Base64 Encoder / Decoder

Encode and decode Base64 strings. Essential for Kubernetes secrets, API tokens, JWT debugging, and certificate inspection.

Plain Text (input)

Base64 Output

Common DevOps Use Cases

Kubernetes Secret

$ echo -n 'mypassword' | base64

Encode value for K8s Secret manifest

Decode K8s Secret

$ kubectl get secret db-creds -o jsonpath='{.data.password}' | base64 -d

Decode secret value from cluster

JWT Token

$ echo 'eyJhbGci...' | cut -d. -f2 | base64 -d

Decode JWT payload (middle segment)

SSL Certificate

$ cat cert.pem | base64 -w0

Encode cert for inline use in configs

What is Base64 Encoding?

Base64 is a binary-to-text encoding scheme that converts binary data into a set of 64 ASCII characters (A-Z, a-z, 0-9, +, /). It is widely used in software engineering to safely transmit binary data through text-based protocols and systems. Base64 increases the data size by approximately 33%, but guarantees that the encoded output contains only printable characters that won't be corrupted during transport.

DevOps engineers encounter Base64 encoding daily when working with Kubernetes secrets (which must be Base64-encoded in manifests), JWT tokens (where the header and payload are Base64URL-encoded), API authentication headers (HTTP Basic Auth encodes credentials in Base64), SSL certificates embedded in configuration files, and email attachments (MIME encoding). This tool performs encoding and decoding entirely in your browser, making it safe for handling sensitive values like passwords and API keys.

Frequently Asked Questions

Is Base64 encryption?

No, Base64 is encoding, not encryption. It provides no security whatsoever—anyone can decode a Base64 string without any key or secret. It is designed for data transport compatibility, not confidentiality. This is a common misconception with Kubernetes secrets, which are Base64-encoded but not encrypted by default. For actual security, use encryption at rest (like AWS KMS or sealed-secrets) on top of Base64 encoding.

Why does Kubernetes use Base64 for secrets?

Kubernetes uses Base64 encoding for secrets to safely store binary data (like TLS certificates or SSH keys) in YAML manifests and the etcd datastore, which are text-based systems. It is not for security—it is for data integrity during storage and transmission. To actually secure secrets, enable encryption at rest in etcd, use external secret managers like HashiCorp Vault, or tools like sealed-secrets that encrypt before storing.

How to base64 encode in terminal?

On Linux and macOS, use echo -n 'your-string' | base64 to encode (the -n flag prevents a trailing newline from being included). To decode, use echo 'encoded-string' | base64 -d (or base64 --decode on some systems). On macOS, the -D flag is used for decoding. Always use -n with echo when encoding to avoid unexpected newline characters in your encoded output.