BASE32 Decode - Complete Guide

Base32 decoder converts Base32-encoded text back to original binary data. Essential for reading TOTP secrets, processing license keys, and any application that receives Base32-encoded input. Handles padding and case variations.

How It Works

Each Base32 character represents 5 bits. Decoder maps characters back to values (A=0 through 7=31), concatenates bits, groups into bytes, and converts to original data. Padding (=) is stripped first.

Technical Details

Decoder must handle: case normalization (A=a), padding removal, invalid character detection, and bit alignment. 8 Base32 characters become 5 bytes. Last group may have fewer bytes based on padding count.

Common Use Cases

1. TOTP Verification: Decode secret keys to generate time-based one-time passwords.
2. License Validation: Decode user-entered license keys for verification.
3. Data Import: Process Base32-encoded data from external systems.
4. QR Code Data: Many 2FA QR codes contain Base32-encoded secrets.

Code Examples

Base32 Decoding

const BASE32_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';

function base32Decode(input) {
  // Remove padding and convert to uppercase
  input = input.replace(/=+$/, '').toUpperCase();

  let bits = '';
  for (const char of input) {
    const val = BASE32_CHARS.indexOf(char);
    if (val === -1) throw new Error('Invalid Base32 character');
    bits += val.toString(2).padStart(5, '0');
  }

  // Convert bits to bytes
  const bytes = [];
  for (let i = 0; i + 8 <= bits.length; i += 8) {
    bytes.push(parseInt(bits.slice(i, i + 8), 2));
  }

  return new TextDecoder().decode(new Uint8Array(bytes));
}

base32Decode('JBSWY3DP');  // "Hello"

Map characters to 5-bit values, concatenate, extract bytes, decode as text.

Tips & Best Practices

• Normalize to uppercase before decoding
• Handle missing padding gracefully
• Validate characters strictly for security
• Output may be binary, not just text
• Check which Base32 variant was used

Common Mistakes to Avoid

• Not handling case variations
• Assuming output is always valid UTF-8
• Ignoring invalid characters
• Wrong Base32 variant (standard vs hex)

When to Use This Tool

Use Base32 decoder when processing TOTP secrets, license keys, or any Base32-encoded data. Ensure you know which Base32 variant was used for encoding.

Frequently Asked Questions

My decoded output looks wrong. Why?

Common issues: wrong Base32 variant (standard vs hex vs Crockford), case sensitivity in your decoder, corrupted padding, or the data was double-encoded. Verify the encoding scheme used.

How do I handle invalid characters?

Strict decoders reject invalid input. Lenient decoders skip invalid characters. For security applications, always use strict validation. Invalid characters may indicate corruption or tampering.

What if padding is missing?

Some encoders omit padding for compactness. Decoders should handle this by inferring padding from length. Add = until length is multiple of 8 before decoding.

Is the output always text?

No. The output is bytes, which may be text (UTF-8) or binary data (images, keys). Check the expected format. For TOTP secrets, output is raw bytes used directly for HMAC.

Get Started

Ready to try BASE32 Decode? Use the tool now - it's free, fast, and works right in your browser.

---

Last updated: June 27, 2026