Base32 Encoding Demystified: Why Authenticator Apps Use RFC 4648 Base32 Over Base64

The RFC 4648 Base32 Alphabet

When you configure Two-Factor Authentication on platforms like Google, GitHub, or AWS, you are provided with a secret key such as JBSWY3DPEHPK3PXP. Notice that this string never contains the numbers 0, 1, 8, or 9. This is because authenticator setups strictly employ the RFC 4648 Base32 alphabet.

Why Base32 Instead of Base64 or Hexadecimal?

• Elimination of Visual Ambiguity: In human readability, numeral 0 is easily confused with letter O, and numeral 1 is confused with lowercase l or uppercase I. Base32 completely omits 0, 1, 8, and 9 to eliminate manual transcription errors.
• Case-Insensitivity: Unlike Base64, which requires uppercase (A-Z), lowercase (a-z), and symbols (+, /), Base32 is strictly case-insensitive. Users can type keys in lowercase or uppercase without causing decoding errors.
• Uniform 5-Bit Grouping: Base32 cleanly encodes 5 bits of binary data per character ($2^5 = 32$), providing optimal compression while maintaining human readability.