Updated · Built and checked by the PlinzoTools team, formulas tested against published sources
Encode text to Base32, or decode Base32 back to text.
JBSWY3DPEE======Base32 encodes binary data using a 32-character alphabet (A-Z and 2-7), designed to be safely read aloud, typed by hand, or used in case-insensitive systems -- unlike Base64, which uses both uppercase and lowercase letters plus symbols. Base32 is the format behind TOTP (time-based one-time password) secret keys used by authenticator apps.
Choose Encode or Decode, then enter text (to encode) or Base32 (to decode). Output updates instantly, padded with = characters to a multiple of 8 as the RFC 4648 standard requires.
Base32 packs input bytes into 5-bit groups (since 32 = 2^5), each mapped to one of 32 alphabet characters (A-Z, 2-7). This produces roughly 60% more output than the original input length, more than Base64's ~33% overhead, in exchange for being case-insensitive and avoiding visually ambiguous characters.
For the more common, more compact Base64 encoding, see the Base64 Encoder/Decoder.
Encode the four-letter text "Hi!!" and watch how the padding appears. The tool converts the text to its UTF-8 bytes, joins them into one long string of bits, and cuts that string into 5-bit groups. Any final group that is short is filled with zero bits on the right. Each group then becomes one character from the alphabet A to Z followed by 2 to 7. Finally, equals signs are added until the total length is a multiple of eight. Because four bytes are 32 bits, and 32 does not divide evenly by 5, the last group is padded and the result ends with equals signs. A five-byte input, by contrast, is 40 bits and encodes to exactly eight characters with no padding at all.
output length = 8 x ceiling(input bytes / 5) characters
The encoder works on bytes, not on letters. Plain English text uses one byte per character, but characters outside basic ASCII, such as accented letters, currency symbols or emoji, take two to four bytes in UTF-8. That means the same visible length can produce a longer Base32 string when non-English characters are present. On the decoding side the tool interprets the recovered bytes as UTF-8 text. If the bytes are not valid UTF-8, you will see an error message instead of garbled output, which usually means the Base32 string represents binary data such as a key or a file rather than readable text.
When you decode, the tool trims surrounding whitespace, converts the input to upper case, and removes trailing equals signs before reading it. So lower-case pasted strings work fine, and missing padding is not a problem. It will, however, reject any character outside the alphabet. The digits 0, 1, 8 and 9 are not part of Base32, and neither are lower-case-only tricks or punctuation. Spaces or hyphens inside the string, which some authenticator apps add for readability in groups of four, will trigger an invalid character message, so remove them before decoding. That grouping convention is a display choice by the app, not part of the encoding itself.
If you are inspecting a real two-factor secret, remember that it is equivalent to a password for generating your login codes. Prefer a throwaway test value while learning, and do not share screenshots of live secrets. The conversion here runs in your browser, but good habits matter regardless of where a tool runs.
Since eight output characters carry five input bytes, the encoded form is about 1.6 times the size of the original. If you are deciding whether Base32 will fit into a field with a character limit, divide the limit by 1.6 and round down to the nearest multiple of five to estimate how many raw bytes you can store. Remember to leave room if your system requires the equals padding to be present, and check whether it accepts unpadded values. Different libraries handle padding differently, so if another program rejects this tool's output, compare how each treats the trailing equals signs.
Base32's alphabet is case-insensitive and excludes visually ambiguous characters (like 0/O and 1/I/l), making it more reliable for humans to read, type, or speak aloud -- exactly why authenticator app secret keys use it.
Padding, so the output length is always a multiple of 8 characters, as the RFC 4648 standard specifies -- some implementations omit padding, but this tool includes it for strict compliance.
No -- like Base64, it's an encoding, not encryption. Anyone can decode it instantly; it provides no confidentiality or security on its own.
The bytes hidden in the Base32 string are not readable text. This is normal for random keys and binary data, which cannot be shown as a text string.
Yes. The tool converts input to upper case first, and it also accepts strings with the trailing equals signs removed.
Base32 uses only A to Z and 2 to 7. Digits 0, 1, 8, 9, spaces, hyphens and other symbols are not valid. Remove any grouping spaces or dashes and try again.
Eight characters for every five input bytes, rounded up, with equals signs filling the last group. Text containing accented characters or emoji uses more bytes, so the output is longer.
Reference: MDN Web Docs