JWT Invalid Base64URL Header – Fix Header Encoding

Local only

Check the encoding of the first JWT segment before investigating its JSON fields.

36 chars · 1 line

Needs attention

Invalid JWT header

JWT header encoding error

How to fix an invalid Base64URL JWT header

JWT header bytes are encoded with the URL-safe Base64 alphabet. Characters outside that alphabet, invalid lengths, whitespace, padding, or non-canonical trailing bits cause this decoder to reject the header before JSON parsing. This tool is free to use. No account or payment is required.

Last updated

What you can do here

  • Browser-local JWT decoding
  • Strict three-segment validation
  • Canonical Base64URL checks
  • Header and payload JSON validation
  • Expiration status details
  • No signature verification claims

Steps

  1. Inspect only the first segment before the first dot.
  2. Remove accidental whitespace, standard Base64 characters, or copied padding only by regenerating the token correctly at its source.
  3. Decode again and then validate the resulting header JSON object.

JWT uses Base64URL rather than ordinary Base64 text

The compact token alphabet uses URL-safe characters and normally omits padding. This decoder additionally checks canonical encoding so alternate bit representations are not silently accepted.

Invalid JWT header alphabet example

The dollar sign is not part of the Base64URL alphabet.

Invalid first segment

bad$

Typical valid first segment

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9

Common questions

Frequently asked questions

Why can standard Base64 text fail in a JWT?

JWT compact segments use Base64URL conventions. The alphabets and padding expectations are not identical.

Does a valid Base64URL header guarantee valid JSON?

No. The decoded bytes must also be valid UTF-8 JSON representing an object.

Should I manually re-encode a production token?

Usually no. Get a correctly issued token, because changing encoded segments changes the bytes covered by its signature.

Recommended next steps

JWT Invalid JSON HeaderFix a Base64URL header whose decoded text is not a JSON object.JWT Invalid Base64URL PayloadFix a JWT payload segment that is not canonical Base64URL.Base64 Encoder & Decoder OnlineInspect standard and URL-safe Base64 text separately.

Debugging a specific JWT issue? Browse JWT troubleshooting.