"jwt malformed" / "Not enough segments" Error, Explained

This error fires before a JWT library even looks at the signature or claims — it means the string you handed it isn't shaped like a JWT at all.

What triggers it

A JWT is exactly three base64url segments joined by dots: header.payload.signature. Libraries typically split on . and check the count before doing anything else. You'll see this error (worded differently depending on the library — jwt malformed, Not enough or too many segments, invalid token specified) when:

• The token got truncated — a copy-paste that missed the last few characters, or a database column too short to hold the full string.
• You passed something that isn't a JWT at all: an API key, a session cookie value, or the whole Authorization: Bearer <token> header including the Bearer prefix.
• The token has extra whitespace or a trailing newline from being read out of a file or environment variable.
• It's actually a JWE (encrypted JWT) — those have five segments, not three, and a JWS-only library will reject them as malformed.

How to check it quickly

Paste the raw string into the JWT Decoder. If it's genuinely malformed, you'll see exactly that — a segment-count or base64 decode failure — before any signature check runs, which tells you the problem is in how the token was captured or stored, not in your verification logic.

Related Tools