YAML to Base64

YAML to Base64 for Kubernetes Secrets and CI/CD

This converter encodes YAML to Base64 and decodes it back, with a special mode for the most common DevOps task: filling the data: block of a Kubernetes Secret. You can encode a whole YAML file as one Base64 string, or keep the keys and encode each value individually.

Two ways to encode

Whole document (default) turns the complete YAML text, indentation and comments included, into a single Base64 string. That's what you want when a pipeline variable must hold an entire config file, for example a kubeconfig, a Helm values.yaml, or a GitHub Actions secret that a job writes back to disk with echo "$CONFIG" | base64 -d > config.yaml.

Only values (key: value) keeps every key and encodes just the part after the first : . Comments and empty lines are left alone, and surrounding quotes are removed. The line DB_PASSWORD: s3cr3t-P@ss becomes DB_PASSWORD: czNjcjN0LVBAc3M=, ready to paste under data: in a manifest:

apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
type: Opaque
data:
  DB_PASSWORD: czNjcjN0LVBAc3M=

Decoding

Switch to Base64 to YAML to turn a Base64 blob back into readable YAML, for instance the output of kubectl get secret app-secrets -o yaml or an encoded CI variable. The decoder tolerates whitespace, line breaks, missing padding, and URL-safe characters.

Tips for CI/CD

GitLab CI, GitHub Actions, Bitbucket Pipelines, and Azure DevOps all mask secret variables better when they are a single line, which is why multi-line YAML is usually stored as Base64. Avoid line wrapping for these values. For JSON configs such as Docker registry credentials use JSON to Base64, and for secrets in URL parameters see URL Encode / Decode.