{"record":{"id":"eaae1d95cd0e4f9b","repo":"jwtk/jjwt","slug":"invalid-base64url-name-value","errorCode":null,"errorMessage":"Invalid Base64Url <name>: <value>","messagePattern":"Invalid Base64Url <name>: <value>","errorType":"exception","errorClass":"MalformedJwtException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java","lineNumber":889,"sourceCode":"    @Override\n    public Jwe<byte[]> parseEncryptedContent(CharSequence compact) throws JwtException {\n        return parse(compact).accept(Jwe.CONTENT);\n    }\n\n    @Override\n    public Jwe<Claims> parseEncryptedClaims(CharSequence compact) throws JwtException {\n        return parse(compact).accept(Jwe.CLAIMS);\n    }\n\n    protected byte[] decode(CharSequence base64UrlEncoded, String name) {\n        try {\n            InputStream decoding = this.decoder.decode(Streams.of(Strings.utf8(base64UrlEncoded)));\n            return Streams.bytes(decoding, \"Unable to Base64Url-decode input.\");\n        } catch (Throwable t) {\n            // Don't disclose potentially-sensitive information per https://github.com/jwtk/jjwt/issues/824:\n            String value = \"payload\".equals(name) ? RedactedConfidentialValue.REDACTED_VALUE : base64UrlEncoded.toString();\n            String msg = \"Invalid Base64Url \" + name + \": \" + value;\n            throw new MalformedJwtException(msg, t);\n        }\n    }\n\n    protected Map<String, ?> deserialize(InputStream in, final String name) {\n        try {\n            Reader reader = Streams.reader(in);\n            JsonObjectDeserializer deserializer = new JsonObjectDeserializer(this.deserializer, name);\n            return deserializer.apply(reader);\n        } finally {\n            Objects.nullSafeClose(in);\n        }\n    }\n}\n","sourceCodeStart":871,"sourceCodeEnd":903,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java#L871-L903","documentation":"Thrown as MalformedJwtException when a JWT segment (header, payload, etc.) cannot be Base64Url-decoded during parsing. The cause is attached, but for the 'payload' segment the value in the message is redacted to avoid leaking sensitive token contents (per jjwt issue #824).","triggerScenarios":"Calling parse/parseSignedClaims/parseSignedClaimsJws/parseContentClaim on a string that is not valid compact JWT serialization: corrupted token, URL-unsafe Base64 ('+' or '/' instead of '-' and '_'), truncated or padded segments, copying only part of the token.","commonSituations":"Token truncated by logging/truncating code, extra whitespace or newlines pasted in, hand-rolled encoder producing standard Base64 instead of Base64Url, tokens passed through systems that mangle characters (e.g. HTML decoding '+').","solutions":["Regenerate/retransmit the full, unmodified JWT string — do not trim or transform it.","Ensure producers use Base64Url encoding (JJWT's builder does this automatically).","Trim whitespace/newlines from the token before parsing.","Decode the token manually (base64url) to inspect which segment is corrupt.","Check for upstream systems rewriting the token (proxies, HTML escaping, log truncation)."],"exampleFix":"// before\nString jwt = receivedToken.trim().substring(0, 100); // truncated -> MalformedJwtException\nJwts.parser().verifyWith(key).build().parse(jwt);\n// after\nString jwt = receivedToken.trim();\nif (!jwt.chars().allMatch(c -> Character.isLetterOrDigit(c) || c == '.' || c == '-' || c == '_')) {\n    throw new IllegalArgumentException(\"Token contains invalid Base64Url characters\");\n}\nJwts.parser().verifyWith(key).build().parse(jwt);","handlingStrategy":"try-catch","validationCode":"String t = jwt == null ? \"\" : jwt.trim();\nboolean shapeOk = t.chars().filter(c -> c == '.').count() >= 2\n    && t.chars().allMatch(c -> Character.isLetterOrDigit(c) || c == '.' || c == '-' || c == '_');\nif (!shapeOk) throw new IllegalArgumentException(\"Malformed JWT string\");","typeGuard":null,"tryCatchPattern":"try {\n    claims = Jwts.parser().verifyWith(key).build().parseSignedClaims(jwt.trim()).getPayload();\n} catch (io.jsonwebtoken.MalformedJwtException e) {\n    // reject token; do not log the raw token (payload is redacted in the message)\n}","preventionTips":["Never truncate, wrap, or transform JWT strings in logs or storage","Trim whitespace before parsing","Always use Base64Url (not standard Base64) when hand-assembling tokens","Watch for intermediaries (proxies, HTML escaping) that mangle '+'/'=' characters"],"tags":["jwt","base64url","malformed-token","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}