Working with an authenticator secret, a case-insensitive token, or a string that needs to survive being typed out by hand? This free base32 encoder and decoder converts text to RFC 4648 Base32 and back, with the padding handled for you. Everything runs in your browser, so nothing is uploaded, no account is needed, and no signup stands between you and the result.
How to use this base32 encoder and decoder
Three quick steps — no signup, no cost.
Encode plain text into Base32, or decode a Base32 string back into readable text.
For decoding, lowercase input is accepted and stray whitespace is ignored; the decoder uppercases and re-pads as needed.
Encoded output uses only A–Z and 2–7 plus = padding, so it survives systems that fold case or dislike symbols.
Why this base32 encoder and decoder fits human-handled strings
Built for secrets and tokens that people actually type.
Only A–Z and 2–7, with = padding to a multiple of 8 characters — the same format authenticator apps and other standard tools expect.
There is no 0, 1, O, or I in the alphabet, so nothing gets confused with something else when a string is read aloud or copied by hand.
Decoding accepts lowercase and missing padding, but rejects characters outside the alphabet with a clear error instead of returning garbage.
Base32 expands data by roughly 60% — 8 output characters for every 5 input bytes — so longer output than the input is normal, not a bug.
A warning before you paste a real secret into any encoder
Encoding is not protection — and a live secret deserves more care than a test string.
Base32 is not encryption. Anyone can decode a Base32 string back to the original in one step, with no key and no password. It changes how data looks, not who can read it, so never use it to ‘protect’ sensitive information.
Authenticator secrets are sensitive. The shared secret behind a two-factor app is almost always stored as Base32, and anyone holding it can generate your codes. This tool runs entirely in your browser, so a pasted secret never travels to a server — but prefer a test secret over a live one whenever you are just checking a format.
Decoding refuses bad bytes instead of guessing. If decoded bytes are not valid UTF-8 text, or the input contains characters outside A–Z, 2–7, and =, you get a clear error rather than mojibake. That strictness is deliberate: silently returning wrong bytes would be worse than failing.
Base32 Encoder and Decoder FAQs
Short, direct answers to the questions readers ask most.
The RFC 4648 alphabet: uppercase A–Z and digits 2–7, 32 characters in total, with = as padding.
Padding brings the output length to a multiple of 8 characters, because 5 input bytes map to exactly 8 output characters. A shorter final block is zero-filled and padded back up.
No. Base64 has a larger alphabet and shorter output, but Base32 is case-insensitive and friendlier for humans typing or reading a string.
No. It is purely a representation format — anyone can decode it instantly, so it must never be used to protect sensitive information.
Yes. It runs entirely in your browser with no account, no signup, and nothing uploaded.
Related Tools
More free converters that work the same way — right in your browser.
Decode Base64 data back into an image file.
Image to Base64 ConverterEncode an image as Base64 text for embedding.
JSON to TXT ConverterFlatten JSON data into plain text.
TXT to CSV ConverterTurn plain-text rows into a CSV table.
Try the related tools above, or go back to the Convertion homepage for more free converters.
