Base32 encoder and decoder
Paste text or hex bytes to encode them as Base32, or switch to Decode. Choose the RFC 4648 standard alphabet (used by many one-time-password secrets), base32hex or Crockford, and decide whether to keep the = padding.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- Choose Encode or Decode and pick an Alphabet.
- Choose whether the bytes are Text (UTF-8) or Hex bytes.
- When encoding, switch Add = padding on or off.
- Copy the result.
How it works
Every 5 bytes (40 bits) are split into eight 5-bit groups, and each group selects one character of the 32-character alphabet. If the input does not fill the last group, the remaining bits are zero and padding characters are added to reach a multiple of 8.
Example from RFC 4648: foobar encodes to MZXW6YTBOI====== in the standard alphabet and CPNMUOJ1E8====== in base32hex. Crockford gives CSQPYRK1E8.
Tips and common mistakes
- A length of 1, 3 or 6 characters (modulo 8) is impossible and is rejected.
- Secrets from authenticator apps are usually standard Base32 without padding and in capitals.
- Mixing alphabets gives errors or wrong bytes: decode with the same alphabet that encoded.
Frequently asked questions
Where is Base32 used?
The standard alphabet appears in one-time-password (TOTP) secrets that you type or scan, in onion-style names and in places where case-insensitive text is needed. Base32 is longer than Base64 (8 characters per 5 bytes) but safer to read aloud and type.
What is the difference between the three alphabets?
Standard Base32 uses A-Z and 2-7. base32hex uses 0-9 and A-V, so encoded values sort in the same order as the bytes. Crockford uses 0-9 and A-Z without I, L, O and U to avoid confusion, and has no padding.
Is padding required?
RFC 4648 pads to a multiple of 8 characters with =. Many systems omit it. This tool can add or leave it out when encoding and accepts both when decoding. Crockford never uses padding.
Does decoding care about letter case?
No, lowercase and uppercase are accepted. For Crockford, I and L are read as 1 and O as 0, and hyphens are ignored, as in its specification.
Is my data uploaded?
No. Everything is computed in your browser.