Regex for JSON Web Tokens (JWT)
A compact JWT is three Base64URL segments joined by dots: header, payload and signature. This pattern checks exactly that shape. It allows an empty signature, which unsigned tokens (alg: none) have — and which your server should reject unless you truly mean to accept them.
/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/How it works, token by token
| Token | Meaning |
|---|---|
| ^[A-Za-z0-9_-]+ | the header: one or more Base64URL characters |
| \. | a dot |
| [A-Za-z0-9_-]+ | the payload |
| \. | a dot |
| [A-Za-z0-9_-]*$ | the signature — empty for unsigned tokens — then end of string |
What it matches
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.abc123_-eyJhbGciOiJub25lIn0.eyJzdWIiOiIxIn0.eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQBearer eyJhbGciOiJIUzI1NiJ9.e30.siga.b.c.dabc+/.def.ghiTry it live
One candidate per line — the m flag makes the ^ and $ anchors apply to each line. Edit anything; it runs in your browser.
Variations
^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$require a signature (rejects alg: none tokens)^Bearer [A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$a complete Authorization header valueFrequently asked questions
Does matching this regex mean the token is valid?
No. It only checks the shape. A valid token has a signature verified with the right key and acceptable claims such as exp, nbf, iss and aud — use a JWT library for that.
How can I see what's inside a JWT?
The header and payload are Base64URL-encoded JSON, so any JWT decoder can read them. Anyone holding the token can too, so never put secrets in a JWT payload.
Building something custom? The regex tester gives you live match highlighting for any pattern.