★ Web · regex

Regex for URL

Validates a web URL a user pastes into a form: http or https, a dotted domain with a valid TLD, an optional port, and anything after the first slash, ? or # as long as it has no spaces.

Runs in your browser
No signup

Try the url pattern

Read it in plain English (best-effort)

^start of a line
httpthe text 'http'
sthe character 's'
?the previous is optional
://the text '://'
(?:start a group (not captured)
[A-Za-z0-9]one character from: A–Z, a–z, 0–9
(?:start a group (not captured)
[A-Za-z0-9-]one character from: A–Z, a–z, 0–9, '-'
{0,61}between 0 and 61 of the previous
[A-Za-z0-9]one character from: A–Z, a–z, 0–9
)end of group
?the previous is optional
.the character '.'
)end of group
+one or more of the previous
[A-Za-z]one character from: A–Z, a–z
{2,63}between 2 and 63 of the previous
(?:start a group (not captured)
:the character ':'
\da digit (0–9)
{1,5}between 1 and 5 of the previous
)end of group
?the previous is optional
(?:start a group (not captured)
[\/?#]one character from: '/', '?', '#'
\Sanything except whitespace
*zero or more of the previous
)end of group
?the previous is optional
$end of a line

Test text

One sample per line works well with the m flag on anchored patterns.

Waiting for a pattern

The pattern, piece by piece

/^https?:\/\/(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}(?::\d{1,5})?(?:[\/?#]\S*)?$/

Pattern explanation
Part	What it does
`^https?:\/\/`	http:// or https://
`(?:label\.)+`	one or more domain labels, each followed by a dot
`[A-Za-z]{2,63}`	top-level domain
`(?::\d{1,5})?`	optional port, like :8080
`(?:[\/?#]\S*)?`	optional path, query or fragment with no whitespace
`$`	end of the string

What it accepts and rejects

Every sample below is checked automatically in JavaScript and Python. The tester above is preloaded with all of them, one per line.

Should match
Should match
`https://example.com`	✓
`http://example.com/path?q=1#top`	✓
`https://sub.domain.co.in:8080/a/b`	✓
`https://my-site.dev/`	✓
`https://example.com?ref=tools`	✓
`https://a.io#section`	✓

Should not match
Should not match
`example.com`	✗
`ftp://example.com`	✗
`https://`	✗
`https://-bad.com`	✗
`https://example.com/has space`	✗
`http://localhost:3000`	✗

Copy it into your code

RE2-safeNo lookarounds or backreferences, so the same pattern works in Go's RE2 engine and in Rust's regex crate.

Language

const urlRe = /^https?:\/\/(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}(?::\d{1,5})?(?:[\/?#]\S*)?$/;

export function isValidUrl(value) {
  return urlRe.test(value.trim());
}

When not to use regex for this

In code you control, use the platform's URL parser: new URL() in JavaScript, urllib.parse in Python, net/url in Go. It handles IPv6 hosts, encoded characters and edge cases a regex can't. Use the regex for quick form feedback only.

Questions engineers actually ask

Why doesn't it match localhost?

It requires a dotted domain with a TLD, which is what you want for user-submitted links. For developer tools that accept localhost or IP addresses, parse with new URL() instead.

Does it accept URLs without https://?

No. If you want to accept example.com, prepend https:// when the scheme is missing, then validate.

What is catastrophic backtracking?

Some patterns, usually nested quantifiers like (a+)+, make a backtracking engine try an exponential number of paths on input that almost matches. The tester stops any run after 300ms, so a bad pattern can't freeze your tab. In production, that same pattern can take down a server (a ReDoS attack).

More web patterns

Or browse the full regex library.

More from the workbench

09 · Dev utilitiesJSON to TypesPaste JSON, get TypeScript, Zod, Pydantic, Go, Rust, JSON Schema, Prisma or GraphQL.10 · Dev utilitiesCron Expression BuilderBuild or explain a cron expression, with the next run times and platform quirks.07 · AI & LLMsToken CounterToken counts per model, cost per call and how much of the context window you are using.

Fine print

Tools: on the house.
Engineer: by the hour.

The regex was free. Code that doesn't need one is the upgrade: typed schemas, validated once at the edge, trusted everywhere after.

I'm Himanshu, an AI and full-stack engineer. I build MVPs, AI agents and the growth plumbing around them for early-stage startups.

Hire me →My projects