Kubernetes Secret data is Base64-encoded so binary values can travel through JSON and YAML. That makes it readable, not protected.

01

Inspect the resource type

Confirm the document is a Secret and identify whether values live under data or stringData.

apiVersion: v1
kind: Secret
type: Opaque
02

Decode locally

Use a local command or ParseNest's browser-local decoder. Never paste a live token into an untrusted service.

printf '%s' 'cGFyc2VuZXN0' | base64 --decode
03

Verify storage protection

Check whether the cluster enables encryption at rest and whether RBAC limits who can read Secrets.

kubectl auth can-i get secrets -n <namespace>
04

Rotate exposed values

If a Secret reached logs, tickets, chat, or a server-side tool, treat it as exposed and rotate the underlying credential.

Key takeaways
  • Base64 is not encryption.
  • Prefer local decoding.
  • Control access with RBAC and encryption at rest.