---
id: "jwt"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["secrets"]
langs: ["common"]
quality: 78
url: "http://registry.apicrafter.io/datatype/jwt"
---

# JSON Web Token (JWT) (`jwt`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

Compact JSON Web Token (RFC 7519) signed with JWS: three Base64url parts (header, claims and signature) separated by dots. The header and the claims are JSON objects, so both parts start with ey. Used as bearer access tokens and ID tokens; the encrypted JWE form has five parts and is not covered.

- Personal data (PII): no
- Categories: Secrets and credentials (passwords, keys, tokens) (secrets)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier

## Detection

Regular expression (Python `re`):

```
^ey[A-Za-z0-9_-]+\.ey[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$
```

## Examples

- `eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk` — Example JWT from RFC 7519, section 3.1
- `eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9` (invalid example) — Header part alone

## Supported by tools

- `amazonmacie`
- `detectsecrets`
- `gitleaks`
- `nightfall`
- `semgrep`
- `trufflehog`

## Sources

- doc: <https://www.rfc-editor.org/rfc/rfc7519>
- wikipedia: <https://en.wikipedia.org/wiki/JSON_Web_Token>
- other: <https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml>

## Quality

Score 78/100. Missing: second example, mapping (Wikidata, Schema.org, ...), translation.

JSON: <http://registry.apicrafter.io/api/v1/datatypes/jwt.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/secrets/jwt.yaml>