All operations

Base32

Bytes as 32 characters chosen to survive being spoken or mistyped.

What it does

Base32 uses twenty-six letters and six digits, five bits at a time. Output is about 60% larger than the input, noticeably worse than Base64’s 33%.

You accept that cost to get something back: the alphabet excludes the digits 0, 1 and 8, because they are too easily confused with O, I and B. It is also case-insensitive, so nothing breaks when a system upper-cases it or a person writes it down.

Where you meet it

  • Two-factor authentication secrets, which is why the setup key your authenticator app shows is always letters and the digits 2 to 7
  • Tor onion addresses
  • DNS records, where case is not preserved
  • Anything a human has to read aloud, retype or write down

Variants

RFC 4648 is the standard alphabet, A to Z then 2 to 7. Extended hex uses 0 to 9 then A to V, which has the useful property that sorting encoded strings preserves the sort order of the underlying bytes.

Base64 is more compact when nothing has to survive a human. The PGP word list goes further in the other direction, trading size for words that cannot be misheard.