Format and Convert JSON, Decode JWTs and Base64 Safely

To format or validate JSON, paste it into the JSON Formatter & Validator: valid JSON is beautified (or minified) instantly, and invalid JSON gets a plain-English error with the exact line and column. To read a JWT, paste it into the JWT Decoder, which decodes and can verify the token inside your browser. Neither tool sends what you paste to a server, which matters when the data contains customer records, API keys or login tokens.

Why does it say my JSON is invalid?

JSON is stricter than the JavaScript it came from. These are the mistakes behind most errors, with the message the formatter shows:

• A trailing comma after the last item: "Trailing comma before }" (or before ]).
• Single quotes around strings: "Strings must use double quotes (") in JSON".
• Unquoted keys such as {name: "Asha"}: "Expected a "quoted" property name".
• Comments (// or /* */): JSON doesn't allow them, so the / is reported as unexpected.
• A missing bracket or brace: "Unexpected end of input — something is not closed".
• A raw line break inside a string: write it as \n instead.

The line with the error is highlighted in the line-number gutter, so you can go straight to it.

How do I format and validate JSON, step by step?

1. Open the JSON Formatter. Paste JSON into the left box, click Open file to load a .json file, or Load sample to try it.
2. Under Mode, choose Beautify for readable output or Minify for the smallest single line.
3. For Beautify, set Indent to 2 spaces, 4 spaces or Tab.
4. Tick Sort keys A–Z if you want keys in a predictable order, for example to compare two API responses. Only the key order inside objects changes; array order and values stay the same.
5. Leave Show tree view ticked to explore the result as collapsible branches. The tree is skipped for documents over 2 MB.
6. Click Copy or Download under the output.

In up-to-date browsers the formatter also keeps very large numbers exactly as written. A database ID like 12345678901234567890 is beyond what a JavaScript number can hold, and many formatters silently round it; this one leaves the digits alone.

How do I convert JSON to CSV for Excel?

JSON to CSV turns an array of objects into rows and columns. Nested objects become dot-path columns, and every key found in any record becomes a column, so records with missing fields still line up.

A worked example. This input:

[{"id":1,"name":"Asha Rao","address":{"city":"Pune","pin":"411001"},"tags":["new","vip"]},{"id":2,"name":"Ben Ortiz","address":{"city":"Austin","pin":"73301"},"tags":["returning"]}]

gives the columns id, name, address.city, address.pin, tags.0 and tags.1, with tags.1 empty for Ben. Switch Arrays from One column per item to Join with "; " and you get a single tags column holding new; vip.

You can also set the Delimiter (Comma, Semicolon, Tab or Pipe) and Header row. If the JSON is wrapped, like {"data": [...]}, the tool finds the first array of objects inside it. A preview table shows the first 50 rows.

If Excel opens the file with everything in one column, your Excel expects semicolons. Choose Semicolon and download again.

To go the other way, CSV to JSON rebuilds nested objects from dot-path headers. Its Detect numbers & booleans option keeps values like PIN codes or phone numbers with leading zeros as text, so 007 doesn't turn into 7.

How do I convert YAML or XML to JSON?

YAML to JSON handles Kubernetes manifests, CI pipelines and Compose files. A file with several documents separated by --- becomes a JSON array. It uses a safe loader: custom tags such as !!js/function are refused rather than run. Files whose anchors and aliases would expand past 2,000,000 values are rejected instead of freezing the tab.

One YAML gotcha: an unquoted value with a leading zero, such as code: 0755, comes out as the number 755. Quote such values in the YAML (code: "0755") to keep them as text. Words like yes, no and on stay as strings. JSON to YAML goes the other way.

For XML, JSON to XML needs a single root element, so if your JSON has several top-level keys or is an array, it is wrapped in the name you give under Root element (if needed). Keys starting with the Attribute key prefix (@_ by default) become attributes. Keys that can't be XML names, such as ones with spaces, are reported so you can rename them. XML to JSON converts back.

Why shouldn't I paste a JWT into any online decoder?

A JSON Web Token is usually a bearer credential: whoever holds a valid, unexpired token can typically use it exactly as you would. If a decoder website sends what you paste to its server, your live session token may end up in its logs or analytics, and you have no way to know.

Two more points people often miss:

• The payload isn't encrypted. It's only Base64URL-encoded, so anyone with the token can read the email, user ID and roles inside it.
• Decoding proves nothing. Anyone can create a token with any payload. Only the signature, checked with the right key, shows who issued it.

How do I decode and verify a JWT safely?

1. Open the JWT Decoder and paste the token. A leading "Bearer " is fine.
2. Read the Header and Payload as formatted JSON. The Claims list explains standard fields and shows exp, iat and nbf as dates, marked "expired", "still valid" or "not yet valid".
3. To verify an HS256, HS384 or HS512 token, enter the Secret (tick Secret is Base64-encoded if it is) and click Verify signature.
4. For RS, PS and ES tokens, paste the public key in PEM ("BEGIN PUBLIC KEY") or JWK form instead.

Verification uses your browser's built-in WebCrypto, so the secret or key stays on your device. Try Load sample (secret: easyconvert): its payload decodes to a sub of 1234567890, a name of Asha Rao, an iat of 1761900000 (31 October 2025, 08:40 UTC) and an exp of 4102444800 (1 January 2100). A token with "alg: none" is flagged as unsigned, and encrypted JWE tokens (five parts) can't be decoded without the key.

Even so, prefer test or expired tokens. If a production token or secret has been pasted somewhere you don't trust, revoke or rotate it.

What is Base64, and is it secure?

Base64 writes any bytes using 64 safe characters. Every 3 bytes become 4 characters, so encoded data is about a third larger: the text Hi becomes SGk=. It's an encoding, not encryption; anyone can decode it.

Base64 Encoder & Decoder handles text as UTF-8, so Hindi and emoji round-trip correctly. Tick URL-safe (- _ and no padding) for the variant used in JWTs and URLs. Set Input type to File to encode any file. With Direction set to Decode, the File mode turns Base64 (or a data URI) back into a file with Decode & download file; common types such as PNG, JPEG and PDF are recognised and given the right extension.

Troubleshooting

• "Decoded … bytes, but they aren't UTF-8 text": the Base64 holds a file, not text. Switch Input type to File.
• "A JWT has 3 parts separated by dots": part of the token is missing, often cut off when copying from a log.
• "Invalid signature": the token was altered, or you used the wrong secret or key.

Quick answers

Is it safe to paste JSON into an online formatter?

It depends on where the processing happens. EasyConvert's JSON Formatter runs entirely in your browser, so nothing you paste is uploaded. Many other online formatters send your input to a server.

How do I decode a JWT without sending it to a server?

Paste it into EasyConvert's JWT Decoder. The header and payload are decoded in your browser, and signature checks use the browser's WebCrypto, so the token and any secret stay on your device.

Is Base64 encryption?

No. Base64 is a reversible encoding that anyone can decode, and it makes data about 33% larger. Use real encryption to protect sensitive data.

How do I convert nested JSON to CSV?

Use JSON to CSV. Nested objects become dot-path columns such as address.city, and arrays become numbered columns or a single joined column.