Base32 Encode & Decode

What is Base32?

Base32 is a binary-to-text encoding that represents data using just 32 characters: the uppercase lettersA–Z and the digits 2–7. It is defined by RFC 4648, the same standard that defines Base64. Where Base64 packs data into 6 bits per character, Base32 uses 5 bits per character, producing a slightly longer string in exchange for a much friendlier character set.

That friendlier set is the whole point. Because Base32 avoids lowercase letters, the digits 0, 1, 8 and 9, and any punctuation, the result is case-insensitive, hard to mis-type, and safe to read aloud or print. You have almost certainly seen it without realising: two-factor-authentication (TOTP/2FA) secret keys, many file-hashing systems, and DNS-based encodings all rely on Base32.

How to use this tool

1. Encode: paste or type your text in the input box and press Encode →. The output is a Base32 string padded with = characters where needed.
2. Decode: paste a Base32 string into the input and press Decode ← to recover the original text.
3. Copy the result to your clipboard with a single click of the Copy button.

Spaces and line breaks in Base32 input are ignored, and lowercase letters are accepted too — they are treated the same as uppercase, exactly as RFC 4648 allows. If you paste something that contains characters outside the A–Z, 2–7 set (for example a 0, 1, or 8), the tool shows a clear error rather than producing garbage.

Base32 vs Base64 — which should I use?

Reach for Base64 when you want the most compact text encoding and the data is handled by machines, such as embedding an image in a data-URI or a token in JSON. Reach for Base32 when a human has to read, type, or dictate the value: it has no case sensitivity and no ambiguous characters, so there is no confusion between a lowercase “l” and the number “1”, or a capital “O” and a zero.

Is it private?

Completely. This converter runs as a small piece of JavaScript directly inside your browser tab. There is no server call, no logging, and no upload — your input is processed on your own device and disappears the moment you close the page. That makes it safe to use even for sensitive values like 2FA seed keys, which you should never paste into a site that transmits them.

Frequently asked questions