Base32hex Encoder + Decoder (RFC 4648)
Base32hex is a variant of Base32 (RFC 4648 §7) that uses the alphabet 0-9, A-V instead of the standard A-Z, 2-7. The benefit: the encoded form has the same lexical sort order as the unencoded binary — useful for DNS NSEC3 records, time-ordered identifiers, and any case where you need encoded data to sort the same way as the raw bytes.
How to use the Base32hex Encoder + Decoder (RFC 4648)
Pick encode or decode. Toggle padding (default on per spec; some uses like DNS NSEC3 strip it). The output updates live.
About Base32hex Encoder + Decoder (RFC 4648)
Base32hex uses the alphabet 0123456789ABCDEFGHIJKLMNOPQRSTUV — first 10 characters are digits (continuing the hex pattern), then letters. Compare to standard Base32 which uses ABCDEFGHIJKLMNOPQRSTUVWXYZ234567.
The key property: lexical sort order = binary sort order. With standard Base32, "AAAAAA" < "AAAAAB" works as expected for the encoded data, but the underlying binary doesn't sort in the same way. With base32hex, sorting the encoded strings gives the same order as sorting the raw bytes. This matters for DNS where NSEC3 records must be in canonical sort order, and for any database / storage system that uses base32-encoded keys.
This tool is the standard counterpart to the more common Base32 converter — both implement RFC 4648, but with different alphabets.
Common use cases
- DNS NSEC3 records — DNSSEC denial-of-existence records use base32hex hashes.
- Sortable identifiers — when you want encoded IDs that sort the same as their raw form.
- Hardware tokens — some 2FA implementations use base32hex for compactness.