Skip to content
TextArray1.53.0
100% local

Kubernetes secret encoder

Convert Kubernetes Secret values between base64 data and readable stringData.

Input
Output
Related tools
Base64 encode and decodeEncoding & conversion
Env to JSONDeveloper tools
Kubernetes manifest overviewnewDeveloper tools
Baudot code translatorEncoding & conversion
Charset detectorEncoding & conversion
Timezone converterEncoding & conversion
Kubernetes secret encoder
A Kubernetes Secret stores its values two ways: base64 in the data field, or plain text in stringData that the API server encodes for you on apply. This tool flips a Secret manifest between the two. Paste a manifest with stringData and it encodes every value into data; paste one with data and it decodes the base64 back to readable text, so you can actually see what a Secret contains without running it through kubectl and a separate decoder by hand.
You can also start from a .env file or a plain list of KEY=VALUE lines — export prefixes and quoted values are handled — and the tool builds a complete Secret manifest around it, ready to encode. Set the secret's name and namespace, and pick its type: Opaque for general values, kubernetes.io/dockerconfigjson for registry credentials, or kubernetes.io/tls for a certificate pair. Turning off "Keep other manifest fields" strips labels and everything else down to a minimal manifest; leaving it on preserves them, along with the original type.
Long base64 values can be folded across multiple lines for readability without changing the decoded content — the breaks use YAML's escaped-continuation syntax, not the kind of wrapping that would corrupt the value. A value that isn't valid base64 is flagged instead of silently mangled. Masking replaces every value with a fixed placeholder when you need to share a manifest's shape without exposing what it actually holds.
Everything runs locally in your browser. The manifest you paste, credentials included, is never uploaded — check your network tab if you want to confirm it. Copy the result, download it as .txt, or send it back into the input for another pass.
FAQ
What is the difference between data and stringData in a Secret?
data holds every value base64-encoded, which is how Kubernetes stores and transmits Secrets internally. stringData holds plain text; the API server base64-encodes it into data the moment you apply the manifest, and never returns it as stringData afterward.
Can I build a Secret from a .env file?
Yes. Paste KEY=VALUE lines (or a real .env file, export prefixes and quotes included) and choose Encode — the tool builds a full manifest with those values base64-encoded into data.
Does wrapping base64 values change the secret?
No. Wrapped lines use YAML's backslash line-continuation, which reproduces the exact original string when decoded again — it only changes how the manifest looks, not what it contains.
What happens if a data value is not valid base64?
With "Warn on invalid base64" on, that entry is flagged in the output instead of being decoded incorrectly or dropped, so you can spot a truncated or corrupted value at a glance.
Is my Secret manifest uploaded anywhere?
No. Every conversion runs locally in your browser's JavaScript — the manifest, and any credentials in it, never leave your device.