Back to all patterns
JWT Three-Segment Structure
Security
Validates the three-segment base64url shape of a JWT, header.payload.signature.
/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/How it works
JWTs are three base64url-encoded segments joined by dots. This pattern verifies the shape only, not the signature. Note that base64url uses - and _ instead of + and /, with no padding.
Test Cases
Should Match
- eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.s5lkfj_aA
- eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6MX0.abc-DEF_123
Should NOT Match
- not.a.jwt.has.too.many.parts
- onlyonepart
- two.parts
Quick Summary
Confirms a string has the header.payload.signature shape of a JWT. Does NOT verify the signature.
Key Takeaways
Key Takeaways
- Three segments separated by dots; each segment is base64url
- Base64url uses A-Z a-z 0-9 - _ (no + / =), that's why this regex uses [A-Za-z0-9_-]
- Shape validation only, always verify the signature with a JWT library
Watch out
Common Mistakes
- Using this in place of cryptographic verification, shape match guarantees nothing about authenticity
- Forgetting that JWT signatures may be empty when alg=none, a known attack vector to reject server-side