AG
JWT
DECODER
Decoder
Algorithms
Claims
Guides
About
한국어
English
日本語
中文
Español
Português
Français
Deutsch
Русский
العربية
Bahasa Indonesia
Decoder
/
Guides
/
Common JWT errors and fixes
Guide
Common JWT errors and fixes
The errors you meet most often when working with JWT, with their causes and fixes.
invalid signature: the signature doesn't match — wrong key or a tampered header.payload. Check the verification key and algorithm.
token expired: the exp time has passed — get a new token or renew it with a refresh token.
malformed token: not three dot-separated parts or broken base64url — strip whitespace, quotes and any 'Bearer ' prefix.
algorithm mismatch: the alg differs from expected (e.g. none, or HS vs RS) — pin the allowed algorithms and reject none.
Try decoding a token yourself
Just paste and the header, payload and claims unfold instantly.
Open the decoder
Related
What is a JWT
A JWT (JSON Web Token) is a small, signed JSON token format for securely passing information between parties.
The three-part JWT structure
Every JWT consists of header.payload.signature, and each part is base64url encoded.
JWT security checklist
A short checklist of the key principles for using JWT safely.
JWT vs session authentication
The difference between token (JWT) auth and server session (cookie) auth, and when to use each.
Access tokens and refresh tokens
The role of the short-lived access token and the refresh token that renews it.