Kubernetes Secret Decoder for kubectl YAML

How to decode a Kubernetes Secret

1. Run kubectl get secret app-db -n shop -o yaml and paste the output into the box. JSON from -o json works too.
2. The table lists each key with its decoded value and size, plus Copy and Copy Base64 buttons.
3. The output pane holds the same Secret rewritten with stringData, values in plain text. Binary values stay in data.
4. Switch to Build Secret for the reverse: KEY=value lines in, a Secret with Base64 data out.

The input can also be a List from kubectl get secrets -o yaml, several documents separated by ---, a Helm-rendered manifest, a bare .dockerconfigjson or just one Base64 value.

Example: what kubectl gives you and what it means

apiVersion: v1
data:
  DATABASE_URL: cG9zdGdyZXM6Ly9hcHA6czNjcjN0LVBhNTVAZGI6NTQzMi9zaG9w
  DB_PASSWORD: czNjcjN0LVBhNTUK
  DB_USER: YXBw
kind: Secret
metadata:
  name: app-db
  namespace: shop
type: Opaque

The password is 11 characters, but the value is 12 bytes. Someone created it with echo 's3cr3t-Pa55' | base64, and the trailing newline will break the database login. The Base64 without the newline would be czNjcjN0LVBhNTU=.

What the decoder recognizes

• PEM certificates and keys such as tls.crt and tls.key in a kubernetes.io/tls Secret are flagged. Certificates get a link to the certificate decoder for expiry and SAN checks.
• JSON values are pretty-printed.
• Binary values such as a Java keystore get their file type, a hex preview and a Download button.
• .dockerconfigjson and .dockercfg values are split into registry, username and password, with auth decoded. The .dockerconfigjson decoder puts these first.

kubectl one-liners

One value. Escape dots in key names inside jsonpath:

kubectl get secret app-db -o jsonpath='{.data.DB_PASSWORD}' | base64 --decode
kubectl get secret app-tls -o jsonpath='{.data.tls\.crt}' | base64 --decode

All values, with kubectl’s built-in base64decode template function or with jq:

kubectl get secret app-db -o go-template='{{range $k, $v := .data}}{{$k}}={{$v | base64decode}}{{"\n"}}{{end}}'
kubectl get secret app-db -o json | jq '.data | map_values(@base64d)'

Creating a Secret without the newline trap:

kubectl create secret generic app-db --from-literal=DB_PASSWORD='s3cr3t-Pa55' --dry-run=client -o yaml

More shell recipes are on the Bash Base64 page.

Limits and common problems

• “No Secret with data or stringData found”: the paste is probably a Deployment or a ConfigMap. ConfigMap values are plain text and need no decoding.
• Size: a Secret is limited to 1 MiB in total. Build Secret checks the limit, key names and the DNS-style name before you apply anything.
• YAML features: the reader covers what kubectl, Helm and Kustomize produce, including block scalars and multiple documents. Anchors, aliases and merge keys are not supported.
• Helm release Secrets (sh.helm.release.v1.*) contain Base64 of gzip data inside the Base64 data value. Decode the outer layer here, then use the gzip Base64 decoder.

FAQ