123456789ABCDEFGHJKMNPQRSTVWXYZ

Frequently asked questions

How do I decode a Base32 string?

Paste the string into the left pane and choose Decode. If the result is readable text you see the text, otherwise the bytes appear as hex. Lowercase letters, spaces and a missing = padding at the end are all fine.

What is the difference between Base32 and Base64?

Base64 uses 64 characters and is shorter: 3 bytes become 4 characters. Base32 uses only capital letters and digits, and 5 bytes become 8 characters, so it is about 20% longer. In return it is case-insensitive, easy to read aloud and safe in file names. That is why 2FA keys are Base32.

What are the = signs at the end for? Can I remove them?

Base32 works in blocks of 5 bytes. When the last block is short, = signs pad the string to a multiple of 8 characters. This tool decodes strings with or without padding, and many apps, including 2FA apps, never write it. If another system will read your string, check whether it expects padding.

What does "does not add up to whole bytes" mean?

In Base32 the last block can never be 1, 3 or 6 characters long; those lengths do not correspond to any number of bytes. If you see this error, a character was lost or added while copying. Copy the string again from the source.