★ Web · regex

Regex for HTML Tag

Q: Can I use this to strip HTML tags?

For trusted, simple markup, yes. For user input, use a sanitiser library; attackers can craft markup that slips past regex.

Finds things that look like HTML tags in text, capturing the tag name. Useful for quick scans and stripping simple markup. It can't understand nesting, comments, scripts or attributes containing >.

Runs in your browser
No signup

Try the html tag pattern

Read it in plain English (best-effort)

<the character '<'
/the character '/'
?the previous is optional
(start capture group 1
[A-Za-z]one character from: A–Z, a–z
[A-Za-z0-9-]one character from: A–Z, a–z, 0–9, '-'
*zero or more of the previous
)end of group
\ba word boundary
[^<>]any one character except '<', '>'
*zero or more of the previous
>the character '>'

Test text

One sample per line works well with the m flag on anchored patterns.

Waiting for a pattern

The pattern, piece by piece

/<\/?([A-Za-z][A-Za-z0-9-]*)\b[^<>]*>/g

Pattern explanation
Part	What it does
`<`	an opening angle bracket
`\/?`	an optional slash for closing tags
`([A-Za-z][A-Za-z0-9-]*)`	group 1: the tag name, like div or my-component
`\b`	the name ends here
`[^<>]*`	attributes: anything except angle brackets
`>`	the closing bracket

This pattern isn't anchored with ^…$, because its job is to find matches inside longer text, not to validate a whole value.

What it accepts and rejects

Every sample below is checked automatically in JavaScript and Python. The tester above is preloaded with all of them, one per line.

Should match
Should match
`<div>`	✓
`</p>`	✓
`<a href="/x">link</a>`	✓
`<img src="a.png" />`	✓
`<my-component prop=1>`	✓
`text <br> more`	✓

Should not match
Should not match
`plain text`	✗
`a < b and c > d`	✗
`<>`	✗
`< div>`	✗
`<1abc>`	✗
`5 > 3 < 4`	✗

Copy it into your code

RE2-safeNo lookarounds or backreferences, so the same pattern works in Go's RE2 engine and in Rust's regex crate.

Language

const htmlTagRe = /<\/?([A-Za-z][A-Za-z0-9-]*)\b[^<>]*>/g;

export function findHtmlTags(text) {
  return [...text.matchAll(htmlTagRe)].map((m) => m[0]);
}

When not to use regex for this

Never parse or sanitise HTML with regex. Use DOMParser in the browser, a real parser on the server (parse5, BeautifulSoup, golang.org/x/net/html), and a sanitiser like DOMPurify for anything user-supplied. Regex-based sanitising is a classic XSS hole.

Questions engineers actually ask

Can I use this to strip HTML tags?

For trusted, simple markup, yes. For user input, use a sanitiser library; attackers can craft markup that slips past regex.

Why doesn't it match ?

Comments and doctype declarations aren't tags. A parser handles them properly.

What is catastrophic backtracking?

Some patterns, usually nested quantifiers like (a+)+, make a backtracking engine try an exponential number of paths on input that almost matches. The tester stops any run after 300ms, so a bad pattern can't freeze your tab. In production, that same pattern can take down a server (a ReDoS attack).

More web patterns

Or browse the full regex library.

More from the workbench

09 · Dev utilitiesJSON to TypesPaste JSON, get TypeScript, Zod, Pydantic, Go, Rust, JSON Schema, Prisma or GraphQL.10 · Dev utilitiesCron Expression BuilderBuild or explain a cron expression, with the next run times and platform quirks.07 · AI & LLMsToken CounterToken counts per model, cost per call and how much of the context window you are using.

Fine print

Tools: on the house.
Engineer: by the hour.

The regex was free. Code that doesn't need one is the upgrade: typed schemas, validated once at the edge, trusted everywhere after.

I'm Himanshu, an AI and full-stack engineer. I build MVPs, AI agents and the growth plumbing around them for early-stage startups.

Hire me →My projects