Base64 to Base32 for TOTP Secrets

How to convert Base64 to Base32

1. Paste the Base64 into Input · Base64. URL-safe characters (-, _), missing padding and line breaks are fine.
2. Read the result in Output · Base32 (RFC 4648).
3. For an otpauth:// link or an authenticator app, untick Padding (=) under the output.
4. Click Copy output. Base32 (RFC 4648) → Base64 in the direction toggle converts the other way, as does the Base32 to Base64 page.

The bytes in the middle do not change. A 20-byte key in, a 20-byte key out, as the Bytes counter under the tool shows.

Examples

The two strings in the first rows look nothing alike, and that is normal: Base64 uses 6 bits per character and Base32 uses 5, so the characters never line up.

The mistake to avoid is encoding the Base64 characters as text. Pasting iEwO+V01Llzjb4MxBUtgEuCNW8o= into a text-to-Base32 encoder gives NFCXOTZLKYYDCTDM…, which is valid Base32 of the 28 characters themselves. Authenticator codes from it will never match the server.

Setting up TOTP from a Base64 secret

Server code often stores the shared secret as Base64, or generates it with a command like this:

openssl rand -base64 20

To enroll it in an authenticator app, convert it here, then build the key URI:

otpauth://totp/Example:alice@example.com?secret=RBGA56K5GUXFZY3PQMYQKS3ACLQI2W6K&issuer=Example

algorithm, digits and period can be added as parameters; without them, apps assume SHA-1, 6 digits and 30 seconds. Turn the link into a QR code with any local QR tool, or let the user type the Base32 secret by hand. The secret is the same bytes your server feeds into HMAC, so codes match without changing the server.

If you need a new secret rather than an existing one, generate 20 random bytes as Base64 with the random Base64 generator (Custom preset) and convert them here.

Lengths for common key sizes

Sizes that are a multiple of 5 bytes, like 10 and 20, give Base32 with no padding at all.

The same conversion in Python

import base64

secret_b64 = "iEwO+V01Llzjb4MxBUtgEuCNW8o="
base64.b32encode(base64.b64decode(secret_b64)).decode().rstrip("=")
# 'RBGA56K5GUXFZY3PQMYQKS3ACLQI2W6K'

For URL-safe input use base64.urlsafe_b64decode, and add = padding first if it was stripped. More on that in Base64 in Python.

FAQ