JWT Invalid JSON Payload – Fix Decoded Claim JSON

Local only

Separate Base64URL decoding success from a JSON syntax failure inside the JWT claims payload.

69 chars · 1 line

Needs attention

Invalid JWT payload

JWT payload JSON error

How to fix malformed JSON in a JWT payload

A payload can use perfectly valid Base64URL encoding yet decode to malformed claim text. A trailing comma, missing quote, or broken delimiter makes JSON parsing fail before the decoder can inspect claims such as sub, exp, iss, or aud. This tool is free to use. No account or payment is required.

Last updated

What you can do here

  • Browser-local JWT decoding
  • Strict three-segment validation
  • Canonical Base64URL checks
  • Header and payload JSON validation
  • Expiration status details
  • No signature verification claims

Steps

  1. Decode only the second JWT segment as Base64URL UTF-8 text.
  2. Run the decoded text through a strict JSON parser and locate syntax errors such as a trailing comma, unmatched quote, or missing delimiter.
  3. Fix claim serialization in the issuer and mint a new signed token; do not repair the payload text inside an already signed compact JWT.

A trailing comma fails before any JWT claim can be read

The example below decodes to {"sub":"123",}. The Base64URL layer succeeds, but JSON.parse rejects the comma before the closing brace, so the decoder never reaches exp, iss, aud, or other claim-specific handling.

After syntax is fixed, the top level must still be a JSON object. The decoder also rejects non-finite numbers and unsafe integers rather than silently displaying misleading claim values.

Payload contains a trailing comma

The second segment decodes successfully, but the trailing comma makes the claim object invalid JSON.

Decoded payload

{"sub":"123",}

Corrected claim object

{"sub":"123"}

Common questions

Frequently asked questions

Why does valid Base64URL still produce Invalid JWT payload?

Base64URL only transports bytes. After decoding, the payload text must independently parse as JSON and produce an object before claims can be inspected.

Can I remove the trailing comma directly from a production token?

Not safely. Editing the payload changes the signed bytes, so the issuer should serialize valid JSON and issue a new token.

Will syntactically valid claims be trusted automatically?

No. Parsing claims is separate from verifying the signature and enforcing issuer, audience, expiration, or authorization policy.

Recommended next steps

JWT Invalid Base64URL PayloadFix a JWT payload segment that is not canonical Base64URL.JWT Expired TokenDecode an exp claim and understand the decoder's Expired status.JWT Decoder OnlineDecode JWT header and payload data locally in the browser.

Debugging a specific JWT issue? Browse JWT troubleshooting.