Base58 Encode

About Base58

Base58 is Base64 with the ambiguous characters taken out. There is no 0 and no O, no I and no lower-case l, and no + or / — so a string can be read off a screen, copied by hand or double-clicked as one word without any of it going wrong. It was designed for Bitcoin addresses and is now used for IPFS v0 CIDs, Solana keys and Ripple identifiers.

Because 58 is not a power of two, there is no group of characters that corresponds to a group of bytes: the whole string is one large number, which is why leading zero bytes have to be carried separately and why the conversion costs more as it gets longer. Real addresses and keys use Base58Check, which appends four bytes of SHA-256(SHA-256(data)) so that a single mistyped character is detectable. Decoding here verifies that checksum whenever the shape says one was meant to be there, and names the version byte that says what kind of value it is.

Where it helps

• Verifies the Base58Check checksum, so a mistyped address is reported rather than silently decoded.
• Names the version byte, which says whether a value is an address, a testnet address or a private key.
• Points at the character that is not in the alphabet, and says which character it was left out in favour of.
• Covers the Bitcoin, Ripple and Flickr alphabets, which order the same 58 characters differently.

Limits

• Both directions treat the input as a single number, so the work grows with the square of the length — this is for addresses and keys, not files.
• It does not add a Base58Check checksum when encoding: that needs the version byte saying what kind of value is being built.
• An encoding, not encryption. A private key in Base58 is a private key anyone who sees it can use.
• A checksum that passes says the value was transcribed correctly. It says nothing about whether it is the address you meant to send to.

Frequently asked questions

Why does the tool sometimes not mention a checksum?

Because most Base58 is not Base58Check. A checksum is reported when it passes, and reported as invalid only when the length and version byte say one was meant to be there — otherwise encoding ordinary text would produce a false alarm every time.

Which characters are missing from Base58?

0, O, I and lower-case l, because each is easily confused with another, plus + and /, which have their own meaning in URLs.

Can I use this to decode an IPFS CID?

A v0 CID — the kind starting Qm — yes, with the Bitcoin alphabet. v1 CIDs are usually written in Base32 instead, which is the other tool.

Does a valid checksum mean the address is safe?

No. It means nothing was mistyped. An address substituted by malware is perfectly well formed and will pass every check there is.

Related tools

• Base32 — Encode or decode Base32 in the RFC 4648, extended hex and Crockford alphabets
• Base64 — Encode or decode UTF-8 text and URL-safe Base64
• Hash Generator — SHA-2, SHA-3, BLAKE and legacy digests, in any encoding
• HMAC Generator — Keyed message authentication codes
• URL Encoder — Percent-encode components or whole URLs
• HTML Entities — Escape and unescape HTML entities

More Encoders & Decoders tools

• Base64 — Encode or decode UTF-8 text and URL-safe Base64
• Base32 — Encode or decode Base32 in the RFC 4648, extended hex and Crockford alphabets
• Base58 — Encode or decode Base58, and verify the Base58Check checksum an address carries
• URL Encoder — Percent-encode components or whole URLs
• HTML Entities — Escape and unescape HTML entities
• JWT — Read, verify and sign JSON Web Tokens
• Punycode — Convert internationalised domain names to and from their ASCII form
• Unicode Converter — Escape, unescape and inspect code points
• Unicode Inspector — Analyse every character: category, script, block and encoding
• Number Base Converter — Binary, octal, decimal and hexadecimal, with the bits explained
• Hex and Text Converter — Text to hexadecimal bytes and back, with a dump
• Gzip Compressor and Decompressor — Compress and expand gzip, zlib and raw deflate