Regex Reference Library
Copy tested regular expressions, review matching examples, and understand the tradeoffs before using them in forms, scripts, and data cleanup.
Validation
10 pagesEmail Address Validation
/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/Matches common email addresses for practical form validation.URL Validation/https?:\/\/[A-Za-z0-9.-]+\.[A-Za-z]{2,}(?:\/[^\s]*)?/Matches HTTP and HTTPS URLs with host, path, query, or fragment.IPv4 Address/^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/Matches dotted IPv4 addresses from 0.0.0.0 to 255.255.255.255.ISO Date YYYY-MM-DD/^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$/Matches date strings shaped like YYYY-MM-DD.Credit Card Number Shape/^(?:\d[ -]*?){13,19}$/Matches common credit card number formatting before Luhn validation.US Phone Number/^\+?1?[-.\s]?(?:\(?\d{3}\)?[-.\s]?)\d{3}[-.\s]?\d{4}$/Matches common US phone number formats.US ZIP Code/^\d{5}(?:-\d{4})?$/Matches 5 digit and ZIP+4 postal codes.Username/^[a-zA-Z][a-zA-Z0-9_-]{2,31}$/Matches usernames that start with a letter and allow letters, digits, underscore, or dash.Strong Password/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{12,}$/Requires lowercase, uppercase, digit, symbol, and 12 or more characters.Hex Color Code/^#?(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/Matches three or six digit CSS HEX color values.Extraction
10 pagesHTML Tag
/<\/?[a-zA-Z][^>]*>/Extracts HTML-like opening or closing tags from text.JSON Field Name/"([A-Za-z_][A-Za-z0-9_]*)"\s*:/Extracts object field names from JSON-like text.CSV Row/^(?:"(?:[^"]|"")*"|[^,\r\n]*)(?:,(?:"(?:[^"]|"")*"|[^,\r\n]*))*$/Matches a single CSV row with quoted cells.Domain Name/(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}/Extracts domain names from text.Email Domain/@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/Extracts the domain part after @ in an email address.URL Query String/[?&]([^=&#]+)=([^&#]*)/Extracts URL query parameter key-value pairs.Markdown Link/\[([^\]]+)\]\(([^)]+)\)/Extracts Markdown link text and target.Number/[-+]?\d*\.?\d+(?:[eE][-+]?\d+)?/Extracts integer, decimal, and scientific notation numbers.Chinese Characters/[\u4e00-\u9fff]+/Extracts common CJK Unified Ideograph Chinese characters.UUID v4/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/Matches lowercase RFC 4122 version 4 UUID strings.Replacement
10 pagesCollapse Extra Whitespace
/\s+/Finds runs of whitespace for replacement with a single space.HTML Entity/&(?:[a-zA-Z]+|#\d+|#x[0-9a-fA-F]+);/Matches named and numeric HTML entities.Regex Special Characters/[.\*+?^${}()|\[\]\\]/Matches characters that need escaping in many regex contexts.Snake Case/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/Matches lower snake_case identifiers.Camel Case/^[a-z][a-zA-Z0-9]*$/Matches lower camelCase identifiers.Line Breaks/\r\n|\r|\n/Finds Windows, old Mac, and Unix line endings.JavaScript Comments//\*[\s\S]*?\*/|//.*/Matches block and line comments in JavaScript-like text.SQL Comments/--.*$|/\*[\s\S]*?\*//Matches SQL line and block comments.XML Comments/<!--[\s\S]*?-->/Matches XML and HTML comments.Word Start For Title Case/\b[a-z]/Finds lowercase letters at word starts for capitalization.Security
5 pagesSQL Injection Signal
/(union\s+select|or\s+1=1|--|;\s*drop)/Detects common SQL injection-like strings for triage, not blocking.XSS Signal/<\s*script|javascript:|onerror\s*=|onload\s*=/Detects common XSS-like substrings for triage.Path Traversal/(\.\.\/|\.\.\\|%2e%2e%2f)/Detects common path traversal sequences.Phone Redaction/(\+?\d[\d .-]{7,}\d)/Finds phone-like strings for redaction workflows.ID-like Number Redaction/\b\d{6,20}\b/Finds long numeric identifiers that may need redaction.Developer
15 pagesIPv6 Address
/(?:[0-9a-fA-F]{1,4}:){2,7}[0-9a-fA-F]{1,4}|::1/Matches many common IPv6 textual addresses.MAC Address/^(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}$/Matches colon or dash separated MAC addresses.Base64 String/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/Matches standard Base64 encoded text shape.JWT Token Shape/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/Matches three-part JWT token shape.Semantic Version/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/Matches SemVer versions with optional pre-release and build metadata.Docker Image Tag/^[a-z0-9]+(?:[._/-][a-z0-9]+)*:[\w][\w.-]{0,127}$/Matches common Docker image references with a tag.Git Commit Hash/^[0-9a-f]{7,40}$/Matches short or full lowercase Git commit hashes.MongoDB ObjectId/^[0-9a-fA-F]{24}$/Matches MongoDB ObjectId hex strings.Data URI/^data:[\w/+.-]+;base64,[A-Za-z0-9+/=]+$/Matches common base64 data URI values.SSH Public Key/^ssh-(?:rsa|ed25519)\s+[A-Za-z0-9+/=]+(?:\s+.*)?$/Matches ssh-rsa and ssh-ed25519 public key lines.JSONP Callback/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/Matches JavaScript identifier paths often used as JSONP callbacks.CSS Color Value/^(?:#[0-9a-fA-F]{3,8}|rgba?\([^)]*\)|hsla?\([^)]*\)|[a-zA-Z]+)$/Matches common CSS color value formats.Stack Trace Line/^\s*at\s+.+\(.+:\d+:\d+\)$/Matches common JavaScript stack trace lines.Cron Expression Shape/^\S+\s+\S+\s+\S+\s+\S+\s+\S+$/Matches five-field cron expression shape.Markdown Image/!\[([^\]]*)\]\(([^)]+)\)/Matches Markdown image syntax.