NV ToolkitFormat · Validate · Convert

Base64 Tools

Base64 ⇄ YAML Converter

The Kubernetes-secret decoder — Base64 to clean, validated YAML and back, entirely in your browser.

In short

Decode Base64 to YAML online (and encode YAML to Base64): UTF-8 safe, fully parsed and re-formatted — ideal for Kubernetes secrets and CI variables.

By NaveenKumar T · Updated

Learn: What is Base64? Encoding Explained Without the Mystique

  • Both directions in one tool
  • UTF-8 safe en/decoding
  • Parses & formats the YAML

Runs entirely in your browser — nothing you paste or open here is uploaded, logged, or stored.How we handle data →

Example

Base64 to YAML: input and output

A config file encoded for the data section of a Kubernetes Secret manifest.

YAML
database:
  host: db.internal
  port: 5432
  user: app_rw
  password: "s3cr3t#2026"
tls: true
Base64
ZGF0YWJhc2U6CiAgaG9zdDogZGIuaW50ZXJuYWwKICBwb3J0OiA1NDMyCiAgdXNlcjogYXBwX3J3CiAgcGFzc3dvcmQ6ICJzM2NyM3QjMjAyNiIKdGxzOiB0cnVl

The YAML was parsed before encoding — a bad indent or an unclosed quote would have been reported instead — and the Base64 covers the text byte-for-byte, so the quotes and the # inside the password survive.

Learn more

Base64 + YAML: the Kubernetes workflow

kubectl get secret returns data fields Base64-encoded, and writing a Secret manifest requires encoding values yourself — both directions of this tool, used daily by anyone operating clusters. Decoding here additionally parses the result as YAML when it is YAML (config files stored in secrets), formatting it for reading; pure string secrets simply come out as their text.

Everything happens locally, which matters precisely because these are secrets: nothing you paste leaves the browser. Base64 itself is a transport encoding, not encryption — see the FAQ above on why Secret values aren't protected by it alone.

Help

Frequently asked questions

Everything you need to know about the Base64 to YAML.

01How do I use Base64 to YAML?

Paste YAML and Convert to Base64-encode it (YAML → Base64 is the default mode) — for example when writing a Secret manifest by hand. Switch the mode to Base64 → YAML to decode a value from a k8s Secret's data field, a CI variable or a config blob into parsed, formatted YAML.

02Why are Kubernetes Secret values Base64 and not encrypted?

Base64 exists there to make arbitrary bytes YAML-safe, not to protect them — anyone with read access decodes them instantly (as this tool demonstrates). Treat Secret access control and encryption-at-rest as the real security; Base64 is just packaging.

03Why did my decoded secret change — leading zeros gone, quotes removed?

Because Base64 → YAML parses the decoded text as YAML and re-serializes it, which normalizes plain scalars: 0123 comes out as 123, 1e3 as 1000, "hunter2" loses its quotes, and comments in a config file disappear. Structure and key order are preserved. For opaque values — passwords, API tokens, anything numeric-looking — use the plain Base64 tool, which returns the exact bytes; keep this page for values that really are YAML documents.

04How do I decode one key of a Kubernetes Secret?

Pull that key with kubectl and pipe it through Base64: kubectl get secret app -o jsonpath='{.data.config\.yaml}' | base64 -d, then paste the result here for the parsed, formatted view. Each field under data is encoded separately, so decode the specific key you need rather than the whole manifest.

05Is stringData also Base64?

stringData holds plain, unencoded text — you write the value directly and the API server Base64-encodes it into data when the Secret is created or updated. Reading a Secret back with kubectl get -o yaml always shows data, already encoded, regardless of which field you used to write it.

Keep working

Related tools

Learn the format

Related guides

All guides →