Regex Pattern Library

You need a regex for email validation. You could write \S+@\S+ (too loose — matches foo@), or you could copy the RFC 5322 regex from Stack Overflow (200 characters, unreadable, and probably wrong). You need a tested, documented pattern with example matches and a live test input so you can verify it works with your data before pasting it into production.

Why This Library (Not the Regex Cheat Sheet or Tester)

PureDevTools has a Regex Cheat Sheet for syntax reference and a Regex Tester for testing custom expressions. This library provides 35+ pre-built, tested patterns for email, URL, phone, date, IP address, credit card, password strength, HTML tags, file paths, UUID, and more — each with a live test input and example matches. Use this library for common patterns; use the cheat sheet to learn syntax; use the tester for custom expressions.

What Is a Regular Expression?

A regular expression (regex or regexp) is a sequence of characters that defines a search pattern. Regex is built into virtually every programming language and text editor, and is the standard tool for:

• Validating input — email addresses, phone numbers, ZIP codes, URLs
• Searching text — finding patterns in log files, source code, documents
• Extracting data — parsing structured text like HTML, CSV, or log entries
• Replacing content — transforming strings with String.replace() or sed

How to Use These Patterns

Each pattern card shows the full regex in /pattern/flags notation. Click Copy to copy the pattern, or type in the Test it field to see a live match result.

JavaScript

const emailRegex = /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
emailRegex.test("user@example.com"); // true

// Named capture groups (ES2018+)
const dateRegex = /^(?<year>\d{4})-(?<month>0[1-9]|1[0-2])-(?<day>0[1-9]|[12]\d|3[01])$/;
const match = "2024-01-15".match(dateRegex);
console.log(match?.groups?.year); // "2024"

Python

import re

email_pattern = re.compile(
    r"^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+"
    r"@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?"
    r"(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$"
)
bool(email_pattern.match("user@example.com"))  # True

PHP

$pattern = '/^[a-zA-Z0-9.!#$%&\'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/';
preg_match($pattern, 'user@example.com'); // 1

Java

import java.util.regex.*;

Pattern p = Pattern.compile("^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@...$");
Matcher m = p.matcher("user@example.com");
boolean matches = m.matches(); // true

Pattern Categories

Email & Web

The Email Address pattern follows RFC 5321 and allows dots, plus signs, and special characters in the local part. It does not verify deliverability — for that, send a confirmation email.

The HTTP/HTTPS URL pattern matches complete web URLs including path, query string, and fragments. It requires the http:// or https:// scheme.

Phone & Numbers

Phone number formats vary widely by country. The US Phone Number pattern handles the most common US formats including parentheses, dashes, dots, and the +1 country code. For international numbers, use the E.164 pattern which requires the + prefix followed by 7–15 digits.

The Credit Card pattern matches the digit-only format (no spaces or dashes) for Visa, Mastercard, American Express, and Discover cards. Always use a dedicated payment library (Stripe, Braintree) for production validation — regex alone cannot validate a card’s actual validity or expiration.

Date & Time

The ISO 8601 Date pattern (YYYY-MM-DD) is the international standard and is the safest format to use in APIs and databases because it is unambiguous across locales. The US Date pattern (MM/DD/YYYY) is common in North American applications.

Note: these patterns validate the format and basic range of month/day values, but they cannot check for calendar validity (e.g., February 31 passes). For full date validation, parse with a date library.

Network

The IPv4 pattern validates all four octets to be in the range 0–255. The IPv6 pattern handles both fully-expanded (2001:0db8:...) and compressed (::1, fe80::1) forms. The MAC Address pattern accepts both colon (AA:BB:CC:DD:EE:FF) and hyphen (AA-BB-CC-DD-EE-FF) notation.

Security

The Strong Password pattern enforces a minimum set of requirements common in security policies: 8+ characters, at least one uppercase, one lowercase, one digit, and one special character. Adjust the special character set to match your policy.

The MD5 and SHA-256 hash patterns simply check for the correct hexadecimal length (32 and 64 characters, respectively). They do not validate the content of the hash.

