Free Online Base64URL & Base32 Encoder / Decoder
Convert text between standard Base64, URL-safe Base64URL (RFC 4648), and Base32 — pick a format, choose Encode or Decode, and convert instantly in your browser. It helps when tokens, filenames, or URL parameters use URL-safe Base64 or Base32 rather than ordinary readable text.
Three related but distinct formats
Base64 is the everyday format for embedding binary data as text, using A-Z, a-z, 0-9, +, /, and = padding. Base64URL (RFC 4648 §5) swaps +// for -/_ and drops the padding, specifically so the result can be used directly inside a URL path, query parameter, or filename without being percent-encoded further — this is the format JWTs use for each of their three segments. Base32 (RFC 4648 §6) uses a smaller 32-character alphabet (A-Z, 2-7) that's case-insensitive and avoids easily-confused characters, at the cost of a ~20% larger output than Base64 for the same input.
How to use this converter
Choose Encode or Decode, select which of the three formats you're working with, and enter your text. Encoding accepts any text (including Unicode); decoding expects text that's actually valid in the selected format and reports a clear error otherwise, rather than returning garbled output.
Why Base64 is not encryption
It's worth stating plainly: none of these three formats provide any confidentiality. There's no secret key involved in any direction — anyone who sees Base64, Base64URL, or Base32 text can decode it back to the original instantly, with nothing more than this page (or a one-line script). If you need to actually protect data from being read, encode isn't the right word — use the AES-256 encryption or RSA encryption tools instead, both of which require a secret to reverse.
Common use cases
- Decoding the header or payload segment of a JWT, which uses Base64URL without padding
- Converting a value to Base64URL before using it in a URL path segment or filename
- Decoding a TOTP/2FA secret key shared in Base32, or generating one for a script
- Converting standard Base64 (with +, /, =) into a URL-safe form for a query parameter
How to use Base64URL & Base32 Converter for related tasks
Select the representation, paste the encoded value, and check padding and alphabet differences when a token comes from JWT or a URL.
Related tools: JWT Decoder, Encode / Decode.
Frequently asked questions
What is the difference between standard Base64 and Base64URL?
They use almost the same alphabet, but standard Base64 uses + and / (both of which have special meaning inside a URL) and pads with =. Base64URL (RFC 4648 §5) replaces + with - and / with _, and this tool omits the = padding entirely, so the result is safe to drop directly into a URL path, query string, or filename without further encoding.
Where is Base32 actually used?
Base32 shows up wherever a result needs to be case-insensitive and easy for a human to read aloud or type — TOTP/2FA secret keys (Google Authenticator and similar apps), DNS-related identifiers, and some filesystem-safe naming schemes. Its 32-character alphabet (A-Z and 2-7) avoids visually similar characters like 0/O and 1/I/l.
Is Base64/Base32 encoding the same as encryption?
No — none of these formats involve a secret key. Encoding is fully reversible by anyone with no special knowledge required; it changes representation, not confidentiality. If you need actual confidentiality, use the AES-256 or RSA encryption tools instead.
Is my text uploaded anywhere?
No. All three formats are encoded and decoded entirely in your browser — nothing you type or paste is sent to a server.
Why is Base64URL different from Base64?
Base64URL swaps URL-sensitive characters and may omit padding, so decode it with the URL-safe variant rather than assuming standard Base64 rules.