How it works
Private by design
Values are encrypted with the Web Crypto API. They never touch the network, never get logged, and never appear in the output.
Git-safe output
The manifest contains ciphertext only — RSA-OAEP wrapped session keys and AES-256-GCM payloads. Safe to commit, even on public repos.
Toolchain drop-in
Byte-for-byte compatible with kubeseal 0.38 / sealed-secrets controller 0.19+. Verified by an automated 71-check test harness.
Nothing to install
One HTML file. Open it on any device — Windows, macOS, Linux, Android, iOS — and it works fully offline.
Options
Values
Sealing certificate (public PEM)
The public certificate of your sealed-secrets controller. Fetch it with
kubeseal --fetch-cert > sealed-secrets-cert.pem or paste a bare
BEGIN PUBLIC KEY block. You can also load it from a file:
Generate
Manifest will appear here. It contains ciphertext only, so it is safe to commit to git.