Best 3 Base32 Encoder Tools Compared

Someone hands you a string like JBSWY3DPEHPK3PXP and you need to know what is inside it. Or you have a value that a device expects in Base32 and you need it encoded correctly, padding and all.

The catch is that “Base32” is not one thing. There is the RFC 4648 standard alphabet, the extended-hex variant, and Crockford’s version — and a tool that only speaks one of them will hand you a plausible-looking string that fails on the other end. Padding is the second trap: some tools add = characters, some strip them, and some systems reject either choice.

How to judge a Base32 tool

Which alphabet does it support? Standard RFC 4648 uses A-Z and 2-7. Base32hex uses a different ordering, and Crockford drops the letters that look like digits. Mismatched alphabets decode to garbage, not to an error.

How does it handle padding? The = characters pad the string to a multiple of eight. Some parsers require them, others reject them, so being able to toggle padding matters more than it sounds.

Does the string stay on your machine? Base32 shows up most often around TOTP secrets, and a 2FA secret pasted into a server-side form is a secret you have shared. In-browser processing removes the question.

The comparison

Facts checked August 2026; tools change their plans. Table covers only the 3 alternatives — our tool gets its own section below.

Cryptii

Cryptii is built around a modular “pipes” idea: you stack conversion steps and watch the value flow through them, so Base32 can sit in the middle of a chain rather than being the whole job. It is MIT-licensed and open source, and states that operations run entirely in the browser with no server interaction. For decoding something in layers — Base32, then hex, then text — nothing else here comes close.

Its page does not spell out which alphabets are implemented, which is the one thing you want confirmed when a decode comes back as nonsense. For a plain RFC 4648 round-trip it is more interface than the task needs.

base32.utils.com

The most explicit of the three about the details that actually break things. It follows RFC 4648, offers a padding toggle between “With Padding (=)” and “No Padding”, and switches between the standard alphabet and Base32hex. It encodes and decodes as you type, and calls out the TOTP case directly: when you set up 2FA the secret arrives in Base32, and this decodes it for manual entry.

It is a single-string tool — the page mentions no file input — so a batch of values means pasting them one at a time. For the 2FA case that is exactly the right shape.

base64.sh Base32

Clean and fast for the common case: the RFC 4648 alphabet of A-Z and 2-7, padding handled automatically, and a clear statement that conversions happen in your browser and your data never leaves your device. It does not ask you any questions first.

Crockford’s Base32 is supported, but on a separate page rather than as a toggle, so you need to know which variant you are dealing with before you start. There is also no padding control — it is handled for you, which is convenient until the system on the other end wants the opposite.

Base32 Encoder Decoder

Ours encodes text to RFC 4648 Base32 and decodes a Base32 string back, with padding and alphabet options exposed rather than assumed, and it runs entirely in the browser — the value never goes to a server, which is the point when the value is an authenticator secret.

What it does not do: chain into other conversions the way Cryptii does, and it works on a pasted string rather than a file. If you are decoding a layered puzzle, or you have a directory of files to convert, this is the wrong shape of tool. The RFC 4648 specification is the reference if you need to check a variant’s exact alphabet.

Which one to pick

• Decoding a 2FA secret by hand — base32.utils.com or ours; both keep the string local and expose the alphabet.
• Base32 as one step in a longer decode — Cryptii, for the pipeline.
• Crockford Base32 specifically — base64.sh’s separate Crockford page.
• You need padding control and a plain round-trip — the tool below.

How to do it with Base32 Encoder Decoder

1. Open the Base32 Encoder Decoder and paste your text or Base32 string.
2. Pick the alphabet the receiving system expects.
3. Set padding on or off to match that system.
4. Copy the result, then paste it back the other way to confirm the round-trip.

The step-by-step version is in how to encode and decode Base32 strings. Other converters are in the tools directory.

You might also need

If the Base32 secret arrived inside a QR code rather than as text, the 2FA QR Decoder pulls the secret out of the image so there is something to decode in the first place.

Once you have the secret, the TOTP Code Generator turns it into the six-digit codes.

Frequently asked questions

Is there a free Base32 tool that doesn’t need an account?

All four here are free and none require an account. The more useful filter is where the string is processed — Cryptii, base64.sh and ours all state it happens in your browser.

Why does my decoded Base32 come out as nonsense?

Almost always an alphabet mismatch. Standard RFC 4648, Base32hex and Crockford use different character sets, so a string encoded with one and decoded with another produces valid-looking output that means nothing. Confirm the variant before blaming the string.

Do I need the = padding characters?

It depends on the receiving system. Padding brings the string to a multiple of eight characters; some parsers insist on it, others reject it outright. That is why a padding toggle is worth more than a tool that silently decides for you.

Final thought

Pick on alphabet support first. Almost every “Base32 is broken” moment is a variant mismatch, and a tool that lets you see and change the alphabet turns a twenty-minute mystery into one dropdown.

Try the free Base32 Encoder Decoder