JWT Format Validation
Validates that a string has the three-part Base64URL structure of a JSON Web Token.
/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/How it works
A JWT consists of three Base64URL-encoded parts separated by dots: header.payload.signature. This pattern validates the structural format only, it does not verify the signature or decode the claims. Use a JWT library for cryptographic verification.
Test Cases
Should Match
- eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyMSJ9.abc123
- header.payload.signature
Should NOT Match
- not.a.jwt.with.too.many.parts
- onlytwoparts.here
- has spaces.in.it
Quick Summary
Validates the three-part Base64URL structure of a JWT (header.payload.signature). Does not verify the signature or decode claims, use a JWT library like jose or jsonwebtoken for cryptographic verification.
Key Takeaways
- JWT structure: three Base64URL segments separated by dots
- Base64URL uses A-Z, a-z, 0-9, -, and _ (not + and / like standard Base64)
- The signature segment can be empty for unsecured JWTs (alg: none), the trailing dot is still required
- This regex only validates format, never trust a JWT without verifying its signature
When to use it
- Quick format check before attempting to decode a JWT
- Validating Authorization header values in middleware
- Detecting JWT-shaped strings in log files or request bodies
Common Mistakes
- Using this as a security check, format validation does not verify the signature
- Forgetting that JWTs use Base64URL (- and _) not standard Base64 (+ and /)
- Logging JWT values, they may contain sensitive claims
JWT Format Validation, Frequently Asked
How do I verify a JWT signature?
Use a library: jsonwebtoken (Node.js), jose (universal), or PyJWT (Python). Pass the secret or public key to verify().
What is the difference between JWT and JWS?
A JWT is a claim set. A JWS (JSON Web Signature) is a signed JWT. Most JWTs you encounter are JWS tokens.