K8s/Terraform Base64 Secret Checker
Paste a base64 value from a Kubernetes Secret's
data: field, a Terraform variable, or a
kubectl create secret output, and see exactly why
strict Go-based decoders will accept or reject it — invisible
whitespace/newlines, double-encoding, base64url characters, or a
padding mismatch that a human (or an LLM) eyeballing the string
won't catch.
Why does kubectl reject a base64 secret value that looks fine?
Kubernetes and most Go-based tooling use Go's
encoding/base64 in strict mode, which rejects any
whitespace or newline characters in the input. If the value was
copied from a terminal, a YAML block, or generated by a tool
that wraps long base64 lines, it likely has embedded newlines
that look invisible when you paste it but make Go's decoder
fail with a corrupt input error. This tool flags every
whitespace character explicitly instead of silently stripping
it.
What does double-encoding mean and why does it happen?
Double-encoding happens when a value that's already base64 gets
base64-encoded again, usually because a Terraform provider or a
script assumed the input was plaintext and encoded it before
storing it in a Secret's data field (Kubernetes
Secrets always store their data field as base64).
The result decodes successfully once, but the decoded output is
itself valid base64 instead of the real plaintext value. This
tool detects that pattern and shows you both decode levels.
Does this tool send my secret value anywhere?
No. Every check and decode runs entirely in your browser with plain JavaScript. Nothing you paste is uploaded or transmitted anywhere.