Encode data as Base32 (RFC 4648) using the case-insensitive A-Z 2-7 alphabet found in TOTP authenticator secrets, DNS records and Onion addresses. The base32hex variant is supported too.
Show calculation steps
Processed privately in your browser — nothing you paste is uploaded, logged or stored.
When Base64 is the wrong shape
Base32 encodes five bytes as eight characters using only A-Z and 2-7. It is bulkier than Base64 — 60 per cent overhead against 33 — and it buys something Base64 cannot offer: a case-insensitive alphabet with no punctuation, which survives being typed, spoken and stored in systems that fold case.
Worked example
"Hi" → JBUQ==== 5 bytes → 8 characters, padded to a multiple of 8 with =
Where it is used
Authenticator secrets are the everyday case: the string you type into a TOTP app is Base32 precisely because people transcribe it by hand. It also appears in DNS records, in Onion addresses, and anywhere an identifier has to be read aloud without ambiguity.
The alphabet is the point
RFC 4648 excludes 0, 1 and 8 because they are confusable with O, I and B. What remains is 32 symbols that stay distinct in most typefaces and in speech, which is the entire reason to accept the extra size.
Limits
Base32 is an encoding, not encryption: anyone can decode it. A TOTP secret in Base32 is still a secret in plain text. Encoding runs in your browser, which matters given how often these strings are exactly the ones that should not be pasted elsewhere.
How to use the Base32 Encoder
- Paste the text or secret you want to encode.
- Choose the variant: standard RFC 4648 (A-Z and 2-7) for TOTP and most uses, or base32hex when a system asks for the 0-9 A-V alphabet.
- Adjust padding and letter case if the target system is fussy about them.
- Click "Encode to Base32" and copy the result.
Frequently asked questions
Why does Base32 exist when Base64 is shorter?
Because Base32 is case-insensitive and avoids easily confused characters, so it survives being spoken aloud, handwritten, typed on a phone keypad or stored in a case-insensitive system such as DNS. The trade-off is size: Base32 output is about 60 percent larger than the input, versus 33 percent for Base64.
Where will I actually meet Base32?
Most commonly in two-factor authentication: the secret behind an authenticator app QR code is Base32. It also appears in Tor onion addresses, some DNS record formats and in the base32hex form inside NSEC3 records.
Why are there no 0, 1, 8 or 9 in the alphabet?
Standard Base32 uses A-Z plus the digits 2-7 precisely because 0 and 1 are visually confusable with O and I. Removing them makes transcription errors far less likely – the same motivation behind Base58.
What is the base32hex variant for?
It uses 0-9 followed by A-V, an ordering that preserves the sort order of the underlying data. That property matters in DNSSEC NSEC3 records, where records must remain sortable after encoding.
