JWT Invalid JSON Header – Fix Decoded Header JSON

Local only

Distinguish a valid Base64URL segment from a decoded value that cannot serve as a JWT header object.

44 chars · 1 line

Needs attention

Invalid JWT header

JWT header JSON error

How to fix a JWT header that is not a JSON object

A JWT header can decode from Base64URL into syntactically valid JSON and still be unusable when the top level is an array, null, string, or number. This decoder requires an object because JOSE header parameters such as alg, typ, and kid are represented as named object members. This tool is free to use. No account or payment is required.

Last updated

What you can do here

  • Browser-local JWT decoding
  • Strict three-segment validation
  • Canonical Base64URL checks
  • Header and payload JSON validation
  • Expiration status details
  • No signature verification claims

Steps

  1. Decode only the first JWT segment as Base64URL UTF-8 text.
  2. Parse the decoded value and confirm the top level is an object with named members rather than an array, scalar, or null.
  3. Correct header generation at the issuer and issue a fresh signed token instead of editing the compact token by hand.

A JSON array is valid JSON but not a JWT header object

The example below decodes to ["HS256"]. JSON.parse can read that value, but there is no alg member for the decoder to inspect because array positions are not JWT header parameter names.

Malformed JSON can also fail here, but an object-shape failure is different: decoding and JSON syntax both succeed before the decoder rejects the top-level value.

Header decodes to a JSON array

The first segment is valid Base64URL and valid JSON, but the decoded array cannot represent named JWT header parameters.

Decoded header

["HS256"]

Expected header object

{"alg":"HS256","typ":"JWT"}

Common questions

Frequently asked questions

Can a JWT header be a JSON array?

No for this decoder. JWT header parameters are read from a JSON object whose member names identify parameters such as alg, typ, or kid.

Why can valid JSON still produce Invalid JWT header?

JSON validity only proves the text has legal JSON syntax. The decoder separately requires the parsed top-level value to be a non-null object and rejects arrays and scalar values.

Does fixing the header object verify the token?

No. A parseable header only exposes metadata such as alg; signature, issuer, audience, and authorization checks still belong to a trusted JWT verifier.

Recommended next steps

JWT Invalid Base64URL HeaderFix a JWT header segment that is not canonical Base64URL.JWT Signature Not VerifiedUnderstand why decoding JWT claims does not authenticate the token.JWT Decoder OnlineDecode JWT header and payload data locally in the browser.

Debugging a specific JWT issue? Browse JWT troubleshooting.