Base32 & TOTP Tools
Encode or decode Base32 strings, and verify whether a 6-digit TOTP authentication code is currently valid. All computation happens in your browser.
Or generate a new code for this secret key: use the 2faco TOTP generator →
Base32 Encoder / Decoder & TOTP Verifier — FAQ
What is Base32?
Base32 is a text encoding scheme that represents binary data using a 32-character alphabet (A–Z and 2–7). It is defined in RFC 4648 and is most commonly used for TOTP secret keys, because the alphabet is case-insensitive and avoids confusing characters like 0, 1, 8 and 9.
Why do TOTP secret keys use Base32?
Authenticator apps and services use Base32 for 2FA secrets because it is human-friendly: keys can be typed without case confusion, and they survive phone keypads and QR code transcription. A typical 2FA secret like JBSWY3DPEHPK3PXP is a Base32 string.
How do I verify a TOTP code?
Paste your Base32 secret key into the Verify tab, enter the 6-digit code, and press Verify Code. The tool checks the current 30-second window plus the previous and next windows to tolerate minor clock drift between your device and the authentication server.
Is Base32 the same as Base64?
No. Base32 uses 32 characters (A–Z, 2–7) and is about 20% larger than the raw binary data. Base64 uses 64 characters (A–Z, a–z, 0–9, +, /) and is more compact, but includes case sensitivity and symbols that make it unsuitable for hand-typed 2FA secrets.
Does this tool send my data anywhere?
No. Encoding, decoding, and TOTP verification all run entirely in your browser with client-side JavaScript. Your secret keys and codes never leave your device.
Is the "=" padding at the end of a Base32 string required?
RFC 4648 defines the padding as optional — the "=" characters are added so that the total length becomes a multiple of 8. Most authenticator apps accept secrets with or without padding, and this tool strips trailing padding automatically before decoding, so both forms work.
Why are 8 Base32 characters equal to 5 bytes?
Each Base32 character encodes 5 bits of data, so 8 characters carry 8 × 5 = 40 bits, which is exactly 5 bytes. This is why Base32 strings always grow in blocks of 8 characters — a 32-character TOTP secret holds 20 bytes (160 bits) of key material.
Why does the alphabet skip 0, 1, 8 and 9?
The Base32 alphabet (A–Z and 2–7) deliberately excludes 0, 1, 8 and 9 because they are easily confused with the letters O, I and B when typed by hand. Removing them means keys can be read aloud, typed into a phone, or transcribed from a QR code without ambiguity.
What is the hex output shown after decoding?
The Decode tab also displays the raw decoded bytes as hexadecimal, separated into byte pairs. This is handy for debugging TOTP secrets or confirming that a Base32 string represents exactly the byte sequence you expect — for example, when migrating a secret between services.
How to use the Base32 encoder, decoder and TOTP verifier
- Encode text. Switch to the "Base32 Encode" tab, type or paste the text you want to convert, and the encoded output appears instantly below. Because the tool runs live, the output updates with every keystroke.
- Decode a string. Switch to the "Base32 Decode" tab and paste any Base32 string, such as a TOTP secret like
JBSWY3DPEHPK3PXP. The decoded text appears immediately, along with a hexadecimal view of the underlying bytes. - Verify a TOTP code. Open the "TOTP Verifier" tab, paste a Base32 secret key into the first field and a 6-digit code into the second, then press Verify Code. The tool checks the current 30-second window plus one window before and after to tolerate small clock differences.
- Copy the result. Use the Copy button on any output field to place the result on your clipboard. Everything runs in the browser, so nothing you encode, decode, or verify is ever transmitted.
Common Base32 mistakes and how to avoid them
Base32 looks simple, but a few recurring mistakes break otherwise valid workflows:
- Typing "1" instead of "I" or "0" instead of "O". The alphabet has no digits 0 and 1 precisely because they collide with letters. If a key fails to verify, re-check those characters first — this is the single most common cause of a rejected TOTP setup.
- Lowercase input. Base32 is case-insensitive by convention, and this tool uppercases input automatically. But when you store secrets in your own database, store them uppercase and without spaces so they compare cleanly.
- Adding or removing padding inconsistently. Some systems store secrets with trailing "=" characters and some without. This tool handles both, but if you are debugging a mismatch between two services, check whether one of them pads the secret and the other does not.
- Forgetting that encoding is not encryption. Base32 merely changes how bytes are represented — it adds no secrecy. Anyone who can read a Base32 string can decode it, so treat Base32 secrets as sensitive data and never share them.