Contact

Tools  /  Encoding  /  Base32 Encoder / Decoder

ENCODING

Base32 Encoder / Decoder

Encode and decode Base32 — RFC 4648, base32hex, Crockford and z-base-32, with a TOTP-secret helper.

More Encoding tools

Base58 Decoder Hex Encoder Hex Decoder URL Encoding Tester Base64 Encoder / Decoder URL Encoder / Decoder

What this tool does

Text or a binary file converts to Base32 and back, in whichever of four real alphabets the situation calls for — not just the one most tools default to.

Four alphabets, because Base32 is not one fixed standard

  • RFC 4648 (standard) — the common A-Z2-7 alphabet most software means by "Base32."
  • base32hex — an RFC 4648 variant ordered so that sorting the encoded text sorts the original data the same way, which the standard alphabet does not guarantee.
  • Crockford's Base32 — designed to be typed and read by a person: it drops visually similar letters and treats O as 0 and I/ L as 1 automatically when decoding, so a small transcription slip still works.
  • z-base-32 — arranges its alphabet so the most common characters are the easiest to say and write, aimed at the same human-readability goal from a different angle.

Generating a real 2FA secret key

Authenticator apps store a TOTP secret key as Base32 — it is the standard representation for that specific value. A button generates one directly: a genuine random 160-bit key from the browser's cryptographic random number generator, formatted in the standard RFC 4648 alphabet the way an authenticator app expects to receive it, rather than base32-encoding arbitrary typed text and hoping it happens to be suitable.

Text or a file, either direction

Encoding accepts typed text or a binary file's actual bytes, and decoding can produce a real downloadable file, not just decoded text — a full round trip. Padding, letter case, character grouping, and line wrapping are all controlled independently, and decoding is lenient about whitespace and separators already present in pasted input.

Privacy

Encoding, decoding, and secret generation all happen in your browser. Nothing you paste, drop, or load is sent to a server.

FAQ

Frequently asked questions

Is my data uploaded anywhere?
No. Encoding, decoding, and secret generation all run locally in the browser — nothing is sent to a server.
Why are there four different Base32 alphabets?
RFC 4648 is the common default. base32hex reorders the alphabet so sorted encoded text matches the sort order of the original data. Crockford's Base32 and z-base-32 both prioritize human readability, in different ways, over matching a byte-for-byte standard.
What is Crockford's Base32 and why is it more typo-tolerant?
It drops visually similar letters from its alphabet and, when decoding, automatically treats a typed O as 0 and I or L as 1 -- so a small misreading or mistyping during manual entry still decodes correctly instead of failing outright.
Can this generate a real 2FA or TOTP secret key?
Yes — a button generates a genuine random 160-bit key using the browser's cryptographic random number generator, formatted in standard RFC 4648 Base32 the way an authenticator app expects a secret key to look, rather than encoding arbitrary text.
Can it encode or decode a binary file, not just typed text?
Yes — encoding can read a file's actual bytes directly, and decoding can produce a real downloadable binary file, completing a full round trip rather than working with text alone.
Does it handle formatting differences like padding and grouping?
Yes — padding, letter case, grouping characters with a separator at a chosen interval, and line wrapping are all controlled independently, and decoding tolerates whitespace and separators already present in pasted input.
Theme Accent