Free OAuth token decoder and XOAUTH2 builder
Debug OAuth 2.0 sign-in for IMAP, POP, and SMTP: decode an access token to check that it is valid for email, or build and decode the XOAUTH2 strings your app sends.
This tool runs entirely in your browser – your token is never sent anywhere. Even so, treat access tokens like passwords.
Build an XOAUTH2 string
XOAUTH2 string (base64):
Commands:
Decode an XOAUTH2 or OAUTHBEARER string
What is a JWT?
A JWT (JSON Web Token) is a common format for access tokens. It is three sections of text joined by dots: header.payload.signature. The header and payload are just base64url-encoded JSON – which is why JWTs usually start with eyJ, the encoding of {" – so anyone holding the token can read them. The payload contains claims: who the token was issued to and by (iss, tid, upn), which service it is for (aud, its audience), what it allows (scp scopes or roles), and when it expires (exp).
The signature is what stops anyone changing those claims: it is created with the provider’s private key, and email servers check it before accepting the token. Decoding a token lets you read it, but not edit it or prove it is genuine – and because a JWT is not encrypted, anyone who has a copy can use it until it expires, just like a password.
Not every access token is a JWT. Microsoft 365 work and school accounts use JWTs, but Outlook.com / Hotmail and Google access tokens are opaque – random-looking strings that only the provider can read. That’s normal, and this tool tells you when it sees one.
What makes a token work for email?
Microsoft 365 and Outlook.com: the token’s audience (aud) must be https://outlook.office.com (or https://outlook.office365.com), with delegated scopes such as IMAP.AccessAsUser.All, POP.AccessAsUser.All or SMTP.Send – or, for app-only access, the roles IMAP.AccessAsApp, POP.AccessAsApp or SMTP.SendAsApp. Tokens issued for Microsoft Graph are rejected with AUTHENTICATE failed.
Gmail and Google Workspace: the token needs the https://mail.google.com/ scope. Google access tokens are not JWTs, so they can’t be decoded – but their scopes and expiry can be checked with Google’s tokeninfo endpoint.
XOAUTH2 is the sign-in method email servers use for OAuth: the base64 encoding of user=email^Aauth=Bearer token^A^A, where ^A is the byte 0x01.
Rather not deal with OAuth tokens at all?
Auth-Email handles OAuth sign-in, token refresh and consent for you, so your app, script or device can connect to Microsoft 365, Outlook and Gmail over IMAP, POP, and SMTP with a simple username and password.
Frequently asked questions
What is a JWT?
A JWT (JSON Web Token) is a common format for OAuth access tokens: three base64url-encoded sections (header.payload.signature) separated by dots. The payload lists claims such as the token’s audience (aud), scopes (scp), and expiry (exp) – anyone can decode and read these, but only the provider can create a valid signature, so they cannot be changed. Microsoft 365 work and school access tokens are JWTs; Outlook.com and Google access tokens are opaque strings that cannot be decoded.
Is it safe to paste my access token here?
The decoder runs entirely in your browser – your token is never sent to our servers. Access tokens are short-lived, but you should still treat them like passwords and avoid sharing them.
Why does Microsoft say AUTHENTICATE failed when my token is valid?
The most common reason is that the token was issued for the wrong resource. Tokens for IMAP, POP, and SMTP must have the audience https://outlook.office.com (or https://outlook.office365.com) and scopes such as IMAP.AccessAsUser.All, POP.AccessAsUser.All or SMTP.Send. Tokens for Microsoft Graph (audience https://graph.microsoft.com) are rejected.
Why can’t a Google token be decoded?
Google access tokens (starting ya29.) are opaque – they are not JWTs, so their contents cannot be read locally. Google ID tokens are JWTs and can be decoded.