Skip to content
BCBinary Code Translator
Menu

RFC 4648 encoding tool

Base32 Encoder / Decoder

Convert UTF-8 text to RFC 4648 Base32 and decode Base32 back to text with optional equals-sign padding, strict alphabet checks, and canonical unused-bit validation.

Every byte is processed on this device; the page makes no conversion request to an external service.

Conversion direction
0 characters
0 characters

Conversion runs locally in this browser. The input is not uploaded.

No result yet.

What RFC 4648 Base32 is

Base32 is a binary-to-text encoding that represents arbitrary bytes with the letters A through Z and the digits 2 through 7. It is defined in RFC 4648 alongside Base16 and Base64. Five input bits become one output character, so the alphabet needs exactly thirty-two symbols. The result is longer than Base64, but it avoids punctuation, is usually easy to read aloud, and works in environments that prefer case-insensitive alphanumeric identifiers.

This page treats the source as Unicode text and converts it to UTF-8 bytes before Base32 encoding. That detail matters for accented letters, CJK text, emoji, and every character outside plain ASCII. A converter that encodes JavaScript UTF-16 code units directly can produce values that no other UTF-8 tool understands. Decoding follows the reverse path: Base32 symbols become bytes, and the bytes must form valid UTF-8 before they are displayed as text.

The padding switch controls only the trailing equals signs. RFC 4648 pads output to a multiple of eight characters, but many systems omit padding when the length is already known. The decoder accepts both forms while still checking that the final unused bits are zero. That canonical check prevents several different strings from silently representing the same byte sequence.

How to use the Base32 converter

  1. Choose Encode when the input is normal text, or Decode when the input already uses the Base32 alphabet.
  2. For encoding, decide whether the receiving system expects RFC-style equals-sign padding. Leave padding enabled when a protocol explicitly requires fixed eight-character blocks.
  3. Enter or paste the value. Conversion updates in the browser, and an error is shown instead of guessing when the alphabet, length, padding, or UTF-8 bytes are invalid.
  4. Compare the result with one of the official vectors or Unicode examples. This is useful when validating another library, command-line tool, or API implementation.
  5. Copy the result or swap direction to verify a round trip. A successful round trip confirms text recovery, but it does not prove that a separate protocol uses the same padding policy.

Base32 examples and official vectors

These examples combine RFC 4648 test vectors with Unicode and padding cases. Use the example buttons above to reproduce each conversion with the relevant direction and option.

Input Output Conversion direction Notes
f MY====== Encode Include padding: With padding — RFC vector: one byte. A one-byte input leaves two significant Base32 characters and therefore uses six padding characters.
foobar MZXW6YTBOI====== Encode Include padding: With padding — RFC vector: foobar. This is the longest text vector published in RFC 4648 section 10.
Hello JBSWY3DP Encode Include padding: Without padding — Unpadded text. The data characters are unchanged; only the optional trailing equals signs are omitted.
jbswy3dp Hello Decode Decode lowercase input. The decoder accepts lowercase letters even though canonical RFC 4648 output is uppercase.
你好 4S62BZNFXU====== Encode Include padding: With padding — Unicode UTF-8. Chinese characters are first encoded as six UTF-8 bytes, not truncated to 16-bit code units.
Encode Include padding: With padding — Empty value. An empty byte sequence has an empty Base32 representation and requires no padding.

Accepted input, padding, and canonical form

Encoding accepts any well-formed JavaScript string and uses the browser’s UTF-8 encoder. Decoding accepts A-Z, 2-7, optional lowercase letters, and an optional trailing run of equals signs. Spaces and line breaks are rejected deliberately because RFC 4648 does not require decoders to ignore arbitrary formatting characters. Removing whitespace automatically can hide copy errors in secrets or identifiers.

Unpadded lengths are not arbitrary. The number of data characters modulo eight can be 0, 2, 4, 5, or 7. Other remainders cannot correspond to a whole number of bytes. When padding is present, its count must match the final quantum: six, four, three, one, or zero equals signs respectively.

  • Canonical encoder output uses uppercase A-Z and digits 2-7.
  • Padding may appear only at the end and the total padded length must be divisible by eight.
  • The digits 0, 1, 8, and 9 are not part of the RFC 4648 alphabet.
  • Non-zero leftover bits are rejected instead of being discarded.
  • Decoded arbitrary binary data may fail when it is not valid UTF-8 text.

How the Base32 algorithm processes bytes

The encoder reads the UTF-8 byte stream from left to right and collects bits in a small buffer. Whenever at least five bits are available, it removes the next five-bit value and uses that value as an index in the Base32 alphabet. If the final byte does not end on a five-bit boundary, the remaining bits are shifted toward the high side and zero bits fill the unused positions. Optional padding then extends the character count to an eight-character boundary.

