JsonWebTokenError: jwt malformed is what Node's jsonwebtoken library throws server-side, typically from jwt.verify() or jwt.decode(), when the string it's given isn't three base64url-encoded segments joined by two dots. A valid JWT always has exactly that shape, header.payload.signature:
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U └──────header──────┘ └──────payload──────┘ └──────────signature──────────┘
The usual causes
- The token got truncated. It was copied from a terminal that wrapped or clipped a long line, logged with a length limit, or stored in a field or env var too short for the full string.
- Something extra is attached to it: a leading
Bearerthat didn't get stripped before decoding, quotes from a config file, or trailing whitespace or a newline from a.envfile. - It isn't a JWT. An API key, a session cookie value, or an opaque OAuth access token can all look like a random string and get mistaken for one.
What this tool tells you that the error message doesn't
This decoder never verifies a signature. It has no secret or public key to check against, so it can't reproduce the exact "jwt malformed" you get from a verify call. It splits the string on . and tells you if there's no payload segment at all, or if a segment doesn't decode to valid JSON after base64url-decoding. So pasting the token in shows you which of the three segments is broken, where the library error only tells you that one of them is.
Strip "Bearer " before decoding
A token taken from an Authorization header usually looks like Authorization: Bearer <token>. Decoding the whole header value, Bearer prefix included, is a common way to end up with an invalid first character before the token even starts. Strip everything up to and including the space first.