Base32 Encoder / Decoder

Continue in the tool

More pages for this tool

base32 totp 2fa authenticator key

Base32 in 2FA authentication (TOTP)

When you scan a 2FA authentication QR code or type a manual key, you are using Base32. The TOTP protocol (RFC 6238) uses Base32 as the interchange format for secret keys because it is case-insensitive, has no ambiguous characters and is easy to type.

How TOTP uses Base32

The server generates 20 random bytes (160 bits) as the HMAC-SHA1 secret key. These bytes are encoded in Base32 to present to the user (e.g. JBSWY3DPEHPK3PXP). The authenticator app decodes the Base32 back to the original bytes and uses them as the key to calculate the HOTP every 30 seconds.

TOTP key example

TOTP key in Base32

Input: JBSWY3DPEHPK3PXP
Expected output: Bytes: 48 65 6c 6c 6f 21 de ad be ef

This is the key "Hello!\xde\xad\xbe\xef" encoded in Base32, classic RFC example.

Safe use

Input: context + tool result
Expected output: interpreted with limits and next steps

Use the result as technical or educational support, keeping the tool limits explicit in the workflow.

Full tool FAQ

Which Base32 variant should I use?

If the other side says RFC 4648 without qualifying, it means the A-Z2-7 alphabet with padding. Use base32hex when the alphabetical order of the encoded text has to follow the numeric order of the data, which is the case for NSEC3 in DNSSEC. Use Crockford when the code will be read and typed by people and you want to catch errors on the spot with the check symbol. Use z-base-32 when the value will be spoken aloud. Picking the wrong one corrupts nothing, but the other side will not be able to decode it.

Why does Crockford turn O into 0 and I into 1?

What is the Crockford check symbol?

Is my 2FA secret Base32?

How long should a TOTP key be?

What does the non-canonical trailing bits warning mean?

What is the overhead of Base32?

Does Base32 protect my data?

Frequently asked questions

Can I use this decoder to verify my 2FA keys?

Yes, to verify the Base32 format of a backup key. Never enter active 2FA keys into unknown websites. In this case, decoding is performed entirely in your browser, no data is sent to any server.

Does this page replace official or professional review?

No. It helps explain the scenario and use the tool more safely, but real decisions should consider official sources, full context and qualified guidance when needed.

Next steps