diff --git a/src/validator.py b/src/validator.py
index 1a3afdd..d5d1dfe 100644
--- a/src/validator.py
+++ b/src/validator.py
@@ -1,18 +1,32 @@
 from argon2 import PasswordHasher
+import re
 
-def is_valid_platform(platform):
+def is_valid_platform(platform) -> bool:
 	if platform not in ["ios","android","web"]:
 		return False
 	return True
 
-def is_valid_token(token): #Later check for specific Firebase tokens
+def is_valid_token(token: str) -> bool:
 	"""
-	Correct length
-	No malicious characters
-	Freshness?
+	Validate a push notification token.
+
+	Criteria:
+	- Must be a string
+	- Correct length (e.g., 140–200 chars)
+	- Only safe characters (alphanumeric, dash, underscore)
 	"""
+	if not isinstance(token, str):
+		return False
+
+	if not (140 <= len(token) <= 200):
+		return False
+
+	if not re.match(r'^[A-Za-z0-9\-_]+$', token):
+		return False
+
 	return True
 
+
 ph = PasswordHasher()
 
 def hash_api_key(api_key: str) -> str: