Five bytes in, eight characters out
Base32 reads 5 bytes (40 bits) at a time and writes them as eight characters of 5 bits each. The 32 symbols are A-Z and 2-7, with = as padding. Leftover bytes pad the last group: one byte gives two characters and six =, two bytes give four characters and four =, three give five and three, four give seven and one. So the output length is always a multiple of 8, and a single byte already takes 8 characters.
How long the output gets
At 5 bits per character, Base32 carries fewer bits than Base64's 6, so its output runs longer. It adds 60% to the size, against 33% for Base64, so a large payload comes out 1.2 times as long. For a 32-byte SHA-256 hash the lengths are:
- Hex: 64 characters
- Base32: 56 characters
- Base64: 44 characters
The gap hardly matters for the short values Base32 is used for. A 20-byte secret is 32 characters.
Why people pay for the longer text
The alphabet is uppercase letters and digits only. There's no lowercase, no +, / or -, so the text survives systems that ignore case or mangle symbols, and it's easier to read aloud. RFC 4648 describes Base32 as built for a form that needs to be case insensitive, and it notes that 0 and O are easily confused, as are 1, l and I. Base32 leaves out 0 and 1.
The best known use is the secret behind an authenticator app. The secret in an otpauth:// setup link is Base32, and the padding should be left off. There's also a variant, Base32hex, with the alphabet 0-9 and A-V. Its output sorts in the same order as the data it encodes.