Skip to content
All tools
EncodingRuns locallyNo account

Base32 decoder and encoder

Decode Base32 (RFC 4648) to text or bytes, with padding repair. Distinguishes Base32 from Base64 and hex automatically.

Open in ctfpal

Base32 encodes five bytes into eight characters using A-Z and 2-7. It is bulkier than Base64 but case-insensitive and free of characters that get mangled by URLs, filesystems, or people reading them aloud - which is why TOTP secrets, Tor onion addresses, and DNS-based exfiltration all use it.

How to recognise it

  • Uppercase letters and the digits 2-7 only. The absence of 0, 1, 8, and 9 is the giveaway - those were dropped because they look like O, I, B, and g.
  • Padding runs long: Base32 can end in one, three, four, or six = characters, where Base64 never exceeds two.
  • Length is a multiple of 8 with padding included.

The 40% size penalty over Base64 is the price of that robustness, and it is why Base32 appears where humans or DNS labels are in the loop rather than where bandwidth matters. In a CTF, seeing Base32 rather than Base64 is therefore a hint about the channel the data travelled through - which is often the actual puzzle.

Worked example

A Base32 flag

Input

NZXXIYLGNRQWOYTVORRGC43FGMZHO33SNNZQ====

Result

notaflagbutbase32works

Twenty-two bytes is not a multiple of five, so this one pads out to four `=`. Note also the strictly uppercase alphabet with no 0, 1, 8, or 9.

Load this example in the workspace

Part of a module

1. Recognising encodings

Tell Base64 from hex from Base32 from binary on sight, peel layered encodings, and learn why an encoding is not encryption.

Practise on real challenges

Go deeper

Related tools