Secret Size Calculator
Check whether a Kubernetes Secret's encoded data fits within size constraints.
About Secret Size Calculator
Kubernetes Secrets store their data values base64-encoded, which inflates raw byte size by roughly 4/3 (33% overhead) before it's persisted to etcd. Combined with etcd's hard 1MiB object size limit, a Secret holding what looks like a modest 800KB of raw certificate/key data can actually fail to create once encoding overhead is accounted for — this calculator applies that encoding factor to give an accurate size check.
Formula
encodedSize = rawSize × (4 / 3)
- S_r
- Raw data size in KB
- S_e
- Base64-encoded size in KB
Worked example
With the default values below, Secret Size Calculator returns Base64-Encoded Size of 400.0. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Raw Data Sizeaccepts 0–10,000 KB
- 300 KB
Results
- Base64-Encoded Size
- 400.0 KB
- Percent of 1MiB Limit
- 39.1%
- Base64 Encoding Overhead
- 100.0 KB
- Exceeds 1MiB Limit
- false
Step by step
- 1Base64-encoded size = raw × 4/3= 400.0KB
- 2Encoding overhead= 100.0KB
- 3Percent of 1MiB limit= 39.1%
Assumptions and limits
- The result is derived only from the single input listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
Why does Kubernetes base64-encode Secret data at all?
Secret values can contain arbitrary binary data (certs, keys) that isn't safe to embed directly in YAML/JSON; base64 encoding makes it representable as printable text in the API object, at the cost of the well-known ~33% size overhead of that encoding scheme.
Is base64 encoding the same thing as encryption?
No — base64 is a reversible text encoding, not encryption. Anyone with API access to read the Secret object can trivially decode it; actual confidentiality relies on RBAC restricting who can read Secrets, plus optionally encryption-at-rest for etcd.
What's the workaround for Secrets that need to exceed 1MiB?
Split data across multiple Secret objects, or store large sensitive blobs in an external secrets manager (e.g. Vault, cloud KMS-backed secret store) and inject only a reference or short-lived credential via the Secret instead of the full payload.