Skip to content

Kubernetes Secret decoder

Paste a Secret manifest. data is decoded into stringData, and the rest stays as written.

The manifest is decoded in this browser and is not uploaded. Analytics records only that the tool was used, never the values.

Ctrl+Enter or ⌘+Enter runs this tool immediately.

Direction
Secret manifest
Converted manifest

Waiting for input.

Parsing stays in this browser. Input is not uploaded or saved.

How to use this tool

  1. Paste the output of kubectl get secret NAME -o yaml, or load the sample.
  2. Choose Decode data to read the values, or Encode stringData to turn plain values into base64 data.
  3. Copy the manifest. Other documents in the file, such as a Deployment, are left unchanged.

Supported formats and limitations

  • Only documents with kind: Secret are changed. A file with several documents keeps the others as they are.
  • A value that decodes to binary, such as a keystore, is not valid text. It stays base64 under data.
  • If a key exists in both data and stringData, the stringData value is kept, as Kubernetes does.
  • Comments and the order of other fields are kept.

Examples

Decode one value

YWRtaW4= under data becomes username: admin under stringData.

kind: Secret
data:
  username: YWRtaW4=

A certificate

A decoded value with line breaks is written as a | block so the line breaks survive.

kind: Secret
data:
  tls.crt: bGluZSBvbmUKbGluZSB0d28K

Common errors and solutions

is not valid base64
The value has a character base64 does not use, or the wrong length. Check that it was not truncated when copied.
No document has kind: Secret
Paste a Secret. A ConfigMap stores plain text and needs no decoding.

FAQ

Is base64 encryption?
No. Anyone with the manifest can decode it, as this page does. Use encryption at rest or a secrets manager to protect the values.
Can I apply the decoded manifest?
Yes. Kubernetes accepts stringData and encodes it into data when the Secret is written.
Are my secrets sent anywhere?
No. The manifest is decoded in your browser. It is not uploaded, stored, or put in the URL.

Read next

Related tools

  • Kubernetes YAML syntax check

    Check the YAML syntax of a Kubernetes manifest, including files with more than one document. This does not check apiVersion, required fields, or unknown kinds.

  • YAML validator

    Check YAML syntax without converting or rewriting it. Errors include a line and column when the parser provides them, and valid input is left unchanged.

  • YAML formatter

    Reformat YAML with consistent 2- or 4-space indentation in the browser. Comments, quotes, anchors, and multiple documents are kept.