★ Patterns that are actually tested
Regex Library & Tester
29 battle-tested patterns, from email and UUID to PAN, GSTIN and UPI IDs, plus a tester that explains your regex in plain English and won't freeze your tab on a bad one.
- Runs in your browser
- No signup
Test any regex
Read it in plain English (best-effort)
- [\w.+-]one character from: word character (letter, digit or _), '.', '+', '-'
- +one or more of the previous
- @the character '@'
- [\w-]one character from: word character (letter, digit or _), '-'
- +one or more of the previous
- (?:start a group (not captured)
- .the character '.'
- [\w-]one character from: word character (letter, digit or _), '-'
- +one or more of the previous
- )end of group
- +one or more of the previous
One sample per line works well with the m flag on anchored patterns.
Waiting for a pattern
01
Pattern library
Every pattern below has its own page with should-match and shouldn't-match samples, a token-by-token explanation, code in JavaScript, Python, Go and Java, and a note on when not to use regex at all. Each one passes all its samples in both JavaScript and Python.
Web
URLs, domains, emails and markup- Email AddressPragmatic email check: catches typos without rejecting real addresses.^[A-Za-z0-9_%+-]+(?:\.[A-Za-z0-9_%+-]+)*@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*\.[A-Za-z]{2,}$
- URLhttp(s) URLs with a real domain, optional port, path, query and fragment.^https?:\/\/(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}(?::\d{1,5})?(?:[\/?#]\S*)?$
- Domain NameHostnames like example.com or sub.example.co.uk, including punycode.^(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}$
- URL SlugLowercase kebab-case slugs like my-first-post.^[a-z0-9]+(?:-[a-z0-9]+)*$
- IPv4 AddressDotted-quad IPv4 with each octet 0–255 and no leading zeros.^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$
- IPv6 AddressFull and compressed (::) IPv6 addresses.^(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?::[0-9A-Fa-f]{1,4}){1,6}|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))$
- Hex ColorCSS hex colours: #rgb, #rgba, #rrggbb and #rrggbbaa.^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$
- HTML TagFinds opening, closing and self-closing tags in a string. Not a parser.<\/?([A-Za-z][A-Za-z0-9-]*)\b[^<>]*>
Identity & contact
Phones, postcodes, usernames, cards- US Phone NumberNANP numbers in common formats, capturing area code, exchange and line.^(?:\+?1[ .-]?)?\(?([2-9][0-9]{2})\)?[ .-]?([2-9][0-9]{2})[ .-]?([0-9]{4})$
- E.164 Phone NumberInternational numbers in E.164: +, country code, up to 15 digits.^\+[1-9][0-9]{6,14}$
- US ZIP CodeFive-digit ZIP codes with an optional ZIP+4 suffix.^[0-9]{5}(?:-[0-9]{4})?$
- Username3–16 characters, starts with a letter, letters, digits and underscores only.^[a-zA-Z][a-zA-Z0-9_]{2,15}$
- Strong Password12+ characters with lowercase, uppercase, a digit and a symbol.^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{12,}$
- Credit Card Number Format16-digit cards in groups of four, and 15-digit Amex in 4-6-5. Format only.^(?:(?:\d{4}[ -]?){3}\d{4}|3[47]\d{2}[ -]?\d{6}[ -]?\d{5})$
Dev formats
UUIDs, dates, versions, tokens- UUIDRFC 9562 UUIDs, versions 1–8, with the standard variant bits.^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
- ISO 8601 DateYYYY-MM-DD dates with valid month and day ranges. Format only.^\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$
- 24-hour TimeHH:MM or HH:MM:SS in 24-hour format, 00:00 to 23:59:59.^(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d)?$
- Semantic VersionThe official semver.org pattern, with pre-release and build metadata.^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$
- JWTThree base64url segments starting with eyJ. Shape only, never trust it.^eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$
- Base64Standard padded base64: groups of four with = or == padding.^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$
- MAC AddressColon, hyphen or Cisco dot notation, without mixing separators.^(?:(?:[0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}|(?:[0-9A-Fa-f]{2}-){5}[0-9A-Fa-f]{2}|(?:[0-9A-Fa-f]{4}\.){2}[0-9A-Fa-f]{4})$
India
PAN, GSTIN, IFSC, UPI and more- Indian Mobile Number10-digit Indian mobiles starting 6–9, with optional +91, 91 or 0.^(?:\+91[ -]?|91[ -]?|0)?[6-9]\d{4}[ -]?\d{5}$
