Authentication & Security · In-Browser Regular Expression Lab

JWT Regex — Validate Base64URL Encoded Header, Payload & Signature

Validates standard 3-part JSON Web Tokens (Header.Payload.Signature) in Base64URL encoding.

Pattern:

Regular Expression Pattern & Flags

Flags:

//none

Live Test String

Match Found

Load Sample:

Match Inspection & Details1 match

Match #1:eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Test Samples Verification Matrix

Expected Valid Samples (Should Match)

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c Pass

Expected Invalid Samples (Must Reject)

invalid.jwt Rejected (Pass)

header.payload Rejected (Pass)

a.b.c.d Rejected (Pass)

Code Implementation Generator

// JavaScript / TypeScript (ES6+)
const pattern = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
const text = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";

const isMatch = pattern.test(text);
console.log("Is Match:", isMatch);

if (isMatch) {
  const matches = text.match(pattern);
  console.log("Matches:", matches);
}

Regular Expression Token Breakdown

Checks three dot-separated Base64URL character sequences corresponding to JWT structure. Each component of the regular expression serves a distinct syntactical purpose as mapped below:

Token Pattern	Name / Component	Function & Rule
^[A-Za-z0-9_-]+	Header	Base64URL encoded JSON header.
\.	Dot separator	Separator between header and payload.
[A-Za-z0-9_-]+	Payload	Base64URL encoded JSON claims.
\.	Dot separator	Separator between payload and signature.
[A-Za-z0-9_-]+$	Signature	Cryptographic HMAC or RSA signature.