★ Dev formats · regex

Regex for JWT

A JSON Web Token in compact form: header, payload and signature separated by dots, each base64url-encoded. Headers start with eyJ because they encode '{"'. The signature can be empty for unsigned tokens.

Runs in your browser
No signup

Try the jwt pattern

Read it in plain English (best-effort)

^start of a line
eyJthe text 'eyJ'
[A-Za-z0-9_-]one character from: A–Z, a–z, 0–9, '_', '-'
*zero or more of the previous
.the character '.'
[A-Za-z0-9_-]one character from: A–Z, a–z, 0–9, '_', '-'
+one or more of the previous
.the character '.'
[A-Za-z0-9_-]one character from: A–Z, a–z, 0–9, '_', '-'
*zero or more of the previous
$end of a line

Test text

One sample per line works well with the m flag on anchored patterns.

Waiting for a pattern

The pattern, piece by piece

/^eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/

Pattern explanation
Part	What it does
`^eyJ`	header: base64url of '{"'
`[A-Za-z0-9_-]*`	rest of the header (base64url alphabet)
`\.[A-Za-z0-9_-]+`	the payload
`\.[A-Za-z0-9_-]*`	the signature, which may be empty

What it accepts and rejects

Every sample below is checked automatically in JavaScript and Python. The tester above is preloaded with all of them, one per line.

Should match
Should match
`eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c`	✓
`eyJhbGciOiJub25lIn0.eyJzdWIiOiJhIn0.`	✓
`eyJ0eXAiOiJKV1QifQ.eyJhIjoxfQ.abc_def-123`	✓
`eyJhbGciOiJFUzI1NiJ9.e30.sig`	✓
`eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjF9.Zm9v`	✓
`eyJraWQiOiIxIn0.eyJpc3MiOiJ4In0.c2ln`	✓

Should not match
Should not match
`abc.def.ghi`	✗
`eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0`	✗
`eyJhbGciOiJIUzI1NiJ9..sig`	✗
`eyJhbG ciOiJ9.eyJ.sig`	✗
`eyJ+/=.e30.sig`	✗
`Bearer eyJhbGciOiJIUzI1NiJ9.e30.sig`	✗

Copy it into your code

RE2-safeNo lookarounds or backreferences, so the same pattern works in Go's RE2 engine and in Rust's regex crate.

Language

const jwtRe = /^eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/;

export function isValidJwt(value) {
  return jwtRe.test(value.trim());
}

When not to use regex for this

A token that matches is not a valid token. Verify the signature, algorithm, expiry, issuer and audience with a JWT library (jose, PyJWT, golang-jwt). Never accept alg 'none' in production.

Questions engineers actually ask

Can I trust a JWT that matches this pattern?

No. Anyone can produce this shape. Only signature verification with your key proves who issued it.

Why must it start with eyJ?

The header is JSON starting with {" and the base64url encoding of those characters is always eyJ.

What is catastrophic backtracking?

Some patterns, usually nested quantifiers like (a+)+, make a backtracking engine try an exponential number of paths on input that almost matches. The tester stops any run after 300ms, so a bad pattern can't freeze your tab. In production, that same pattern can take down a server (a ReDoS attack).