module

KemalIdentity::MFA::Base32

RFC 4648 base32, because every authenticator app expects a TOTP secret in it.

Not a general-purpose codec and not exported as one: it exists because otpauth:// URIs and the "type this code in by hand" fallback both speak base32, and Crystal's stdlib ships base64 only. The alphabet is case-insensitive on the way in — a person reading a secret off a screen types it in whatever case they like — and upper-case on the way out.

Constants

ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"

Class methods

decode?(value : String) : Bytes | Nil

The bytes value encodes, or nil when it is not base32.

Returns nil rather than raising: the input is usually something a person typed, so "that is not a valid secret" is an expected answer and not an exceptional one. Spaces and hyphens are ignored, since secrets are printed in groups of four to be readable, and = padding is accepted although never produced.

Source

encode(bytes : Bytes) : String

Base32 of bytes, unpadded.

Padding is dropped because otpauth:// secrets are conventionally unpadded and because = would have to be percent-escaped in the query string it lands in.

Source