JSON Web Tokens (JWT) Error Triage & Fixes
Diagnose and remediate JSON Web Tokens (JWT) exceptions with validated copy-paste fixes and interactive tool sandboxes.
TokenExpiredError: jwt expired
The current Unix timestamp exceeds the numeric value defined in the JWT exp (expiration) claim. Token verification libraries strictly reject expired credentials to prevent replay attacks.
JsonWebTokenError: invalid signature / algorithm mismatch
The cryptographic signature in the third segment of the JWT does not match the computed hash of the header and payload using the provided verification key. This commonly happens when symmetric HS256 secrets are mistakenly used against asymmetric RS256 public keys.
JsonWebTokenError: jwt malformed
The provided string cannot be split into three period-separated Base64URL segments (header.payload.signature). This frequently happens when "Bearer " prefix is included in the verification call or undefined is passed.