JsonWebTokenError: jwt malformed is what Node's jsonwebtoken library throws server-side, typically from jwt.verify() or jwt.decode(), when the string it's given isn't three base64url-encoded segments joined by two dots. A valid JWT always has exactly that shape — header.payload.signature:
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U └──────header──────┘ └──────payload──────┘ └──────────signature──────────┘
The usual causes
- The token got truncated somewhere — copy-pasted from a terminal that wrapped or clipped a long line, logged with a length limit, or stored in a field/env var that's too short for the full string.
- It's wrapped in something extra — a leading
Bearerthat didn't get stripped before decoding, surrounding quotes from a config file, or trailing whitespace/a newline from a.envfile. - It isn't a JWT at all — an API key, a session cookie value, or an opaque OAuth access token can all look like a random string and get mistaken for a JWT.
What this tool tells you that the error message doesn't
This decoder never verifies a signature — it has no secret or public key to check against, so it can't reproduce "jwt malformed" from a verify call exactly. What it does instead: it splits the string on . and tells you specifically if there's no payload segment at all, or if a segment that exists doesn't decode to valid JSON once you base64url-decode it. That's the actual diagnostic step behind the generic error — pasting the token in shows you which of the three segments is the problem, rather than just confirming that one of them is.
Strip "Bearer " before decoding
If the token came from an Authorization header, it's usually formatted as Authorization: Bearer <token>. Decoding the whole header value including the Bearer prefix is a common way to end up with an extra, invalid first character before the real token even starts — strip everything up to and including the space first.