Is my kubeconfig uploaded?

No. It is parsed in your browser and nothing is sent or saved. Even so, a kubeconfig with embedded keys is a credential - prefer the redacted copy whenever you share one.

Why does it reject some YAML?

It reads the plain YAML kubectl writes. For anything more elaborate, run `kubectl config view --raw -o json` and paste the JSON instead.

How do I remove a context?

Run `kubectl config delete-context NAME`, and `kubectl config delete-user` and `delete-cluster` for the entries it used.

Free tool · no account

kubeconfig inspector and redactor

kubeconfig files collect contexts, clusters, and credentials over time, and it is rarely obvious which users carry an embedded private key or a static token. Paste one to see every context and how each user authenticates, and get a copy with secrets removed that you can safely share when asking for help.

kubeconfig

YAML as kubectl writes it, or kubectl config view --raw -o json.

See every context, cluster, and user in a kubeconfig, how each user authenticates, and get a copy with keys and tokens removed that is safe to share.

Runs entirely in your browser. Nothing you enter is sent to Shortspan or saved, and no account is needed.

Next step

Kubeconfigs that do not live on laptops

Shortspan stores kubeconfigs encrypted and writes one to a temporary file only for the life of a shortspan k8s subshell, removing it when the shell exits.

Create a free workspace See what Shortspan does

How each user authenticates

An embedded client key means whoever holds the file is that user until the certificate expires - Kubernetes cannot revoke a single client certificate. A static token is valid until it is deleted. An exec plugin, such as aws eks get-token or gke-gcloud-auth-plugin, fetches short-lived credentials each time and stores nothing long-lived in the file.

The in-tree auth providers were removed from kubectl in Kubernetes 1.26, and basic authentication was removed from the API server in 1.19; the inspector flags both.

The redacted copy

Private keys, tokens, passwords, and exec plugin environment values are replaced with REDACTED. Server addresses and CA certificates are kept, because they are what someone helping you needs to see.

Common questions

Is my kubeconfig uploaded?: No. It is parsed in your browser and nothing is sent or saved. Even so, a kubeconfig with embedded keys is a credential - prefer the redacted copy whenever you share one.
Why does it reject some YAML?: It reads the plain YAML kubectl writes. For anything more elaborate, run kubectl config view --raw -o json and paste the JSON instead.
How do I remove a context?: Run kubectl config delete-context NAME, and kubectl config delete-user and delete-cluster for the entries it used.

More free tools