Why authenticator secrets are written in Base32
Base32 keeps secrets human-readable, copy-paste safe, and case-insensitive — here's why TOTP picked it over hex or Base64.
Why not hex or Base64?
Base32 uses 32 case-insensitive characters (A–Z and 2–7). That avoids the visually confusing pairs like 0/O and 1/l, survives being read aloud over the phone, and is safe to paste into any text field.
Padding and grouping
Most authenticator UIs strip = padding and group the secret into blocks of four for readability. 2FA auth normalizes whitespace and case before decoding.
Last updated: June 26, 2026