- Indian PIN CodeSix-digit PIN codes not starting with 0, optionally written as 3 + 3.^[1-9][0-9]{2} ?[0-9]{3}$
- PAN Card Number10-character PAN: 5 letters, 4 digits, 1 letter, with a valid holder-type letter.^[A-Z]{3}[ABCFGHJLPT][A-Z][0-9]{4}[A-Z]$
- GSTIN15-character GST number: state code, PAN, entity number, Z, check character.^(?:0[1-9]|[12][0-9]|3[0-8]|97)[A-Z]{3}[ABCFGHJLPT][A-Z][0-9]{4}[A-Z][1-9A-Z]Z[0-9A-Z]$
- Aadhaar Number Format12 digits not starting with 0 or 1, in 4-4-4 groups. Format only.^[2-9][0-9]{3}[ -]?[0-9]{4}[ -]?[0-9]{4}$
- IFSC Code11 characters: 4-letter bank code, a zero, 6-character branch code.^[A-Z]{4}0[A-Z0-9]{6}$
- Indian Vehicle NumberState registrations like MH 12 AB 1234 and Bharat-series like 22 BH 1234 AA.^(?:(?:AN|AP|AR|AS|BR|CG|CH|DD|DL|DN|GA|GJ|HP|HR|JH|JK|KA|KL|LA|LD|MH|ML|MN|MP|MZ|NL|OD|OR|PB|PY|RJ|SK|TN|TR|TS|UK|UP|WB)[ -]?[0-9]{1,2}[A-Z]?[ -]?[A-Z]{0,3}[ -]?[0-9]{4}|[0-9]{2}[ -]?BH[ -]?[0-9]{4}[ -]?[A-Z]{1,2})$
- UPI ID (VPA)username@handle virtual payment addresses like name@okaxis.^[a-zA-Z0-9][a-zA-Z0-9._-]{1,255}@[a-zA-Z][a-zA-Z0-9]{1,63}$
02
Regex cheat sheet
| Syntax | Means |
|---|---|
^ $ | Start and end of the string (or line, with the m flag) |
. | Any character except a newline (any character with the s flag) |
\d \w \s | A digit, a word character, whitespace |
\D \W \S | The opposite of each |
[abc] [a-z] | One character from a set or range |
[^abc] | One character NOT in the set |
* + ? | Zero or more, one or more, optional |
{3} {2,5} {2,} | Exactly 3, between 2 and 5, 2 or more |
*? +? | Lazy: match as few as possible |
(…) | Capture group |
(?:…) | Group without capturing |
(?<name>…) | Named capture group |
a|b | a or b |
(?=…) (?!…) | Lookahead: followed by / not followed by (not in Go's RE2) |
\b | Word boundary |
\1 | Backreference to group 1 (not in Go's RE2) |
03
Why a bad regex can take down a server
JavaScript, Python, Java and most other languages use backtracking engines. Give one a pattern with nested quantifiers like (a+)+$ and an input that almost matches, and it tries every way to split the input before giving up. That's exponential: 30 characters can take seconds, 40 can take hours. Attackers use this to freeze servers. It's called ReDoS.
This tester runs your pattern in a separate worker and kills it after 300ms. In production, avoid nested quantifiers, cap input length before matching, or use a linear-time engine like Go's RE2 or Rust's regex crate, which can't backtrack at all.
04
Questions engineers actually ask
Is my test text sent anywhere?
No. The tester runs entirely in your browser, inside a Web Worker. Nothing you type leaves the page.
Which regex flavour does the tester use?
JavaScript's. Each library page also gives Python, Go and Java versions and flags where Go's RE2 engine needs a different approach, because RE2 has no lookarounds or backreferences.
What is catastrophic backtracking?
Some patterns, usually nested quantifiers like (a+)+, make a backtracking engine try an exponential number of paths on input that almost matches. The tester stops any run after 300ms, so a bad pattern can't freeze your tab. In production, that same pattern can take down a server (a ReDoS attack).
Are these patterns safe to use in production?
They're tested against the sample inputs on each page in JavaScript and Python, and they avoid nested quantifiers. Format checks are still only format checks: each page says what to verify another way.
Should I validate with regex on the client or the server?
Both. Client-side regex gives instant feedback; the server must re-validate, because anyone can bypass the browser.
05
More from the workbench
09 · Dev utilitiesJSON to TypesPaste JSON, get TypeScript, Zod, Pydantic, Go, Rust, JSON Schema, Prisma or GraphQL.10 · Dev utilitiesCron Expression BuilderBuild or explain a cron expression, with the next run times and platform quirks.07 · AI & LLMsToken CounterToken counts per model, cost per call and how much of the context window you are using.
Fine print
Tools: on the house.
Engineer: by the hour.
The regex was free. Code that doesn't need one is the upgrade: typed schemas, validated once at the edge, trusted everywhere after.
I'm Himanshu, an AI and full-stack engineer. I build MVPs, AI agents and the growth plumbing around them for early-stage startups.