JWT Invalid Base64URL Payload – Fix Payload Encoding

Local only

Check the encoding of the second JWT segment before examining claims.

54 chars · 1 line

Needs attention

Invalid JWT payload

JWT payload encoding error

How to fix an invalid Base64URL JWT payload

The second compact JWT segment must use canonical Base64URL text. Invalid alphabet characters, whitespace, bad lengths, or non-canonical bits stop the decoder before it can parse claims such as sub, iat, or exp. This tool is free to use. No account or payment is required.

Last updated

What you can do here

  • Browser-local JWT decoding
  • Strict three-segment validation
  • Canonical Base64URL checks
  • Header and payload JSON validation
  • Expiration status details
  • No signature verification claims

Steps

  1. Inspect the second segment between the first and second dots.
  2. Confirm it uses only the JWT Base64URL alphabet and canonical encoding.
  3. Retrieve or regenerate the token at its issuer instead of editing the signed payload by hand.

Payload corruption prevents claim inspection

Until the payload bytes decode cleanly, claim-level troubleshooting such as expiration, subject, issuer, or audience cannot begin. Encoding and JSON are separate validation layers.

Invalid JWT payload alphabet example

The dollar sign makes the payload segment invalid Base64URL.

Invalid second segment

bad$

Typical valid second segment

eyJzdWIiOiIxMjMifQ

Common questions

Frequently asked questions

Can I replace + and / manually to make Base64URL?

That may change or misunderstand the original bytes. For a signed token, regenerate it correctly at the source rather than repairing production credentials by hand.

Does payload decoding verify claims?

No. Decoding only reveals claim data. Trust requires signature and policy validation.

Why does padding matter?

JWT commonly omits Base64URL padding, and this decoder enforces canonical segment encoding rather than accepting multiple textual representations.

Recommended next steps

JWT Invalid JSON PayloadFix a Base64URL payload whose decoded text is not a JSON object.JWT Invalid Base64URL HeaderFix a JWT header segment that is not canonical Base64URL.Base64 Encoder & Decoder OnlineInspect standard and URL-safe Base64 text separately.

Debugging a specific JWT issue? Browse JWT troubleshooting.