★ India · regex

Regex for UPI ID (VPA)

A UPI ID is a username, an @ and the payment provider's handle (okaxis, ybl, paytm, oksbi). Letters, digits, dots and hyphens are widely accepted in the username; underscores depend on the provider.

Runs in your browser
No signup

Try the upi id (vpa) pattern

Read it in plain English (best-effort)

^start of a line
[a-zA-Z0-9]one character from: a–z, A–Z, 0–9
[a-zA-Z0-9._-]one character from: a–z, A–Z, 0–9, '.', '_', '-'
{1,255}between 1 and 255 of the previous
@the character '@'
[a-zA-Z]one character from: a–z, A–Z
[a-zA-Z0-9]one character from: a–z, A–Z, 0–9
{1,63}between 1 and 63 of the previous
$end of a line

Test text

One sample per line works well with the m flag on anchored patterns.

Waiting for a pattern

The pattern, piece by piece

/^[a-zA-Z0-9][a-zA-Z0-9._-]{1,255}@[a-zA-Z][a-zA-Z0-9]{1,63}$/

Pattern explanation
Part	What it does
`^[a-zA-Z0-9]`	the username starts with a letter or digit
`[a-zA-Z0-9._-]{1,255}`	letters, digits, dots, underscores, hyphens
`@`	exactly one at sign
`[a-zA-Z][a-zA-Z0-9]{1,63}$`	the provider handle, e.g. okaxis or ybl

What it accepts and rejects

Every sample below is checked automatically in JavaScript and Python. The tester above is preloaded with all of them, one per line.

Should match
Should match
`himanshu@okaxis`	✓
`9876543210@ybl`	✓
`jane.doe@oksbi`	✓
`shop-123@paytm`	✓
`rahul.k@ibl`	✓
`merchant99@axl`	✓

Should not match
Should not match
`himanshu`	✗
`@okaxis`	✗
`himanshu@`	✗
`him anshu@okaxis`	✗
`himanshu@ok axis`	✗
`himanshu@@okaxis`	✗
`himanshu#1@okaxis`	✗

Copy it into your code

RE2-safeNo lookarounds or backreferences, so the same pattern works in Go's RE2 engine and in Rust's regex crate.

Language

const upiIdRe = /^[a-zA-Z0-9][a-zA-Z0-9._-]{1,255}@[a-zA-Z][a-zA-Z0-9]{1,63}$/;

export function isValidUpiId(value) {
  return upiIdRe.test(value.trim());
}

When not to use regex for this

Only the UPI network can confirm an ID exists and show the account holder's name. Use your payment gateway's VPA validation API before collecting money.

Questions engineers actually ask

Are underscores allowed in UPI IDs?

It depends on the app or bank. Some accept them, some don't, so a permissive pattern plus gateway verification is safest.

Does this check the handle is a real bank?

No. Handles are added over time; verify with your payment gateway instead of keeping a hard-coded list.

What is catastrophic backtracking?

Some patterns, usually nested quantifiers like (a+)+, make a backtracking engine try an exponential number of paths on input that almost matches. The tester stops any run after 300ms, so a bad pattern can't freeze your tab. In production, that same pattern can take down a server (a ReDoS attack).