TechCompare LogoTechCompare

Base32 vs Base64: when bigger overhead is the better choice

Base64 for machine-to-machine data exchange. Base32 for anything a human will type, read, or transcribe. The overhead difference (33% vs 60%) is negligible for the small payloads (a few dozen bytes) where human readability matters.

Base64 packs 6 bits per character and expands data by 33%. Base32 packs 5 bits per character and expands data by 60%. Base32 is larger, but the RFC 4648 alphabet excludes the digits 0, 1, 8, and 9 and is commonly handled case-insensitively. It still contains letters such as I, L, and O, so it reduces some transcription errors rather than eliminating lookalikes. For data that humans type or read aloud, the extra overhead can be worth that trade.

By TechCompare · Updated

Encoding focus
Base32 vs Base64
base32-vs-base64
Category
Format Comparison
Comparing encoding schemes side by side

How this is calculated

Base32 is used for OTP secrets (the 16-character codes you type into Google Authenticator), product license keys, and recovery codes. The RFC 4648 Base32 alphabet excludes 0, 1, 8, and 9 to avoid confusion with O, I/l, B, and g/q. Base64's alphabet includes letters in both cases, digits, +, and /, making it error-prone for human transcription. If a user is going to type the encoded value, Base32. If machines are exchanging it, Base64.

Verdict

The choice hinges on who reads the output. Base64 carries 6 bits per character at 33% overhead but mixes upper and lower case with + and /, which humans mistype. RFC 4648 Base32 drops to 5 bits per character for 60% overhead and excludes the digits 0, 1, 8, and 9, but it still contains letters such as I, L, and O. That trade makes Base32 common for OTP secrets and recovery codes.

More Encoding scenarios

Base64 vs Hex
Base64 and hexadecimal both encode binary data as text, but they serve different purposes.
View details ➜
UTF-8 vs ASCII
ASCII maps 128 English characters to 7-bit values.
View details ➜
URL encoding guide
Percent-encoding (also called URL encoding) represents a byte with a percent sign followed by two hex digits when that byte can't appear literally in the URL component being built.
View details ➜

Frequently asked questions

Why do 2FA apps use Base32 for secret keys?
Because humans type those secrets. RFC 4648 Base32 excludes the digits 0, 1, 8, and 9, and many 2FA tools accept either case, so short codes are easier to transcribe than Base64 values with mixed case, +, and /. It still contains letters such as I, L, and O, so it does not remove every possible visual ambiguity.
How much bigger is Base32 than Base64?
Base32 packs 5 bits per character versus Base64's 6, so output runs about 60% overhead versus Base64's 33%. For the payloads where Base32 earns its keep (2FA secrets, license keys, recovery codes) the data is a few dozen bytes, so the size difference is invisible. Overhead only matters at machine-scale payloads, and those should stay on Base64.
Can Base32 and Base64 values be converted to each other?
Yes, by decoding back to bytes and re-encoding. Both are reversible transforms of the same binary data, so any Base32 value decodes to bytes that re-encode as Base64 and vice versa. There's no information loss in either direction, which is why services that publish Base32 secrets also accept them pasted into Base64-only tools after conversion.