devpack
EnglishDeutsch · StartseiteFrançais · AccueilEspañol · InicioPortuguês (Brasil) · Início
Site Audit

Regex for JSON Web Token (JWT)

Use /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/ to check that a whole string is a valid for JSON Web Token (JWT). Every example below is tested against the pattern, and you can open it in the Regex Tester with the samples preloaded.

Updated 

/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/
Open in Regex Tester
InputResult
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.sig_abc-123✓ Match
eyJhbGciOiJub25lIn0.eyJzdWIiOiIxIn0.✓ Match
abc.def✗ No match
a b.c.d✗ No match
eyJ.abc.def.ghi✗ No match

How the pattern works

PartMeaning
[A-Za-z0-9_-]+The header, base64url-encoded
\.A dot
[A-Za-z0-9_-]+The payload
[A-Za-z0-9_-]*$The signature (empty for unsigned tokens)

Code examples

JavaScript

const re = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/;
re.test(value); // true or false

Python

import re

bool(re.fullmatch(r'[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*', value))

PHP

preg_match('/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/', $value) === 1;

Notes and limitations

Matching the shape tells you nothing about whether a token is valid — always verify the signature on the server. Inspect a token with the JWT Decoder.

Regex TesterType a pattern and watch matches highlight live in your test text.
Open the tool

Frequently asked questions

What is the regex for JSON Web Token (JWT)?
/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/ — it matches the whole string. See the table above for what each part does.
Which examples match?
Of the examples tested, these match: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.sig_abc-123, eyJhbGciOiJub25lIn0.eyJzdWIiOiIxIn0.. The others don’t.
How do I test this regex?
Click “Open in Regex Tester” — the pattern, flags and sample text load automatically, and matches highlight as you edit.