Base32 encoder / decoder

Under the Hood: The Architecture of Base32 Decoder

Base32 shows up in TOTP secrets and Crockford-ish dumps. Decoding on a website that logs input is how seeds leak. This decoder uses a 32-character alphabet, bit buffer, and TextDecoder. Local only.

Memory Allocation & Browser Threading Mechanics

Linear scan of the cleaned string. Byte array then UTF-8 decode. Main thread.

Algorithmic Deep-Dive: Code Snippet & Logical Analysis

const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
function decodeBase32(input) {
  const clean = input.toUpperCase().replace(/=+$/, "").replace(/\s/g, "");
  let bits = 0, value = 0;
  const bytes = [];
  for (const ch of clean) {
    const idx = ALPHABET.indexOf(ch);
    if (idx < 0) throw new Error("Invalid Base32 character.");
    value = (value << 5) | idx;
    bits += 5;
    if (bits >= 8) {
      bytes.push((value >>> (bits - 8)) & 255);
      bits -= 8;
    }
  }
  return new TextDecoder().decode(new Uint8Array(bytes));
}

Padding equals are stripped. Whitespace ignored. Invalid alphabet throws rather than skipping (skipping would hide corruption). Output is UTF-8 text, not hex.

The Local Storage Sandbox & Volatile Data Pipelines

Input/output strings. No persistence of TOTP material—leave the page.

Verifying True Privacy: How to Audit Your Browser's Network Tab

F12, Network, clear, decode a dummy secret. HAR must not contain it.