Base32 decoder and encoder
Decode Base32 (RFC 4648) to text or bytes, with padding repair. Distinguishes Base32 from Base64 and hex automatically.
Open in ctfpalBase32 encodes five bytes into eight characters using A-Z and 2-7. It is bulkier than Base64 but case-insensitive and free of characters that get mangled by URLs, filesystems, or people reading them aloud - which is why TOTP secrets, Tor onion addresses, and DNS-based exfiltration all use it.
How to recognise it
- Uppercase letters and the digits
2-7only. The absence of0,1,8, and9is the giveaway - those were dropped because they look likeO,I,B, andg. - Padding runs long: Base32 can end in one, three, four, or six
=characters, where Base64 never exceeds two. - Length is a multiple of 8 with padding included.
The 40% size penalty over Base64 is the price of that robustness, and it is why Base32 appears where humans or DNS labels are in the loop rather than where bandwidth matters. In a CTF, seeing Base32 rather than Base64 is therefore a hint about the channel the data travelled through - which is often the actual puzzle.
Worked example
A Base32 flag
Input
NZXXIYLGNRQWOYTVORRGC43FGMZHO33SNNZQ====Result
notaflagbutbase32worksTwenty-two bytes is not a multiple of five, so this one pads out to four `=`. Note also the strictly uppercase alphabet with no 0, 1, 8, or 9.
Load this example in the workspacePart of a module
1. Recognising encodings
Tell Base64 from hex from Base32 from binary on sight, peel layered encodings, and learn why an encoding is not encryption.
Practise on real challenges
Go deeper
- Spot the encoding: reading base64, base32, hex and friends at a glanceAlphabet, length, and padding are enough to name almost any encoding on sight. A field guide to the encodings CTFs actually use, the magic prefixes that tell you what is underneath, and the traps that make a correct guess look wrong.
Related tools
Base64 decoder and encoder
Decode and encode Base64 and Base64-URL in the browser, with padding repair and automatic detection of nested encodings. Nothing is uploaded.
Hex to text converter
Convert hexadecimal to text and back, tolerating whitespace, commas, and `0x` prefixes. Runs entirely in your browser.
Cipher identifier and automatic decoder
Paste anything and find out what it is. ctfpal runs every decoder and rotation, including multi-pass cascades, and ranks results by English-likeness and flag patterns.
Base58, UUID and colour utilities
Decode Base58 and Base58Check, inspect UUID versions and embedded timestamps, and convert colour notations.