Encode or decode every data field of a Kubernetes Secret manifest between plain text and Base64.
Loading tool
About Kubernetes Secret Encoder
Decode every Base64 value in a Kubernetes Secret's data into readable stringData, or encode stringData back into Base64 data ready for kubectl apply. It accepts YAML or JSON, multi-document files and kubectl get secret -o yaml output, can strip server-side metadata (uid, resourceVersion, creationTimestamp, managedFields, status and the last-applied annotation), and outputs YAML or JSON. Binary or invalid values are left in data and flagged; since secrets are involved, decoding happens entirely in your browser.
Common uses
- Read the values of a Secret fetched with kubectl get secret -o yaml.
- Write a Secret with plain-text values and convert it to Base64 data.
- Clean an exported Secret of cluster-generated fields before committing it to a template or re-applying it.
- Spot invalid Base64 or keys that appear in both data and stringData.
FAQ
- Are Kubernetes Secrets encrypted?
- Values in data are only Base64-encoded, which anyone can decode. Protection depends on RBAC and on enabling encryption at rest for etcd, so Secret manifests should not be committed to Git in plain form.
- What is the difference between data and stringData?
- data holds Base64-encoded values. stringData accepts plain strings as a write-only convenience: the API server encodes them into data, and if a key appears in both, the stringData value wins.
- How do I decode a single secret value with kubectl?
- Run kubectl get secret NAME -o jsonpath='{.data.KEY}' | base64 --decode, replacing NAME and KEY with the Secret name and key.