See what's actually in your Kubernetes Secrets
No more piping through base64. Kubius decodes Secret values on screen - gated behind Touch ID - shows every pod and workload that mounts them, and lets you edit and apply changes safely.
Works with Google GKE, Amazon EKS, Azure AKS, DigitalOcean, self-managed & more · macOS Sonoma (14) or later
Secrets, without the friction
Decoded, but protected
Values are masked by default and revealed only after a Touch ID check, on a short unlock window. Copy a decoded value in one click when you actually need it.
Find the right Secret fast
Filter across namespaces, jump straight to a Secret with ⌘K, and read its keys, type and age at a glance.
See what consumes it
A Consumers tab lists every pod, deployment and workload that references the Secret as an env var or volume - so you know the blast radius before you touch it.
Safe YAML editing
View the live YAML, compare against last-applied with a colour diff, and apply changes - with the same Touch ID gate protecting the raw data.
Export when you must
Export decoded config to .env, CSV or XLSX for a migration or audit - each export re-checks Touch ID so nothing leaks by accident.
TLS, docker and opaque
Kubius understands the common Secret types and renders them sensibly, from opaque key/value to TLS certs and image-pull credentials.
Why Kubius for Secrets
The safe way to read a Secret
Everything happens on your Mac - decoded values never leave the machine.
- Touch ID-gated reveal with an auto-relock window
- Values masked by default; the last-applied annotation is redacted too
- Consumers tab: every workload that mounts the Secret
- Live YAML + colour diff against last-applied
- Export to .env / CSV / XLSX with a fresh Touch ID check
- 14-day free trial, no card required
Simple, one-time pricing
Pay once. No subscription.
One-time licence from €49 - no subscription. 14-day free trial, no card required.
Free 14-day trial · macOS Sonoma (14) or later · No agents, nothing to install in-cluster
Questions, answered
Do I have to base64-decode Secret values myself?
No. Kubius decodes them for display once you pass the Touch ID check, and offers a one-click copy of the decoded value. You never touch base64 by hand.
Is it safe to reveal secrets in a GUI?
Reveal is gated behind macOS biometric authentication (Touch ID) with a short unlock window, values are masked until you explicitly reveal them, and the last-applied annotation is redacted. Everything stays local to your Mac - nothing is sent anywhere.
Can I see what uses a Secret before editing it?
Yes - the Consumers tab lists every pod and workload that references the Secret, so you can gauge the impact of a change first.
Can I edit and apply Secret changes?
Yes. You can view and edit the live YAML, diff it against the last-applied configuration, and apply - with the biometric gate protecting the underlying data.