Skip to content

Kubernetes Secret Decoder

Decodes every Base64 value in a Secret manifest, and re-encodes an edited one ready to apply.

Opens a Kubernetes Secret manifest, decodes every Base64 value so you can read it, lets you edit any of them, and rebuilds the manifest with the values re-encoded. It runs entirely in the tab — a Secret is the last thing that should travel to a server to be decoded.

🔒 Runs entirely in your browserkubernetessecretbase64devops

Secret manifest

Drop a secret.yaml

Read in this tab. Nothing is uploaded.

Runs entirely in this tab: nothing is sent anywhere, and nothing is written to storage.

4 values

Values
username

YWRtaW4=

password

c3VwZXItc2VjcmV0LXBhc3N3b3Jk

DATABASE_URL

cG9zdGdyZXM6Ly9hZG1pbjpzdXBlci1zZWNyZXQtcGFzc3dvcmRAZGI6NTQzMi9hcHA=

NOT_ENCODEDstringData — not Base64

dGhpcyBvbmUgaXMgcGxhaW4gdGV4dA==

Re-encoded manifest

Edit a value above and this updates. `stringData` entries are folded into `data` as Base64, which is what `kubectl apply` would do anyway.

Base64 is an encoding, not encryption. A Kubernetes Secret protects nothing on its own — it is RBAC and encryption at rest that do that.

How to use it

  1. Paste the manifest

    The output of `kubectl get secret name -o yaml`, or the file from your repository. Both `data` and `stringData` are read.

  2. Read the values

    Each key is shown with its decoded value and the Base64 underneath it. A `stringData` entry is labelled, because it was never encoded in the first place.

  3. Edit and take the rebuilt manifest

    Change a value and the manifest below updates. `stringData` entries are folded into `data` as Base64, which is exactly what `kubectl apply` does on the way in.

Common questions

Does a Kubernetes Secret encrypt anything?

By itself, no. Base64 is an encoding — the manifest is readable by anyone who can read it. What protects a Secret is RBAC on the cluster and encryption at rest in etcd, neither of which is visible in the YAML.

Why is one value shown as an error?

Because it is not valid Base64, which usually means the manifest was hand-edited or the value belongs under `stringData`. Kubernetes would reject it too.

Is it safe to paste a production Secret here?

Nothing is sent anywhere and nothing is written to storage — the decoding happens in your browser. The usual caveats about screen sharing and browser history still apply, because the values are now visible on screen.

Feed it from

YAML Formatter & Validator

Re-indents YAML consistently, validates it, and flags the tab and anchor mistakes that break parsers.

Runs entirely in your browser

Cron Builder

Builds a cron expression field by field, each typed into its own box with its legal range beside it, and shows the resulting schedule as you change it.

Runs entirely in your browser

docker run to Compose

Turns a docker run command line into a compose service definition, and converts back the other way.

Runs entirely in your browser

.env Parser & Converter

Parses a .env file and converts it to JSON, YAML, shell exports, Docker or Kubernetes formats.

Runs entirely in your browser

Next

These accept what this tool produces, so the result can go straight in.

Base64 Encoder & Decoder

Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.

Runs entirely in your browser

.env Parser & Converter

Parses a .env file and converts it to JSON, YAML, shell exports, Docker or Kubernetes formats.

Runs entirely in your browser

Secret Scanner

Scans pasted code, logs or a config dump for API keys, tokens and private keys, with entropy heuristics.

Runs entirely in your browser

YAML Formatter & Validator

Re-indents YAML consistently, validates it, and flags the tab and anchor mistakes that break parsers.

Runs entirely in your browser

curl to Code

Converts a curl command into fetch, axios, Python requests, Go, PHP or PowerShell.

Runs entirely in your browser

Text Hash

Computes MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 of a string, with an uppercase and Base64 output option.

Runs entirely in your browser