Base32 Encode / Decode
RFC 4648 Base32 encoding, often used for Google Authenticator keys
Base32: why TOTP secrets use it instead of Base64
Base32 and Base64 side by side
Both map binary data to printable characters; they differ in alphabet size and how many bits each character carries:
| Base64 | Base32 | |
|---|---|---|
| Alphabet | 64 chars: A-Z a-z 0-9 + / | 32 chars: A-Z 2-7 |
| Bits per char | 6 bits | 5 bits |
| Size overhead | about 33% | about 60% |
| Case sensitive | Yes | No |
| Confusable chars | Yes (0/O, 1/l/I) | None (digits only 2-7) |
Base32 is clearly the more wasteful of the two — the same data comes out over 20% longer than Base64. What it buys in return is case-insensitivity, no easily confused characters, and confidence when the value is typed or read aloud by a human. When the encoded result must be keyed in by hand, that trade-off is worth paying for.
Why TOTP chose Base32
Authenticator apps (Google Authenticator, Authy and similar) encode their shared secret in Base32 by specification (RFC 4648 / RFC 6238). The reason is exactly the point above: the secret is frequently entered or copied by hand, and being case-insensitive and free of the characters 0 and 1 — the two most easily confused with letters — sharply reduces transcription mistakes.
If you see an all-uppercase string made only of A-Z and 2-7, at a common length of 16, 26 or 32 characters, you can be confident it is Base32 rather than any kind of ciphertext. Because Base32 is case-insensitive, it makes no difference whether a user types or copies the secret in capitals or in lowercase, which removes a whole class of entry mistakes. Its digits run only from 2 to 7, none of which resembles a letter, so a slip of the eye is far less likely to produce a valid-looking but incorrect key. It carries no secrecy of its own; its safety comes from the TOTP algorithm and from the randomness of the key.
Padding rules
Base32 encodes every 5 bytes (40 bits) into 8 characters. When the input is short of 5 bytes, = pads the end:
| Input bytes | Output chars | Padding |
|---|---|---|
| 1 | 2 | ====== |
| 2 | 4 | ==== |
| 3 | 5 | === |
| 4 | 7 | = |
| 5 | 8 | none |
TOTP secrets usually omit the padding, and the decoder restores it from the length. There is also a Crockford variant that changes the alphabet to 0-9 A-Z by dropping I L O U, for settings that need even stronger resistance to misreading.
The tool supports standard Base32 and Base32hex, encoding and decoding in both directions, entirely in your browser.
FAQ
What is the difference between Base32 and Base64?
Base32 uses only uppercase letters and digits 2-7, avoiding easily confused characters like 0 O 1 I. It is about 60% larger and suits manual transcription such as authenticator keys.