Base64 to YAML

Base64 to YAML decoder

Base64 to YAML decoding restores a configuration file that was packed into a single line. Paste the string from a CI variable, a cloud console or an API response, and the tool decodes it and shows the YAML with syntax highlighting so you can check keys, nesting and values.

Example

Base64 input:

YXBpVmVyc2lvbjogdjEKa2luZDogQ29uZmlnTWFwCmRhdGE6CiAgbW9kZTogcHJvZHVjdGlvbgogIHJlcGxpY2FzOiAiMyI=

Decoded YAML:

apiVersion: v1
kind: ConfigMap
data:
  mode: production
  replicas: "3"

Common sources

• Kubeconfig files stored as Base64 secrets in GitHub Actions, GitLab CI or other pipelines.
• EC2 and other cloud instance user data shown in Base64 in consoles and APIs.
• Helm release data and Argo CD or Flux resources that embed configuration as encoded strings.
• Individual values from Kubernetes Secrets — for example, a secret that holds an application config file.

Decoding Kubernetes Secret values

A Kubernetes Secret stores each value Base64 encoded. To read one on the command line: kubectl get secret my-secret -o jsonpath='{.data.config\.yaml}' | base64 -d. If you already have the string, paste it here instead. The tool decodes one value at a time; the Secret manifest around it is plain YAML.

Checking the result

• Indentation is restored exactly as it was encoded, so if nesting looks wrong, the YAML was already broken before encoding.
• Trailing newlines are kept; they are part of the encoded bytes. Windows (CRLF) line endings are shown as plain line feeds, because the editor stores every line break that way.
• Binary output (a hex dump) means the value was not YAML — perhaps it was compressed, or it is a certificate in DER format.

To confirm the decoded document parses, run it through the YAML Validator or convert it with YAML to JSON. Encode it again with YAML to Base64.

Kubeconfigs often contain Base64 inside Base64: the certificate-authority-data, client-certificate-data and client-key-data fields are themselves Base64-encoded PEM files. Decode one of those values again to see the certificate in its -----BEGIN CERTIFICATE----- form.

When the decoded YAML still will not load

• Tabs in the indentation. YAML does not allow tab characters for indentation. Base64 restores them faithfully, so a file that was written with tabs decodes fine but fails to parse. Replace them with spaces.
• Encoded twice. If the output is another long string of letters and digits, the value was Base64-encoded two times, which is a common slip when a script encodes a value that was already encoded. Paste the output back in to decode it again.
• data versus stringData. In a Kubernetes Secret, only values under data are Base64. Values under stringData are plain text and need no decoding.
• A stray newline. echo 'key: value' | base64 encodes a trailing line break. That is harmless for a YAML file, but for single values such as passwords use printf '%s' when encoding.

Handle credentials with care

Decoded kubeconfigs and secrets often contain tokens, client keys or passwords. The decoding happens only in your browser and nothing is uploaded unless you click Save & Share, so do not create a share link for real secrets; copy the result straight to where it belongs and avoid leaving it in shared documents or chat.