JWT Token
Match JSON Web Tokens (JWTs) — three base64url-encoded segments separated by dots.
Try it in RegexPro →Available in
JavaScript / ECMAScript code
const re = new RegExp("eyJ[A-Za-z0-9_\\-]+\\.eyJ[A-Za-z0-9_\\-]+\\.[A-Za-z0-9_\\-]+", "g");
const input = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.abc123-_";
const matches = [...input.matchAll(re)];
console.log(matches.map(m => m[0]));Uses `String.prototype.matchAll` for global iteration (Node 12+ / all modern browsers).
Python (re) code
import re
pattern = re.compile(r"eyJ[A-Za-z0-9_\-]+\.eyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+")
input_text = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.abc123-_"
for m in pattern.finditer(input_text):
print(m.group(0))Stdlib `re` module — no third-party dependency. Works on Python 3.6+.
Go (RE2) code
package main
import (
"fmt"
"regexp"
)
func main() {
re := regexp.MustCompile(`eyJ[A-Za-z0-9_\-]+\.eyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+`)
input := `eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.abc123-_`
for _, match := range re.FindAllString(input, -1) {
fmt.Println(match)
}
}Uses `regexp.MustCompile` (panics on bad patterns at startup) and `FindAllString` for all matches.
Pattern
eyJ[A-Za-z0-9_\-]+\.eyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+ (flags: g)Raw source: eyJ[A-Za-z0-9_\-]+\.eyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+
How it works
Examples
Input
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.abc123-_Matches
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.abc123-_
Input
Bearer token-hereNo match
—Common use cases
- •Detecting JWTs in log files for redaction
- •Extracting tokens from Authorization headers
- •Secret scanning in source code
- •Request tracing and debugging
Related patterns
GitHub Personal Access Token
SecurityMatch GitHub Personal Access Tokens (classic + fine-grained) and OAuth tokens by their `ghX_` prefix.
Bearer Token (Authorization Header)
SecurityMatch Bearer token values from HTTP Authorization headers, capturing the raw token string.
Generic API Key
SecurityMatch generic long alphanumeric tokens (32+ chars) typical of API keys and access tokens.
PEM Certificate Block
SecurityMatch PEM-encoded certificate and key blocks, capturing the block type and base64 content.