Base32 encoder and decoder

Encode text to RFC 4648 Base32, or decode Base32 back to text, right in your browser.

How do I encode text to Base32?

Type or paste your text and this tool encodes it to RFC 4648 Base32 using the standard A to Z then 2 to 7 alphabet with equals-sign padding. Switch to Decode to turn Base32 back into text; lowercase letters and missing padding are accepted. It all runs in your browser, so nothing is uploaded.

What Base32 is

Base32 is a way of writing any data as plain text using just 32 characters: the uppercase letters A to Z and the digits 2 to 7. Computers store data as bytes, and bytes can include values that are not safe to type, paste or print. Base32 solves that by turning every 5 bits of the data into one of those 32 friendly characters, so the result travels safely through systems that only expect ordinary text. This tool encodes any text you type into Base32, and decodes Base32 back into the original text, all inside your browser.

The scheme used here is the standard defined in RFC 4648. The output is padded with equals signs so its length is always a multiple of 8 characters, and decoding accepts lowercase letters and works even if the padding is missing.

Base32 of "foobar"
MZXW6YTBOI======
Base32 of "fo" and "foo"
MZXQ==== and MZXW6===

Base32 compared with Base64

Base64 does a similar job but uses 64 characters, including lowercase letters and a couple of symbols. Because it packs 6 bits per character rather than 5, Base64 is more compact: it grows data by about a third, while Base32 grows it by about three fifths. So why use Base32 at all? Its alphabet is case-insensitive and leaves out characters that people confuse, such as 0 and O or 1 and I. That makes Base32 far easier to read aloud, type by hand, or print on a label without mistakes, which matters more than saving a few characters in many real situations.

Base32 of a single "f"
MY======

Where you will meet Base32

The most common place is two-factor authentication. When an app shows you a secret key to set up a TOTP code in an authenticator, that key is Base32, precisely because you sometimes have to type it in by hand and its forgiving alphabet reduces errors. You will also see Base32 in some APIs and identifiers where the value needs to be case-insensitive or URL-friendly, and in parts of the DNS system, where the character set for certain records is limited. In each case the point is the same: represent raw bytes as text that survives being copied, typed and read by people.

One thing Base32 is not is a security measure. It scrambles nothing and hides nothing, because anyone can decode it back to the original without a key. If you paste a 2FA secret in here to check it, treat that secret as sensitive: it is the seed to your codes. This tool never sends anything anywhere, so the check stays on your device, but do not share the decoded value.

How the conversion runs

Everything happens locally in your browser with plain JavaScript. When you encode, your text is first turned into UTF-8 bytes, which is why letters with accents or emoji encode correctly, and those bytes are regrouped into 5-bit chunks and mapped to the alphabet. When you decode, the reverse happens: the characters become 5-bit values, those are packed back into bytes, and the bytes are read as UTF-8 text. Nothing is uploaded, logged or stored, so you can use it freely with strings you would rather keep to yourself.

How we work it out

Encoding turns the UTF-8 bytes of your text into 5-bit groups, each mapped to the RFC 4648 alphabet (A to Z, then 2 to 7), padding the output to a multiple of 8 characters with equals signs. Decoding reverses this, tolerating lowercase input and missing padding, rebuilds the bytes and reads them back as UTF-8. Any character outside the alphabet is reported as an error.

Frequently asked questions

Is my text sent anywhere?

No. The encoding and decoding run entirely in your browser with plain JavaScript. Your text is never uploaded, logged or seen by anyone, so it is safe to use with private strings.

What is the difference between Base32 and Base64?

Both turn bytes into printable text, but Base32 uses a 32-character alphabet of uppercase letters and the digits 2 to 7, while Base64 uses 64 characters including lowercase and symbols. Base32 is longer for the same data but is case-insensitive and avoids easily confused characters, which makes it friendlier for humans to type or read aloud.

Can I decode lowercase Base32?

Yes. Base32 is case-insensitive, so this tool converts your input to uppercase before decoding and also ignores spaces and line breaks. Missing padding is filled in automatically, so a string without its trailing equals signs still decodes correctly.

Why do I sometimes see equals signs at the end?

They are padding. Base32 works in blocks of 8 characters, so when the data does not fill the last block exactly, equals signs pad it out. The padding carries no data and is optional when decoding, but including it keeps the output a valid multiple of 8 characters.

Is Base32 a form of encryption?

No. Base32 is an encoding, not encryption. Anyone can decode it back to the original text without a password, so it offers no secrecy. Use it to represent binary data as safe text, and use a real cipher if you need to keep something private.

Related tools