YAML to Base64

YAML to Base64 for secrets and variables

YAML depends on line breaks and indentation, which many places cannot store reliably: CI/CD secret fields, environment variables, single-line input boxes and some key–value stores. Converting YAML to Base64 turns the whole document into one line of safe characters that decodes back to the exact original, whitespace included.

Example

Input:

apiVersion: v1
kind: ConfigMap
data:
  mode: production
  replicas: "3"

Output:

YXBpVmVyc2lvbjogdjEKa2luZDogQ29uZmlnTWFwCmRhdGE6CiAgbW9kZTogcHJvZHVjdGlvbgogIHJlcGxpY2FzOiAiMyI=

Typical uses

• Kubeconfig in CI. A common pattern is storing a kubeconfig as a Base64 secret in GitHub Actions or GitLab CI and decoding it in the pipeline with echo "$KUBECONFIG_B64" | base64 -d > ~/.kube/config.
• Cloud-init user data. Cloud APIs such as EC2’s RunInstances expect user data (often a #cloud-config YAML) to be Base64 encoded; the AWS CLI and most SDKs do this for you.
• Helm and Kustomize values passed through tools that only accept single-line strings.
• Configuration inside JSON, such as API requests that carry a YAML definition in a string field.

Kubernetes Secrets: encode values, not files

In a Kubernetes Secret, each value under data: must be Base64 encoded individually — you do not encode the whole manifest. For example, the value production becomes cHJvZHVjdGlvbg==. Alternatively, use stringData: and let Kubernetes encode the values. Remember that Base64 is not encryption; enable encryption at rest or use a secrets manager for real protection.

Encoding on the command line

GNU base64 wraps its output every 76 characters by default, and a wrapped value pasted into a single-line secret often breaks. Use base64 -w 0 kubeconfig on Linux to get one line; the macOS base64 command does not wrap unless asked. This tool writes the Base64 on a single line unless you tick Wrap lines at 76 chars (MIME), so the result can be pasted directly.

Keeping encoded configs secret in CI

Storing a Base64 kubeconfig as a CI secret is common, but a few details decide whether it stays private:

• Log masking only covers the exact secret. CI systems hide the Base64 string in logs, but not the decoded YAML. Never cat the decoded file or run a command with verbose output that prints it.
• Size limits. GitHub Actions secrets can hold up to 48 KB. A kubeconfig with embedded certificates is usually far below that, even after the 33% Base64 overhead, but very large configs may need to be split or stored in a secrets manager.
• Clean up. Write the decoded file to a temporary path with restrictive permissions (chmod 600) and delete it at the end of the job on self-hosted runners.

Watch the trailing newline

Encoding is byte-exact, so a trailing newline in your input becomes part of the Base64. That matters for passwords and tokens stored in secrets: echo "secret" | base64 includes a newline, while printf "secret" | base64 does not. Check that your input ends where you want it to.

Validate the YAML before encoding with the YAML Validator, and decode it again with Base64 to YAML. Everything runs in your browser, but avoid pasting live production credentials into any website.