The decoder maps every symbol back to a value from zero to thirty-one, appends those five bits to its buffer, and emits a byte whenever eight bits are available. The bytes are not interpreted as ASCII; they are decoded with a strict UTF-8 decoder. This distinction is why a string such as 你好 can round-trip correctly even though each character needs three UTF-8 bytes.

Strict validation happens before and after the bit loop. The parser checks the alphabet, allowable remainder, and exact padding count. At the end it verifies that bits which did not contribute to a complete byte are zero. RFC 4648 calls for rejecting non-alphabet characters unless a referring specification explicitly says otherwise, so this tool favors predictable protocol testing over permissive cleanup.

When Base32 is a practical choice

Base32 is useful when a value must remain text-only but punctuation or case sensitivity is inconvenient. It is not encryption and it does not provide integrity, so applications often combine it with a checksum, MAC, or a protocol-specific wrapper.

Use case Description
TOTP and authenticator secrets Many one-time-password provisioning systems display shared secret bytes as unpadded Base32 because users may need to type the value manually.
Case-insensitive identifiers Uppercase letters and a restricted digit set survive systems that fold case or treat punctuation inconsistently.
DNS-oriented encodings Base32 variants are sometimes used in labels or distributed systems, although the exact alphabet may differ from RFC 4648.
Test fixtures and protocol debugging Official vectors make Base32 convenient for checking byte boundaries, padding behavior, and interoperability between libraries.
Human-visible binary values The alphabet avoids easily confused 0 and 1, though long strings still need careful copying and should not be treated as error-correcting.

Common Base32 errors and boundaries

Most failures come from mixing alphabets, copying incomplete data, or applying a padding policy from a different system. A value can look plausible while still ending in an impossible number of symbols. The converter reports that condition instead of adding or deleting data characters.

A second boundary appears after decoding: Base32 represents bytes, not necessarily text. If the bytes are a compressed file, key, hash, or random secret, they may not be valid UTF-8. This text-focused page then reports an invalid UTF-8 result; a byte-oriented application should keep the decoded Uint8Array instead.

  • Using 0 or 1 where O or I was intended produces an invalid-character error.
  • A single data character cannot encode a complete byte and is rejected.
  • Padding in the middle of a value is always invalid.
  • Changing the final symbol can create non-zero unused bits even when the visible length looks correct.
  • Base32 output is not confidential and can be decoded by anyone.

Choose an encoding based on the transport constraints, not on visual preference alone. Base32 spends more characters to obtain a smaller and more transcription-friendly alphabet. Base64 is denser, while Base58 removes visually ambiguous characters but uses big-integer conversion rather than fixed bit groups.

Do not assume that every string called Base32 uses this alphabet. Crockford Base32, base32hex, z-base-32, and protocol-specific variants choose different symbols or error-handling rules. This page implements the standard RFC 4648 alphabet only.

Format Description
Base64 Base64 encodes six bits per character and is shorter, but its + and / characters can need special handling in URLs and filenames.
Base58 Bitcoin Base58 omits 0, O, I, and l and preserves leading zero bytes as 1, but it has no RFC 4648 padding model.
Hexadecimal Hex is simpler and maps each byte to exactly two characters, yet it is about sixty percent longer than Base32 for the same bytes.

Base32 encoder and decoder FAQ

Is this standard RFC 4648 Base32?

Yes. The encoder uses the RFC 4648 alphabet A-Z and 2-7. It can emit standard equals-sign padding or omit it, and the decoder accepts lowercase input while validating the same byte representation.

Why does Base32 sometimes end with several equals signs?

Each Base32 character carries five bits, while input arrives in eight-bit bytes. Padding fills the final eight-character block when the byte count does not align with forty bits. The equals signs carry no data.

Can I decode an unpadded Base32 secret?

Yes, provided its data-character length has a valid remainder and the unused bits are zero. Many authenticator secrets omit padding, so the decoder does not require equals signs.

Why are spaces rejected instead of ignored?

RFC 4648 recommends rejecting characters outside the alphabet unless another specification says to ignore them. Strict handling makes damaged or reformatted identifiers easier to detect.

Does Base32 protect a password or secret?

No. Base32 is reversible encoding, not encryption, hashing, or access control. A TOTP secret displayed as Base32 remains sensitive because anyone who obtains it can decode or use it.

Why can a valid Base32 string fail as text?

The encoded value may represent arbitrary bytes rather than UTF-8. This page is a text converter and therefore requires decoded bytes to be valid UTF-8; byte-oriented software may still accept the same Base32 data.

Related encoding tools

View all tools

Cookie Preferences

Manage your cookie preferences. Necessary cookies cannot be disabled.

Necessary

Required

Required for language selection, privacy choices, and basic site functionality.

Cookies: NEXT_LOCALE

Analytics

Optional analytics cookies help us understand traffic and improve the website.

Cookies: _ga, _gid, _gat, _clck, _clsk

Advertising

Optional advertising cookies may be used to show relevant ads and measure performance.

Cookies: __gads, _gcl_au, IDE