diff --git a/package-lock.json b/package-lock.json
index ab98507..2fa3ed0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,6 +11,7 @@
         "axios": "^1.11.0",
         "exceljs": "^4.4.0",
         "file-saver": "^2.0.5",
+        "jose": "^6.1.3",
         "js-cookie": "^3.0.5",
         "next": "^16.0.7",
         "react": "19.1.0",
@@ -1874,6 +1875,15 @@
       "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
       "license": "MIT"
     },
+    "node_modules/jose": {
+      "version": "6.1.3",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-6.1.3.tgz",
+      "integrity": "sha512-0TpaTfihd4QMNwrz/ob2Bp7X04yuxJkjRGi4aKmOqwhov54i6u79oCv7T+C7lo70MKH6BesI3vscD1yb/yzKXQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
     "node_modules/js-cookie": {
       "version": "3.0.5",
       "resolved": "https://registry.npmjs.org/js-cookie/-/js-cookie-3.0.5.tgz",
diff --git a/package.json b/package.json
index 2a499df..e15f0d6 100644
--- a/package.json
+++ b/package.json
@@ -12,6 +12,7 @@
     "axios": "^1.11.0",
     "exceljs": "^4.4.0",
     "file-saver": "^2.0.5",
+    "jose": "^6.1.3",
     "js-cookie": "^3.0.5",
     "next": "^16.0.7",
     "react": "19.1.0",
diff --git a/proxy.ts b/proxy.ts
index 2a03e65..bc76c6e 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -1,25 +1,64 @@
 import { NextResponse } from "next/server";
 import type { NextRequest } from "next/server";
+import { jwtVerify } from "jose";
 
-export function proxy(request: NextRequest) {
+if (!process.env.JWT_SECRET) {
+  console.error("coloca el JWT_SECRET en el .env")
+}
+
+const secret = new TextEncoder().encode(process.env.JWT_SECRET);
+
+export async function proxy(request: NextRequest) {
   const token = request.cookies.get("token")?.value;
   const pathname = request.nextUrl.pathname;
 
+  if (!token && pathname != "/") {
+    return NextResponse.redirect(new URL("/", request.url));
+  }
+
   if (pathname === "/" && token) {
     return NextResponse.redirect(new URL("/Impresiones", request.url));
   }
 
-  if (!token && pathname != "/") {
-    console.log("No hay token, redirigiendo a login");
-    return NextResponse.redirect(new URL("/", request.url));
+  if (token) {
+    try {
+      const { payload } = await jwtVerify(token, secret);
+
+      const role = payload.role as number;
+
+      const onlyImpresiones = ["/Impresiones"];
+
+      const limitedRoutes = [
+        "/Inscripcion",
+        "/Alta",
+        "/AgregarTiempo",
+        "/Impresiones",
+        "/AsignacionMesas",
+        "/AsignacionEquipo",
+        "/Monitor",
+      ];
+
+      if (role === 5 && !onlyImpresiones.includes(pathname)) {
+        return NextResponse.redirect(new URL("/Impresiones", request.url));
+      }
+
+      if ((role === 2 || role === 3) && !limitedRoutes.includes(pathname)) {
+        return NextResponse.redirect(new URL("/Impresiones", request.url));
+      }
+
+    } catch (error) {
+      if (pathname != "/") {
+        return NextResponse.redirect(new URL("/", request.url));
+      }
+    }
   }
 
   return NextResponse.next();
 }
 
 export const config = {
-  matcher: [   
-    "/", 
+  matcher: [
+    "/",
     "/Reportes",
     "/Monitor",
     "/QuitarSancion",
@@ -37,5 +76,4 @@ export const config = {
     "/AgregarTiempo",
     "/ActivosMantenimiento",
   ],
-};
-//IO
\ No newline at end of file
+};
\ No newline at end of file