By Docify

Hex vs Base64 vs Base32: RFC 4648 Encodings

• 6 min read

RFC 4648 section 10 uses foobar as a test vector for hex, Base64, and Base32. Encoding ASCII foobar writes 666F6F626172 on /base16/. Encoding ASCII foobar writes Zm9vYmFy on /base64/. Encoding ASCII foobar writes MZXW6YTBOI====== on /base32/. Hex here is UTF-8 text-to-hex, not a SHA digest and not sRGB. The live pages are not TOTP verifiers.

Binary data cannot be directly embedded in text formats. These three encodings convert bytes to printable ASCII characters, each with different trade-offs between size, readability, and compatibility.

The same bytes in three encodings

The string foobar (6 ASCII bytes):

Hex:666F6F626172(12 chars, 2× size)
Base64:Zm9vYmFy(8 chars, 1.33× size)
Base32:MZXW6YTBOI======(16 chars with padding)

RFC 4648 section 10 uses foobar as a test vector for all three encodings.

Encoding comparison

PropertyHex (Base16)Base64Base32
RFC 4648 sectionSection 8Section 4Section 6
Alphabet0–9 A–FA–Za–z0–9+/A–Z 2–7
Bits per character465
Size expansion2× (100%)1.33× (33%)1.6× (60%)
Case-sensitiveNo (typically uppercase)YesNo
URL-safeYesNo (+ and /)Yes
PaddingNone= (0–2 chars)= (0–6 chars)
Human-readableBest (byte-aligned)PoorGood (no confusing chars)

When to use each encoding

Hex (Base16): Readability and debugging

Every byte becomes exactly 2 hex characters. This 1:2 mapping makes hex ideal when you need to inspect or compare binary data.

  • ✓Hash digests – SHA-256 outputs 64 hex characters (32 bytes)
  • ✓MAC addresses – 00:1A:2B:3C:4D:5E
  • ✓Color codes – #FF5500, rgb(255, 85, 0)
  • ✓Protocol debugging – hex dumps of network packets
  • ✓UUIDs – 550e8400-e29b-41d4-a716-446655440000

Base64: Compact binary-to-text

The most space-efficient standard encoding. Use when size matters more than human readability.

  • ✓Email attachments – MIME encodes binaries in Base64
  • ✓Data URIs – data:image/png;base64,...
  • ✓PEM certificates – -----BEGIN CERTIFICATE-----
  • ✓JSON payloads – embedding binary in APIs
  • ✓Basic auth headers – Authorization: Basic dXNlcjpwYXNz

For URLs and JWTs, use Base64URL instead (- and _ replace + and /).

Base32: Human-friendly secrets

Larger than Base64, but case-insensitive and avoids confusing characters (no 0/O, 1/I/L). Ideal when humans type or speak the encoded value.

  • ✓TOTP secrets – Google Authenticator, Authy backup codes
  • ✓Recovery codes – 2FA backup codes users must type
  • ✓Onion addresses – Tor .onion domains use Base32
  • ✓Case-insensitive storage – some file systems, DNS
  • ✓URL-safe identifiers – no special characters needed

Size comparison example

Encoding 100 bytes of binary data:

Original binary100 bytes
Hex200 characters (+100%)
Base64136 characters (+36%)
Base32160 characters (+60%)

For a 1 MB file, the difference is significant: 2 MB hex, 1.33 MB Base64, 1.6 MB Base32.

Quick reference

  • Need smallest size? → Base64
  • Need to read individual bytes? → Hex
  • Need case-insensitive? → Base32
  • Need URL-safe? → Base32 or Base64URL
  • Users will type it? → Base32
  • Email/MIME attachment? → Base64
  • Hash or checksum display? → Hex

Try all three encodings

Encode and decode with hex, Base64, or Base32. Nothing is uploaded.

FAQ

Which encoding is most compact?
Base64 is most compact (33% expansion). Base32 expands 60%. Hex (Base16) doubles the size (100% expansion).
Which encoding is safest for filenames?
Base32 uses only A-Z and 2-7, avoiding case sensitivity issues. Base64URL is also filename-safe.
Can I convert between these formats?
Yes. Decode from one format, then encode to another. The underlying bytes are the same.
Does this tool upload my data?
No. All encoding runs in your browser using JavaScript. Nothing is sent to a server.

Related