RFC 4648 · TOTP Secret Keys · Crockford Support

Base32 Converter & Decoder

Convert binary and text data to 5-bit Base32 representations. Decode two-factor authentication (TOTP) seed keys, Tor v3 onion addresses, and RFC 4648 test vectors.

Presets:

Base32 String

Decoded Output (UTF-8)

[Binary Data - Cannot decode to valid UTF-8 string]

Raw Hexadecimal Output (10 Bytes)

48656c6c6f21deadbeef

RFC 4648 Bit Architecture: Why 2FA Authenticator Apps Rely on Base32

The 5-Bit Quantization Mechanism

Whereas Base64 packs 6 bits per character ($2^6 = 64$), Base32 packs 5 bits per character ($2^5 = 32$):

Bit Alignment: 40 bits (5 bytes) map cleanly into exactly 8 Base32 characters.
Padding: If the input length in bytes is not divisible by 5, trailing padding equals signs (=) are appended to preserve byte length during deserialization.
Case Insensitivity: Unlike Base64 where a and A represent distinct values, Base32 is entirely case-insensitive, making it safe for case-folding file systems.

Why TOTP & Google Authenticator Use Base32

RFC 6238 specifies Base32 for Time-based One-Time Password (TOTP) seed configuration:

Voice & Keyboard Entry: If a smartphone camera fails to scan a QR code, a human can easily read aloud or type a 16-character Base32 secret (e.g. JBSWY3DPEHPK3PXP) without case confusion.
Exclusion of Confusing Digits: Digits 0, 1, and 8 are omitted from the standard alphabet, avoiding confusion with letters O, I, and B.

Crockford's Base32 Variant

Created by Douglas Crockford, this alternative alphabet includes 0-9 and A-Z while excluding I, L, O, and U (to prevent accidental obscenity generation). It explicitly maps I and L to 1, and O to 0 during decoding to forgive human typing mistakes.