Decode a base32 secret

TOTP setup keys and DNS-safe tokens arrive in A–Z2–7. Base32 decode shows the bytes — encode round-trips them back.

Tools used in this guide

Base32 encoder / decoder

The job

Base32 trades density for robustness — no ambiguous 0/O or 1/l, safe in DNS and on paper. When a 2FA key or a license token arrives as JBSWY3DPK5XXE3DE, decode it to see the underlying UTF-8 or confirm it round-trips.

Text ↔ base32

Paste either side. Encode turns UTF-8 text into the standard alphabet with optional = padding; decode accepts lower-case and ignores whitespace and padding.

Worked example

Hello encodes to JBSWY3DP (padding optional). Decoding jbsw y3dp — lower-case with a space — still returns Hello. Note that JBSWY3DZ is also a legal string and decodes to Helly: base32 checks the alphabet, not meaning.

Scope

RFC 4648 base32 on UTF-8 text, up to 200,000 characters either direction. Invalid UTF-8 in decoded bytes is reported, not mojibake'd. Base32hex and Crockford variants are different alphabets and are not detected.