{"record":{"id":"5089d6962d150775","repo":"jwtk/jjwt","slug":"invalid-compact-jwt-string-compact-jwss-must-cont","errorCode":null,"errorMessage":"Invalid compact JWT string: Compact JWSs must contain exactly 2 period characters, and compact JWEs must contain exactly 4.  Found: ${delimiterCount}","messagePattern":"Invalid compact JWT string: Compact JWSs must contain exactly 2 period characters, and compact JWEs must contain exactly 4\\.  Found: (.+?)","errorType":"validation","errorClass":"io.jsonwebtoken.MalformedJwtException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/JwtTokenizer.java","lineNumber":102,"sourceCode":"                            body = Strings.EMPTY; //clear out value set for JWS\n                            iv = token;\n                            break;\n                        case 3:\n                            body = token;\n                            break;\n                    }\n\n                    delimiterCount++;\n                    sb.setLength(0);\n                } else {\n                    sb.append(c);\n                }\n            }\n        }\n\n        if (delimiterCount != 2 && delimiterCount != 4) {\n            String msg = DELIM_ERR_MSG_PREFIX + delimiterCount;\n            throw new MalformedJwtException(msg);\n        }\n\n        if (sb.length() > 0) {\n            digest = sb.toString();\n        }\n\n        if (delimiterCount == 2) {\n            return (T) new DefaultTokenizedJwt(protectedHeader, body, digest);\n        }\n\n        return (T) new DefaultTokenizedJwe(protectedHeader, body, digest, encryptedKey, iv);\n    }\n}\n","sourceCodeStart":84,"sourceCodeEnd":116,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/JwtTokenizer.java#L84-L116","documentation":"A compact JWS must contain exactly 2 period delimiters and a compact JWE exactly 4. After tokenizing, JwtTokenizer counts the delimiters and throws MalformedJwtException if the count is neither 2 nor 4, meaning the string is not a structurally valid compact JWT at all.","triggerScenarios":"Passing a truncated, concatenated, corrupted, or completely non-JWT string to parse/parseClaimsJws/parseEncryptedJws — e.g. an empty fragment, a token with a period added/removed, or a base64 blob that isn't a JWT.","commonSituations":"String truncation from fixed-size storage columns or log capture; sending the wrong token type (opaque session id) to a JWT parser; tokens mangled by URL encoding/decoding; clients sending 'null' or 'undefined' literal strings.","solutions":["Verify the token source: count '.' occurrences (2 for JWS, 4 for JWE) before parsing","Log/inspect the raw incoming token to find where it gets truncated or mangled","Distinguish token types in the client and route JWEs to parseEncryptedJws and JWSs to parseClaimsJws","Catch MalformedJwtException and reject with 'malformed token' instead of surfacing a 500"],"exampleFix":"// before\nString token = req.getHeader(\"Authorization\").substring(7);\nparser.parseClaimsJws(token); // token truncated\n// after\nString token = req.getHeader(\"Authorization\").substring(7);\nlong dots = token.chars().filter(c -> c == '.').count();\nif (dots != 2 && dots != 4) throw new MalformedJwtException(\"bad token shape\");\nparser.parseClaimsJws(token);","handlingStrategy":"validation","validationCode":"long dots = token == null ? -1 : token.chars().filter(c -> c == '.').count();\nif (dots != 2 && dots != 4) throw new MalformedJwtException(\"Not a compact JWT: \" + dots + \" dots\");","typeGuard":null,"tryCatchPattern":"try {\n    Jws<Claims> jws = parser.parseClaimsJws(token);\n} catch (MalformedJwtException e) {\n    respond(400, \"Token is not a valid compact JWT\");\n}","preventionTips":["Validate token shape (2 or 4 periods) at the API boundary before parsing","Avoid fixed-length storage columns that can truncate tokens","Check for URL-encoding mangling ('%3D', '+'/space swaps) in transit","Ensure clients send JWTs, not opaque session ids, to JWT parsers"],"tags":["jwt","malformed-token","structure"],"backgroundTag":"invalid-argument-format","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}