Regex to Match JWT Tokens

This regex matches JSON Web Tokens in their compact serialization format. Here is the token-by-token breakdown:

eyJ — Matches the literal characters eyJ which is the Base64url encoding of the opening characters of a JSON object {" that begins the JWT header. Every standard JWT header starts with these three characters because it is a JSON object beginning with a curly brace and a quote.

[A-Za-z0-9_-]* — Matches zero or more Base64url characters for the remainder of the header. The Base64url alphabet uses letters, digits, hyphens, and underscores (replacing the + and / of standard Base64).

. — Matches the literal dot separator between the header and payload sections. The dot is escaped because it is a regex metacharacter.

eyJ — Again matches eyJ for the payload section, which also begins as a JSON object with an opening brace and quote.

[A-Za-z0-9_-]* — Matches the remaining Base64url characters of the payload.

. — Matches the second literal dot separator between the payload and signature.

[A-Za-z0-9_-]+ — Matches one or more Base64url characters for the cryptographic signature. The signature is required (one or more characters) as a JWT without a signature is incomplete.

The g flag enables global matching. This pattern is useful for detecting JWTs in logs, configuration files, HTTP headers, and source code. It leverages the fact that JWT headers and payloads always start with eyJ to reduce false positives. This is commonly used in security auditing to find exposed tokens.