Base32 Encoder / Decoder

RFC 4648, base32hex, Crockford and z-base-32, with real validation

Runs in your browser
No signup
Embeddable
Productivity
Updated on May 5, 2026

What is Base32?

An encoding built to be typed and spoken without mistakes

Base32 represents binary data as text using 32 symbols, five bits per character. The standard RFC 4648 alphabet uses A-Z and 2-7, skipping the digits 0 and 1 precisely because they get confused with O and l. But Base32 is not a single thing: the same RFC defines a second variant, base32hex, with the 0-9A-V alphabet, whose alphabetical order preserves the numeric order of the bytes; Crockford defines a third alphabet, without I, L, O and U, which handles ambiguous letters on read and adds an optional check symbol; and z-base-32 permutes the symbols so the string is easier to read out loud. This tool implements all four, with explicit padding, input from text, hex or a file, and validation that points at the offending character instead of saying only invalid input.

How to use

Pick the variant, and everything else adjusts

Pick the variant. The options follow along: padding only shows up in the two RFC 4648 variants, and the check symbol only in Crockford. The alphabet in use stays visible under the output.
In the Encode tab, the input can be text, hexadecimal bytes or a local file. In the Decode tab you get the bytes back as text or hex, with warnings when the string has non-canonical trailing bits or missing padding.
In the TOTP secret tab, paste an authenticator key to see its bytes and bit length, or supply the bytes to get the unpadded secret that apps accept. In the Batch tab, process many lines at once and download as .txt or .csv.

The four variants

Same bit packing, different alphabets and rules

All four variants do exactly the same arithmetic: take the bytes, cut them into five-bit groups from the most significant bit down, zero-fill the last incomplete group and swap each value from 0 to 31 for a symbol. What changes is which symbol stands for which value, and what happens at the edges.

RFC 4648 defines the first two: the standard one, with A-Z and 2-7, and base32hex, with 0-9 and A-V. Both use the equals sign as padding until the length is a multiple of 8 characters. Crockford and z-base-32 skip padding, because they were designed for short values typed by people, not for concatenated blocks of data. Crockford further adds ambiguous-letter normalization and the check symbol; z-base-32 bets on a permutation chosen to reduce errors when the value is read out loud.

RFC 4648 standard: ABCDEFGHIJKLMNOPQRSTUVWXYZ234567, padded.
base32hex: 0123456789ABCDEFGHIJKLMNOPQRSTUV, padded.
Crockford: 0123456789ABCDEFGHJKMNPQRSTVWXYZ, no I, L, O or U.
z-base-32: ybndrfg8ejkmcpqxot1uwisza345h769, unpadded.

Diagnosis

What validation can actually say about a broken string

Rejecting input with the message invalid input hands the user the job of figuring out what happened. Here validation separates four distinct situations, and each points to a different fix: a character outside the alphabet (almost always an O typed instead of a zero, or a 1 instead of an I), an impossible length (the string got truncated on copy), malformed padding (the equals sign showed up in the middle, or in a run that does not exist) and, for Crockford, a check symbol that does not match.

Beyond errors there are two warnings that do not block decoding: non-canonical trailing bits and missing padding in a variant that defines it. Both mean the string came from an unconventional path, and both are usually harmless, but they explain why another program may refuse the very value that works here.

Character outside the alphabet: says which one.
Impossible length: a remainder of 1, 3 or 6 characters.
Malformed padding: equals sign away from the end, or in an invalid run.
Warnings: trailing bits not zeroed, missing padding, ambiguous letters normalized.

Embed

Use this tool on your site

Paste the code into your HTML and the tool shows up on your page, without J-Kit's navigation and ads. It still runs in the browser of whoever visits your site.

https://jkit.tools/embed/en-US/base32-encoder-decoderOpen

Size

Height (px)

Width

html

<iframe
  src="https://jkit.tools/embed/en-US/base32-encoder-decoder"
  width="100%"
  height="600"
  style="border:0"
  loading="lazy"
  title="Base32 Encoder / Decoder"
></iframe>

References

Sources and references for this tool

These references help contextualize formulas, standards, APIs and limitations used on this page. They do not replace professional validation when a result has legal, financial, medical or operational impact.

FAQ

Frequently asked questions

Which Base32 variant should I use?

If the other side says RFC 4648 without qualifying, it means the A-Z2-7 alphabet with padding. Use base32hex when the alphabetical order of the encoded text has to follow the numeric order of the data, which is the case for NSEC3 in DNSSEC. Use Crockford when the code will be read and typed by people and you want to catch errors on the spot with the check symbol. Use z-base-32 when the value will be spoken aloud. Picking the wrong one corrupts nothing, but the other side will not be able to decode it.

Why does Crockford turn O into 0 and I into 1?

What is the Crockford check symbol?

Is my 2FA secret Base32?

How long should a TOTP key be?

What does the non-canonical trailing bits warning mean?

What is the overhead of Base32?

Does Base32 protect my data?

Productivity

Related tools

An encoding built to be typed and spoken without mistakes

Pick the variant, and everything else adjusts

Pick the variant. The options follow along: padding only shows up in the two RFC 4648 variants, and the check symbol only in Crockford. The alphabet in use stays visible under the output.

In the Encode tab, the input can be text, hexadecimal bytes or a local file. In the Decode tab you get the bytes back as text or hex, with warnings when the string has non-canonical trailing bits or missing padding.

In the TOTP secret tab, paste an authenticator key to see its bytes and bit length, or supply the bytes to get the unpadded secret that apps accept. In the Batch tab, process many lines at once and download as .txt or .csv.

Same bit packing, different alphabets and rules

RFC 4648 standard: ABCDEFGHIJKLMNOPQRSTUVWXYZ234567, padded.

base32hex: 0123456789ABCDEFGHIJKLMNOPQRSTUV, padded.

Crockford: 0123456789ABCDEFGHJKMNPQRSTVWXYZ, no I, L, O or U.

z-base-32: ybndrfg8ejkmcpqxot1uwisza345h769, unpadded.