Base32 Encode

What the Base32 encoder does

This takes your text and rewrites it in Base32, a way of writing data using just 32 plain characters. Type or paste your text, choose a variant if you need one, press Convert, and copy or download the result. To go the other way, from Base32 back to text, the Base32 Decode tool handles that.

It all runs in your browser, so nothing you type is uploaded.

How to use it

1. Enter your text. Type or paste it, or upload a plain text file.
2. Pick a variant. Standard Base32 is the default and the right choice unless you specifically need one of the others. More on that below.
3. Press Convert. The Base32 output appears, ready to Copy or Download.

What Base32 is, and why the small alphabet

Base32 is a cousin of Base64, built on a deliberately smaller and safer set of characters. Standard Base32 uses just the 26 uppercase letters A to Z and the six digits 2 to 7, and nothing else. That is 32 characters, which is where the name comes from.

The point of that small alphabet is people. Base32 is case-insensitive, so it does not matter whether it is typed in capitals or lowercase, and it leaves out the characters that trip humans up. There is no lowercase l to confuse with the digit 1, no capital O to muddle with zero, and none of the + or / that Base64 carries. The trade is size: because each character carries fewer bits, a Base32 string is about 60 percent longer than the original, where Base64 adds only a third. So you reach for Base32 not when you want the most compact result, but when a human might have to read, type, or read out the string without making a mistake.

Where you have already met it: your 2FA secret

You have almost certainly used Base32 without knowing it. When you set up two-factor authentication and the app offers a code to type in by hand instead of scanning the QR, that string, something like JBSWY3DPEHPK3PXP, is Base32. Google Authenticator, Authy, Microsoft Authenticator, and the rest all share their secret key in Base32 for exactly the reason above: you might have to key it in yourself, and the format is built so you can do that without mixing up a zero and an O. That is the everyday face of this encoding, and it is why a Base32 tool is handy to have around.

The three variants

The dropdown offers three flavours of Base32, and they differ only in which characters they use.

• Standard (RFC 4648). The A to Z, 2 to 7 alphabet described above. This is the common one, and the one your 2FA secrets use. If you are unsure, pick this.
• Base32hex. Uses 0 to 9 and A to V instead. Its trick is that encoded strings sort in the same order as the original data, which is handy for database keys and sortable identifiers.
• Crockford's Base32. Designed by Douglas Crockford, the same person behind the JSON format, to be as human-proof as possible. It drops the letters I, L, O, and U to avoid confusion and rude words, and is popular for user-facing IDs.

How it works

Where Base64 slices data into 6-bit pieces, Base32 slices it into 5-bit pieces, because 5 bits give exactly 32 possible values, one for each character. It works in blocks of five bytes: five bytes are 40 bits, which divide neatly into eight 5-bit groups, so every five bytes of input become eight characters of output. As a quick example, the word "Hello" encodes to "JBSWY3DP" in standard Base32. When the data does not fill the last block, the output is padded with = signs to keep the length a tidy multiple of eight.

The library doing the work

The encoding here is handled by base32.js, a JavaScript library that implements all three variants, the standard RFC 4648 alphabet, the hex alphabet, and Crockford's. Your text is first turned into bytes, and the library maps those bytes onto the 32-character alphabet you chose. It is a small, focused piece of code that does one job well.

Questions people ask

How is Base32 different from Base64?

Base32 uses 32 characters and is case-insensitive, leaving out look-alikes like 0 and O. Base64 uses 64 and is case-sensitive, so it is more compact but harder for a person to type correctly. Base32 trades size for safety when a human handles the string.

Is this the same Base32 as my authenticator app?

Yes, if you use the Standard (RFC 4648) variant. That is the format authenticator apps use for the secret key you can type in by hand.

Which variant should I choose?

Standard, unless you have a specific reason not to. Use Base32hex if you need encoded values to sort in order, and Crockford if you want the most human-readable identifiers.

Why does the output end in = signs?

That is padding. Base32 works in blocks of eight characters, and = signs fill out the last block when the data does not divide evenly. They are not part of your text.

References

1. Josefsson, S. (2006). RFC 4648: The Base16, Base32, and Base64 Data Encodings. Internet Engineering Task Force (IETF). https://www.rfc-editor.org/rfc/rfc4648
2. Crockford, D. Base32. https://www.crockford.com/base32.html
3. base32.js, a Base32 encoder and decoder for JavaScript (npm package). https://www.npmjs.com/package/base32.js