What does jwt malformed mean?

It usually means the value is not a valid three-part JWT. Remove prefixes, spaces, quotes, or line breaks and make sure you are passing the raw token string.

How do I fix invalid signature for a JWT?

Check the JWT header algorithm, then verify with the exact secret or public key used by the issuer. Invalid signature often comes from using the wrong key, wrong algorithm, or missing environment variable.

Troubleshooting guide

JWT Error Decoder

Match common JWT error messages to the exact validation step that failed, then fix malformed, expired, invalid-signature, issuer, and audience problems without guessing.

Decode a JWT Check JWT claims

Common JWT errors and fixes

Use the exact error text from your library, API gateway, or auth middleware, then work through the checks in order.

jwt malformed

The token does not have the expected three-part JWT structure.

Fix: Pass only the raw JWT string to your verifier or decoder.

Confirm the token has exactly two dots: header.payload.signature.
Remove Bearer prefixes, quotes, extra spaces, or line breaks before decoding.
Make sure you are not passing an opaque session token instead of a JWT.

invalid signature

The token was signed with a different secret, private key, or algorithm than your verifier expects.

Fix: Verify with the expected algorithm and key pair for the token issuer.

Compare the alg value in the JWT header with your configured algorithm.
Use the correct HS256 secret or RS256/ES256 public key for the issuer.
Check that environment variables are loaded in the runtime that verifies the token.

jwt expired

The exp claim is in the past, so the token should no longer be accepted.

Fix: Refresh the access token or ask the user to sign in again.

Decode exp and compare it with the current Unix timestamp.
Check server clock drift if tokens expire immediately after issue.
Confirm your refresh-token flow requests a new access token before expiry.

jwt not active

The nbf claim says the token is not valid yet.

Fix: Wait until nbf is reached or allow a small, intentional clock-skew window.

Decode nbf and compare it with the server time.
Look for clock skew between your issuer and API servers.
Avoid issuing tokens with future not-before values unless you need delayed validity.

invalid audience

The aud claim does not match the API or application that received the token.

Fix: Request a token for the correct audience and enforce that audience server-side.

Decode aud and compare it with the expected API identifier.
Do not reuse tokens issued for one service against another service.
Check OAuth or Auth0 audience settings when access tokens are issued.

invalid issuer

The iss claim does not match the authority your API trusts.

Fix: Configure the verifier with the trusted issuer that actually issued the token.

Decode iss and compare the exact URL or identifier, including trailing slash behavior.
Make sure development, staging, and production issuers are not mixed.
For multi-tenant systems, resolve trusted issuers before verification.

Debugging flow

1Paste the token into the JWT decoder and confirm it is structurally valid.
2Read the header alg and kid values before choosing a verification key.
3Check exp, nbf, iss, aud, and sub claims against your server expectations.
4Verify the signature server-side with the expected algorithm and key.
5Refresh or reissue the token only after you know which validation check failed.

FAQ

Can a JWT decode but still be invalid?

Yes. Decoding only reads the header and payload. A token can decode cleanly and still fail signature, expiration, audience, issuer, or authorization checks.

Why does my token work locally but fail in production?

Common causes include different environment variables, a different issuer URL, missing public keys, clock drift, or a production API expecting a different audience value.