The JWT Token pattern checks for the three-segment Base64URL structure. Use a dedicated JWT library (jsonwebtoken, jose) to verify the signature.

File & Path

The Unix File Path pattern requires an absolute path starting with /. It disallows null bytes and standalone slashes.

The Windows File Path pattern requires a drive letter and backslash notation. It rejects characters that are invalid on Windows (< > : " / | ? *).

The File Extension pattern covers the most common file types. Add extensions to the alternation group as needed for your use case.

HTML & CSS

Regex is a poor tool for parsing HTML in general — a full DOM parser (browser DOMParser, Python BeautifulSoup, etc.) is almost always the right choice. However, regex can be useful for simple, well-controlled cases like finding all <img> tags in a controlled template.

The Hex Color pattern matches both 3-digit (#FFF) and 6-digit (#FFFFFF) CSS hex colors.

Identity

The US SSN pattern matches the AAA-BB-CCCC format and excludes known invalid area codes (000, 666, 900–999) and a few widely-publicized advertising SSNs. Handle SSNs with care — they are sensitive PII and must be encrypted at rest.

The US ZIP Code pattern matches both the basic 5-digit form and the extended ZIP+4 form (NNNNN-NNNN).

The UK Postcode pattern covers the standard UK postcode formats used by Royal Mail.

Username & Social

The Username pattern (3–16 characters, alphanumeric with underscores and hyphens) is a common baseline used by many platforms. Always check your specific platform’s rules.

The Twitter/X Handle pattern matches 1–15 characters. Note that Twitter does not allow handles starting with a number in the current UI, but the API accepts them.

The GitHub Username pattern enforces GitHub’s rules: 1–39 alphanumeric characters, hyphens allowed but not consecutively or at the start/end.

Text & Formatting

The UUID v4 pattern validates the canonical hyphenated format and checks the version bit (the 4 in the third segment) and variant bits (the 8, 9, a, or b in the fourth segment).

The URL Slug pattern enforces the common convention for URL-friendly strings: lowercase, digits, and single hyphens only.

The Semantic Version pattern implements the full semver.org specification, including pre-release labels (1.0.0-alpha.1) and build metadata (1.0.0+build.1).

Regex Flags Reference

Common Regex Syntax Reference

ReDoS Safety

ReDoS (Regular Expression Denial of Service) occurs when a poorly written regex takes exponential time to process certain crafted inputs. To stay safe:

1. Limit input length before applying regex on the server side
2. Avoid nested quantifiers on overlapping character sets (e.g., (a+)+)
3. Use atomic groups or possessive quantifiers if your engine supports them
4. Test with adversarial inputs — try inputs with many repeated characters before the failure point

The patterns in this library are designed for single-string validation and do not have known catastrophic backtracking issues when used as intended (i.e., testing a complete, length-limited input string).

Frequently Asked Questions

What is the difference between match() and test() in JavaScript? RegExp.prototype.test(str) returns a boolean (does the pattern match?). String.prototype.match(regex) returns the match array or null. For validation, use test(). For extraction, use match() or String.matchAll().

Why does my email regex reject valid addresses? Email validation is famously complex — the full RFC 5321 grammar allows unusual characters and quoted strings. Most teams use a simple pattern that covers 99.9% of real-world addresses and then confirm deliverability via a confirmation link.

Should I use ^ and $ in my patterns? Yes, for validation. Without them, /\d+/ matches 123 inside abc123xyz. With ^\d+$, you require the entire string to be digits. Always anchor validation patterns with ^ and $.

What is a non-capturing group (?:...)? A non-capturing group groups a subexpression without recording the matched text in the capture buffer. Use it for alternation or repetition when you do not need the matched content — it is slightly faster and reduces memory use compared to capturing groups.

Can I use these patterns across programming languages? Yes. JavaScript, Python, Java, PHP, Go, Ruby, and .NET all support PCRE-compatible regex with minor syntactic differences. The main adjustment is string escaping: JavaScript regex literals use \d, while Python uses raw strings (r'\d') or double backslashes ('\\d'). The logic of the patterns transfers directly.