How browsers word it
| Node (jsonwebtoken) | JsonWebTokenError: jwt malformed |
|---|---|
| Python (PyJWT) | jwt.exceptions.DecodeError: Not enough segments |
| Java (jjwt) | MalformedJwtException: JWT strings must contain exactly 2 period characters |
Common causes
The value is the text undefined
A missing header, cookie or storage key gives undefined, and that is passed on as the token.
Input
undefined
JWT Decoder says
A token has three parts separated by dots, this has 1.
The signature part was cut off
A token that was shortened by a log, a form field or a copy and paste has only two parts.
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0
JWT Decoder says
A token has three parts separated by dots, this has 2.
The Bearer prefix is still on the token
The Authorization header holds Bearer followed by a space and the token. Libraries expect only the token. This tool removes the prefix for you, so it decodes, but your server code may not.
Input
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
JWT Decoder says
Decodes (the tool strips the Bearer prefix)
How to fix it
- Log the exact string you pass to verify, and count the dots: a JWT has two.
- Remove the Bearer prefix, quotes and line breaks before you verify the token.
- Check that the header, cookie or storage key really exists before you read it.
- Paste the token into the JWT decoder to see how many parts it has.