How to Base64 Encode Kubernetes Secrets Without a Web Tool

When you're building a Kubernetes Secret manifest, the data: block requires Base64-encoded values. Many developers handle this by pasting raw passwords and API keys into an online Base64 encoder — which sends those credentials to a third-party server. There's a safer way.

Why Kubernetes Uses Base64

A Kubernetes Secret manifest looks like this:

The values under data: are Base64-encoded strings. The raw values — supersecret, sk_test_8c8b4560 — are not stored in the manifest directly.

Encoding Secret Values with TextForge

TextForge is a Chrome extension with 50+ text utilities. Base64 encode runs entirely locally in the free version — no data leaves your browser.

1. 1
   Open TextForge

   Click the TextForge icon in your browser toolbar to open the extension panel.
2. 2
   Paste the raw secret value

   Paste your password, API key, connection string, or any value you need in encoded form. Encode one value at a time.
3. 3
   Apply Base64 Encode

   Select Base64 Encode from the tools menu. The encoded string appears immediately.
4. 4
   Paste into your YAML manifest

   Copy the encoded output and paste it as the value under the appropriate key in the data: block.

Using stringData Instead

Kubernetes also supports a stringData: field that accepts plain text — the API handles Base64 encoding automatically:

stringData is fine for secrets you're creating from scratch. But when you're reading an existing manifest or one generated by a tool, the values will be in data: in Base64 form — which is when you need to decode them for inspection. For that, paste the encoded value into TextForge and apply Base64 Decode.

Frequently Asked Questions