Free online Base32 and Base58 encoder/decoder tool. Supports bidirectional conversion.
TL;DR: Free Base32 and Base58 encoder/decoder. Removes easily confused characters, ideal for blockchain addresses and short links, runs locally.
For local tools, open DevTools → Network and search your input — it should not appear in requests.
Usage Guide
Base32 shows up in TOTP secrets (the uppercase codes authenticator apps expect) because humans can type it; Base58 drops 0/O and I/l and underpins Bitcoin-style addresses. This tool supports RFC 4648 and Crockford Base32, raw Base58 and Base58Check (double SHA-256), plus a post-encode size compare against Base64 — all local, keys never leave the browser.
1. How to use
- Paste plaintext to encode, or an encoded string to decode.
- Pick Base32 or Base58, then the alphabet variant: RFC 4648 / Crockford, or raw Base58 / Base58Check.
- Encode or decode; invalid characters report a position, and Base58Check failures are explicit. After encode, a panel compares lengths with Base64.
2. Alphabets and checksums
- TOTP / Google Authenticator use RFC 4648 Base32 (A–Z and 2–7); this tool pads with = on encode and ignores spaces/case on decode.
- Crockford Base32 drops I/L/O/U and maps O→0, I/L→1 on decode — good for reading codes aloud; do not mix with TOTP alphabets.
- Raw Base58 has no checksum. Base58Check prepends a version byte, appends the first 4 bytes of double SHA-256, then Base58 — one wrong character fails.
- The size panel compares Base32 / Base58 / Base64 for the same UTF-8 input; bulk transport still belongs on the Base64 tool.
3. Typical scenarios and security limits
- Authenticator secrets, some DNS labels → Base32 (RFC).
- ULID / spoken confirmation codes → Base32 (Crockford).
- Crypto-style address strings to verify → Base58Check; alphabet-only without checksum → raw Base58.
- Encoding is not encryption: output reverses byte-for-byte. Keep real secrets in env vars or a KMS; use this tool for display and exchange.
4. Reading the error messages
Invalid Base32 character … at position N means the glyph is outside the selected alphabet (RFC excludes 0/1/8/9; Crockford adds aliases). Invalid Base58 … excludes 0, O, I, l means a forbidden character slipped in — sometimes the string is actually Base32. Base58Check checksum mismatch means the string was altered or was never Base58Check — confirm the variant before decoding.
5. When to use Base32 / Base58 versus Base64
Base64 is denser (~6 bits per character) and fits machine pipelines, HTTP, and JSON; Base32 uses 5 bits per character with an alphabet friendlier for humans (especially Crockford, which avoids 0/O confusion); Base58 drops more look-alikes and often pairs with Base58Check for transport foot-guns. Prefer Base64 when volume matters and the peer is software; switch to this page when secrets must be spoken, typed into Authenticator, or checked as crypto-style addresses. The post-encode size panel exists so you can see the readability-versus-size tradeoff in numbers.
6. Hand-offs to TOTP and hash tools
- TOTP secrets: pick RFC 4648, decode to confirm a clean alphabet, then paste into the TOTP generator — never decode Authenticator secrets as Crockford.
- Base58Check relies on double SHA-256; on checksum failure suspect a truncated copy before blaming the hash primitive.
- To compare the Base64 form of the same input, use the size panel here or the Base64 tool — keep the UTF-8 source identical.
7. Padding, casing, and practical details for spoken codes
RFC 4648 Base32 output length is a multiple of 8, padded with =; many Authenticator UIs strip padding and insert grouping spaces — this tool ignores whitespace and tolerates missing = on decode. Crockford adds O→0 and I/L→1 aliases that survive phone typos, which is exactly why it must not be swapped with the TOTP alphabet. Base58 has no padding notion; Check variants add checksum bytes and grow a little longer — the size panel helps tell raw Base58 from Check by length alone. Prefer copying the secret verbatim over retyping: human mix-ups of 8/B and S/5 are a common source of TOTP codes that are always one digit wrong.
FAQ
Yes. Encoding and decoding run locally on this page — the secret is neither sent anywhere nor stored. Just remember that encoding is not encryption: real secrets belong in environment variables or a key-management service.
Base32 uses 32 characters (A-Z plus 2-7), is case-insensitive, and suits verbal handoff. Base58 uses 58 characters, drops easily confused ones like 0, O, I, and l, and underpins Bitcoin-style addresses. Base64 packs roughly 6 bits per character for the most compact output and remains the default for machine pipelines.
Always RFC 4648 (A-Z and 2-7). Crockford has a different alphabet plus alias rules on decoding, so a TOTP secret read as Crockford yields verification codes that never match — picking the wrong variant is the most frequent mistake.
Use bare Base58 when you only want the de-confused alphabet with no verification; use Base58Check to verify blockchain-style addresses — it prepends a version byte and appends the first 4 bytes of a double SHA-256 checksum, so a single altered character fails loudly.
The string contains a character the Bitcoin alphabet forbids — quite often it is really a Base32 string decoded with the wrong variant. Likewise, "Invalid Base32 character … at position N" means that position falls outside the selected alphabet, and a Base58Check checksum mismatch means the string was altered or was never Base58Check. Confirm the variant before decoding.
Stick with Base64 when transfer size matters and the receiver is a program (HTTP, JSON, machine pipelines). Switch to this page when keys must be readable by people, go into an Authenticator, or need address-style verification. The length-comparison panel shown after encoding makes the readability-for-size tradeoff visible.
Related Tools
Related Articles
Online Base32/Base58 Encoder: Alphabets, Checksums, and Base64 Size Compare
See how Base32, Base58, and Base64 differ: RFC 4648 vs Crockford alphabets, Base58Check double SHA-256 validation, size overhead, and when to switch to Base64.
Online Base64 Encoder and Decoder Tools Compared (2026)
Comparing 4 popular online Base64 tools across Unicode safety, privacy, batch capability, and cost: RapidTables goes broad, Browserling does batch, ToolVault runs locally — each has its place. Includes the btoa trap, base64url variants, and reproducible verification methods.
Online HTML Entity Encoder/Decoder: Safely Handle Special Characters
Learn HTML entity encoding fundamentals. Understand how to convert special characters to HTML entities, prevent XSS attacks, and use encoding in frontend development.