Regex library
Regular expression for JWTs
Match the compact JWT shape: two or three Base64URL segments. Decoding still happens in the JWT tool, not here.
^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$
Runs 100% in your browser. Nothing you paste is uploaded, stored, or sent to a server.
Highlighted matches
How to use
- Scan the pre-filled pattern and the sample. Hits are highlighted; misses stay plain.
- Toggle flags if you need global or case-insensitive matching. The pattern is JavaScript / ECMAScript.
- Paste your own corpus. Nothing is sent to a server.
- Read the notes below before you drop the pattern into production — several of these are intentionally incomplete.
Before you decode a token, you may want to know if a string even looks like a JWT. This pattern checks for Base64URL segments separated by dots. The signature segment may be empty so unsecured tokens still match — and then you should reject them in policy.
A match is not a valid session. Plug the string into the JWT decoder to read claims, and verify on a server.
What this pattern will not do
Does not inspect JSON inside the segments.
Encrypted JWE tokens with five segments will not match, on purpose.
FAQ
Why allow an empty signature?
The compact form of an alg=none token is header.payload. with a trailing dot. Matching it lets you detect it, not accept it.
Should I log strings that match this?
No. A JWT is a credential. Redact it.
Is the sample text uploaded?
No. The tester compiles the pattern with the browser’s RegExp engine and stays on the device.