Base32 decoder and encoder

Base32 encodes five bytes into eight characters using A-Z and 2-7. It is bulkier than Base64 but case-insensitive and free of characters that get mangled by URLs, filesystems, or people reading them aloud - which is why TOTP secrets, Tor onion addresses, and DNS-based exfiltration all use it.

How to recognise it

• Uppercase letters and the digits 2-7 only. The absence of 0, 1, 8, and 9 is the giveaway - those were dropped because they look like O, I, B, and g.
• Padding runs long: Base32 can end in one, three, four, or six = characters, where Base64 never exceeds two.
• Length is a multiple of 8 with padding included.

The 40% size penalty over Base64 is the price of that robustness, and it is why Base32 appears where humans or DNS labels are in the loop rather than where bandwidth matters. In a CTF, seeing Base32 rather than Base64 is therefore a hint about the channel the data travelled through - which is often the actual puzzle.