K8sTools

Secret base64 encoder

Base64 is an encoding, not encryption. Anyone who can read the Secret can decode it. This page does the conversion locally and hides values until you reveal them.

Base64 is encoding, not encryption. Anyone who can read a Secret object can decode it. Values on this page stay in memory: they are never saved, logged or sent anywhere.

Encode / decode

—

Secret builder

Passes pack schemaKubernetes 1.31, pack 2026.10.0
apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
  namespace: app
type: Opaque
data:
  username: ""
  password: ""

Preview masks values unless “Show decoded text” is on; Copy copies the real YAML. For real secrets, prefer kubectl create secret or a sealed/external secret workflow over files.

Inspect an existing Secret

Secret/web-db, type Opaque
KeyValueBytesReveal
username
data
••••4
password
data
•••••••7

data or stringData

data holds base64-encoded bytes. stringData accepts plain text and the API server encodes it on write. If a key is in both, stringData wins. Both end up stored the same way, and neither is encrypted unless your cluster has encryption at rest configured.

For anything real, prefer creating Secrets without writing values to files, or use a sealed or external secret workflow. Decoded values on this page stay in memory and are never written to logs or diagnostics.

Questions

Is my secret sent anywhere?

No. Encoding and decoding use the browser’s built-in functions. The Secret builder is not autosaved, and decoded values are not persisted.

Why does a decoded value end with a newline?

Values encoded with echo instead of echo -n or printf include the trailing newline. The decoder shows byte counts so you can spot it.

Other tools

Manifest editorEdit multi-document Kubernetes YAML with per-document identity, duplicate detection, a relationship graph with an accessible table, and findings tied to source lines.YAML validatorValidate Kubernetes YAML against a versioned schema pack with separate YAML, schema, cross-object and policy findings.Deployment generatorGenerate a Deployment with Service, Ingress, PodDisruptionBudget and HPA: named ports, probes, requests and a hardened security context, validated as you type.Service generatorBuild ClusterIP, NodePort, LoadBalancer, headless and ExternalName Services, and check selector and targetPort mapping against a pasted workload.Resource calculatorExact Kubernetes quantity parsing (100m vs 100Mi), unit conversion, and requests/limits totals that account for init containers, native sidecars, replicas, rollout surge and overhead.RBAC analyzerInspect Roles, ClusterRoles and bindings offline: subject-to-permission matrix, aggregated-role handling, risky verbs, and "can this subject do X" checks scoped to the supplied rules.NetworkPolicy explainerExplain which pods each NetworkPolicy isolates and test traffic scenarios between pods, namespaces and IPs with additive allow-list reasoning.Probe builderBuild liveness, readiness and startup probes and see their timing: when the first check runs, how long until a failure triggers action, and what that action is.Manifest diffCompare two Kubernetes bundles by text or by object: objects matched by identity, list items matched by name, and status or server fields ignored only when you choose.API deprecationsFind Kubernetes APIs removed or deprecated for your target version, using a dated pack, and preview field-aware migrations with the semantic changes you need to review.CronJob schedulePreview the next runs of a Kubernetes CronJob schedule in its spec.timeZone, explain concurrency and deadline settings, and catch TZ= in the schedule string.Redact exportFind Secret data, tokens, credential-bearing env values and last-applied annotations in Kubernetes YAML, review each one, and export a redacted copy.TemplatesSynthetic Kubernetes templates with safe defaults — web app, StatefulSet, CronJob, NetworkPolicy, RBAC, HPA, sidecar — each tested against the schema pack for every supported version.