# Regex for JSON Web Tokens (JWT)

> JWT regex that checks the header.payload.signature shape of a JSON Web Token in Base64URL. What it can and can't tell you, explained token by token.

```
/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/
```

A compact JWT is three Base64URL segments joined by dots: header, payload and signature. This pattern checks exactly that shape. It allows an empty signature, which unsigned tokens (alg: none) have — and which your server should reject unless you truly mean to accept them.

## Token by token

| Token | Meaning |
|---|---|
| `^[A-Za-z0-9_-]+` | the header: one or more Base64URL characters |
| `\.` | a dot |
| `[A-Za-z0-9_-]+` | the payload |
| `\.` | a dot |
| `[A-Za-z0-9_-]*$` | the signature — empty for unsigned tokens — then end of string |

## Examples

- ✓ matches: `eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.abc123_-`
- ✓ matches: `eyJhbGciOiJub25lIn0.eyJzdWIiOiIxIn0.`
- ✗ does not match: `eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ`
- ✗ does not match: `Bearer eyJhbGciOiJIUzI1NiJ9.e30.sig`
- ✗ does not match: `a.b.c.d`
- ✗ does not match: `abc+/.def.ghi`

## Variations

- `^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$` — require a signature (rejects alg: none tokens)
- `^Bearer [A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$` — a complete Authorization header value

## FAQ

### Does matching this regex mean the token is valid?

No. It only checks the shape. A valid token has a signature verified with the right key and acceptable claims such as exp, nbf, iss and aud — use a JWT library for that.

### How can I see what's inside a JWT?

The header and payload are Base64URL-encoded JSON, so any JWT decoder can read them. Anyone holding the token can too, so never put secrets in a JWT payload.

## Related patterns

- [Regex for Base64 Strings](https://www.devkult.com/regex/base64.md)
- [Regex for UUID Validation](https://www.devkult.com/regex/uuid.md)
- [Regex for URL Validation](https://www.devkult.com/regex/url.md)

Open the interactive page: https://www.devkult.com/regex/jwt