Enter key/value pairs or paste a .env file and get a ready-to-apply Kubernetes Secret: values are base64-encoded for you, names and keys are validated, and the matching kubectl command is shown. Switch to Decode to read the values of an existing Secret.
Last updated:
Data
Labels, annotations and options
Write values as
Decoded values
Everything is encoded and decoded in this browser tab. Remember: base64 is an encoding, not encryption, so treat the output as a secret.
Advertisement
Advertisement
How to use the Kubernetes Secret Generator
Name the Secret and pick a namespace and type. Opaque is the general-purpose type for app settings.
Add the data as key/value rows, paste a .env file, or add a file such as a certificate or JSON config as a key.
Choose data or stringData: data stores base64 values; stringData lets you keep readable text that the API server encodes on write.
Fix any red notes, then copy or download the YAML and run kubectl apply -f, or use the kubectl tab instead.
Need to read a Secret? Open Decode Secret and paste the output of kubectl get secret NAME -o yaml.
Kubernetes Secret types
type
Required keys
Typical use
kubectl shortcut
Opaque
Any
App passwords, API tokens, connection strings
create secret generic
kubernetes.io/dockerconfigjson
.dockerconfigjson
Pulling images from a private registry via imagePullSecrets
Do not commit Secret YAML to Git. base64 can be decoded by anyone. Use a tool such as Sealed Secrets, SOPS or an external secrets operator for GitOps workflows.
Watch for trailing newlines.echo "pass" | base64 encodes a newline too; use echo -n or printf. This tool encodes exactly what you type.
Limit access with RBAC: get and list on Secrets reveal their contents, and so does permission to create pods in the namespace.
The data field of a Secret holds arbitrary bytes, such as certificates or keystores, and base64 lets those bytes travel safely inside YAML and JSON. It is only an encoding, not encryption: anyone who can read the Secret can decode it, so protect access with RBAC and consider encryption at rest for etcd.
What is the difference between data and stringData?
data expects base64-encoded values. stringData accepts plain text and is a write-only convenience: the API server encodes the values and merges them into data when the Secret is stored, and stringData wins if the same key is in both. When you read the Secret back, you always get data in base64.
How do I create a Secret from a .env file?
Paste the file into the Paste .env view of this tool and download the YAML, or run kubectl create secret generic NAME --from-env-file=.env. Each KEY=value line becomes one key in the Secret. You can then load all keys into a container as environment variables with envFrom and secretRef.
How do I decode a Kubernetes Secret?
Paste the output of kubectl get secret NAME -o yaml into the Decode Secret tab to see every value. On the command line you can decode one key with kubectl get secret NAME -o jsonpath='{.data.KEY}' piped into base64 --decode.
What names and keys are allowed?
The Secret name must be a DNS subdomain: lowercase letters, digits, hyphens and dots, up to 253 characters. Data keys may contain letters, digits, hyphens, underscores and dots. The namespace is a DNS label of at most 63 characters.
How big can a Secret be?
Each Secret is limited to 1 MiB of data, so large files belong in a volume or object storage instead. Many small Secrets are also better than one huge one, because each is sent to every node that runs a pod using it.
What does immutable: true do?
An immutable Secret cannot have its data changed after creation; you delete and recreate it instead. This protects against accidental edits and lets the kubelet stop watching it, which reduces load on the API server in large clusters.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.