Code Beautifier
Invalid token: expected 3 parts

Fix JWT "Invalid token: expected 3 parts"

A JWT is header.payload.signature — three Base64URL segments joined by dots. What you pasted has another shape: a bare payload, a Bearer prefix, or a JWE.

Input that triggers it

Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0
Open JWT Decoder on its own page
Sensitive tool. Nothing you enter here is saved or shared: no drafts, history, or links. Everything runs in this browser tab.

Local workspace

Named projects in IndexedDB · Local only — never synced to our servers. Worksp…

Open manager
Inputtext
json

What the error means

A JSON Web Token in compact form is three Base64URL-encoded segments separated by dots: the header, the payload, and the signature. The decoder splits the input on . before it does anything else, and Invalid token: expected 3 parts means the split did not produce exactly three pieces. It is a shape check, so it fires before any decoding and before any expiry or signature consideration.

The example fails twice over. It carries the Bearer prefix from an Authorization header, so the first segment is not Base64URL, and it has only two dot-separated parts because the signature was cut off.

Why it happens

  • The Bearer prefix was copied along with the token from a request header or a curl command.
  • The signature is missing, usually because a copy stopped at a line wrap or a log truncated the value. Two parts is the typical result.
  • Surrounding quotes or JSON: pasting "token": "eyJ..." or the whole response body instead of the value.
  • It is a JWE, not a JWS. Encrypted tokens have five parts: header, encrypted key, IV, ciphertext, tag. They start with eyJ too, which is why they get pasted here.
  • It is not a JWT at all: an opaque session ID, an API key, or a PASETO token (which uses v4.local. prefixes and no dots in the same places).

How to fix it

  1. Paste only the token: remove Bearer , the quotes, and any leading token=.
  2. Count the dots. Two dots means a JWT; four means a JWE, which JWE Decoder inspects. Fewer than two means the token was truncated at the source — copy it again from the original response, not from a log line.
  3. Remove line breaks. Tokens are often wrapped in emails and tickets; a JWT never contains whitespace.
  4. Decode. The header shows alg and typ, which confirms what you have.

The example, corrected, is the two segments shown plus a signature:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.<signature>

If it still fails

  • A token that ends in a dot (eyJ...eyJ...) with nothing after it is an unsecured JWT with alg: none — three parts, empty signature. The decoder accepts it, and a verifying server must reject it.
  • Nothing pasted into this tool is saved or shared: it runs in sensitive mode, with no drafts, no history, and no share links, so a production token is safe to inspect here.
  • To produce a well-formed token for testing, JWT Generator signs a payload with a secret you provide and never stores.

Related errors