fjordtools

fjordtools / Errors / jwt: invalid signature

JsonWebTokenError: invalid signature

The verifier recomputed the signature with its key and got a different value from the one in the token. Either the key is not the one that signed it, the algorithm differs, or the token was altered or cut. A decoder cannot check this: it only shows what the token claims.

Fjordtools team · Seen in the jsonwebtoken library for Node.js · Published · 1 min read

Common causes

  1. The wrong key or secret

    A token signed with one secret fails against another, for example a staging secret in production, or a rotated key. The decoder cannot tell you which, because it does not have the key.

  2. The algorithm does not match

    Read the alg in the token's header and compare it with what your verifier expects. An HS256 token verified with an RSA public key, or the other way round, always fails.

    Input

    eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

    JWT Decoder says

    alg = HS256

  3. The token was changed on the way

    Extra characters break the signature or the parsing. Most decoders, including this one, strip a leading Bearer and quotes, but a verifier usually wants the bare token.

    Input

    Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

    JWT Decoder says

    Decodes (the tool strips the Bearer prefix)

How to fix it

  1. Decode the token and read alg and kid in the header.
  2. Check that the verifier uses the same key, in the same form (a secret as text or as Base64, a public key in PEM).
  3. Pass only the token: no Bearer prefix, quotes or line breaks.
  4. Look for a key rotation: a kid that your key set does not contain.

Related errors

More error explainers are coming

See all errors.