New Horizons Banner

Regex Library

100 Essential Regex Patterns

Powerful Regular Expressions • Features & Use Cases

A curated selection of the most useful regular expressions for validation, extraction, and cleaning. Copy, adapt, and use them in JavaScript, Python, PHP, or any modern language.

Pattern Regex Feature / Use Case
Email Address
Most common validation
 ^[^\s@]+@[^\s@]+\.[^\s@]+$ Simple & practical email check
Strong Password
8+ chars, upper, lower, number, symbol
 ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$ Enforces complexity rules
URL / Website
http, https, optional www
 https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b Matches most valid web addresses
IPv4 Address
0.0.0.0 – 255.255.255.255
 ^(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)$ Strict IP validation
Hex Color Code
#RGB or #RRGGBB
 ^#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$ CSS / design tools
Date (YYYY-MM-DD)
ISO format
 ^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$ Strict calendar date
Phone (International)
+ and digits
 ^\+?[1-9]\d{7,14}$ E.164 style numbers
Username
3–20 chars, alphanumeric + _
 ^[a-zA-Z0-9_]{3,20}$ Safe handle / login name
Slug / URL-friendly
lowercase-with-hyphens
 ^[a-z0-9]+(?:-[a-z0-9]+)*$ SEO-friendly paths
UUID / GUID
Standard format
 ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ Unique identifiers
IPv6 Address
Full & compressed
 ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|(([0-9a-fA-F]{1,4}:){0,6}[0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:){0,6}[0-9a-fA-F]{1,4})$ Modern network addresses
Australian Postcode
4 digits
 ^(0[289][0-9]{2}|[1-9][0-9]{3})$ AU postcode validation
UK Postcode
Standard format
 ^[A-Z]{1,2}\d[A-Z\d]? ?\d[A-Z]{2}$ British postcode
YouTube Video ID
From any YouTube URL
 (?:youtube\.com\/(?:[^\/]+\/.+\/|(?:v|e(?:mbed)?)\/|.*[?&]v=)|youtu\.be\/)([^"&?\/\s]{11}) Extract 11-char video ID
JWT Token
Three base64 parts
 ^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$ JSON Web Token format
MongoDB ObjectId
24 hex characters
 ^[0-9a-fA-F]{24}$ MongoDB document ID
Bitcoin Address
Legacy & SegWit
 ^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,39}$ BTC address format
Ethereum Address
0x + 40 hex
 ^0x[a-fA-F0-9]{40}$ ETH wallet address
Visa Card
Starts with 4
 ^4[0-9]{12}(?:[0-9]{3})?$ Visa card numbers
Mastercard
51-55 or 2221-2720
 ^(?:5[1-5][0-9]{14}|2(?:2[2-9][0-9]{12}|[3-6][0-9]{13}|7[01][0-9]{12}|720[0-9]{12}))$ Mastercard numbers
American Express
34 or 37
 ^3[47][0-9]{13}$ Amex card numbers
CVV / CVC
3 or 4 digits
 ^\d{3,4}$ Card security code
IBAN
International bank account
 ^[A-Z]{2}\d{2}[A-Z0-9]{11,30}$ Basic IBAN format
BIC / SWIFT
Bank identifier
 ^[A-Z]{4}[A-Z]{2}[A-Z0-9]{2}([A-Z0-9]{3})?$ SWIFT/BIC codes
ISO 8601 DateTime
2024-01-15T14:30:00Z
 ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})?$ Full ISO datetime
Unix Timestamp
10 digits
 ^\d{10}$ Seconds since epoch
Latitude
-90 to 90
 ^[-+]?([1-8]?\d(\.\d+)?|90(\.0+)?)$ Geographic latitude
Longitude
-180 to 180
 ^[-+]?(180(\.0+)?|((1[0-7]\d)|([1-9]?\d))(\.\d+)?)$ Geographic longitude
Base64 String
Encoded data
 ^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$ Valid Base64 check
Git Commit Hash
7–40 hex chars
 ^[0-9a-f]{7,40}$ Git SHA-1 hashes
SemVer
1.2.3 or 1.2.3-beta
 ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[\w.-]+)?(?:\+[\w.-]+)?$ Semantic versioning
HTML Tag Strip
Remove tags
 <[^>]+> Basic HTML cleaning
Markdown Link
[text](url)
 \[([^\]]+)\]\(([^)]+)\) Parse Markdown links
Hashtag
#word
 #(\w+) Extract hashtags
Twitter / X Handle
@username
 ^@?\w{1,15}$ Valid X/Twitter username
File Extension
.jpg .png .pdf
 \.([a-zA-Z0-9]+)$ Extract extension
CSS Variable
--name
 --[a-zA-Z0-9-_]+ Custom property names
RGB Color
rgb(0,0,0)
 ^rgb\(\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(\d{1,3})\s*\)$ CSS rgb() values
RGBA Color
With alpha
 ^rgba\(\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(0|1|0?\.\d+)\s*\)$ CSS rgba() values
Time (24h)
HH:MM
 ^([01]\d|2[0-3]):([0-5]\d)$ Valid 24-hour clock
Time (12h)
hh:mm AM/PM
 ^(0?[1-9]|1[0-2]):[0-5]\d\s?(AM|PM|am|pm)$ 12-hour with meridian
Roman Numerals
I to MMMCMXCIX
 ^M{0,3}(CM|CD|D?C{0,3})(XC|XL|L?X{0,3})(IX|IV|V?I{0,3})$ Valid Roman numbers
Positive Integer
No leading zeros
 ^[1-9]\d*$ Whole numbers only
Decimal Number
Optional decimal
 ^-?\d+(\.\d+)?$ Floats and integers
Alphanumeric
Letters + numbers
 ^[a-zA-Z0-9]+$ No special characters
Letters Only
A-Z a-z
 ^[a-zA-Z]+$ Pure alphabetic
Digits Only
0-9
 ^\d+$ Pure numeric string
Duplicate Words
Find repeated words
 \b(\w+)\s+\1\b Detect consecutive duplicates
Multiple Spaces
Collapse whitespace
 \s{2,} Two or more spaces
Leading Zeros
00123 → 123
 ^0+(?=\d) Strip leading zeros
Port Number
1–65535
 ^([1-9]\d{0,3}|[1-5]\d{4}|6[0-4]\d{3}|65[0-4]\d{2}|655[0-2]\d|6553[0-5])$ Valid TCP/UDP port
Domain Name
example.com
 ^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9]$ Valid domain format
Mac Address
Colon or hyphen
 ^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$ Network hardware address
Percentage
0% – 100%
 ^(100(\.0{1,2})?|[1-9]?\d(\.\d{1,2})?)%$ Percentage values
SQL Injection Risk
Basic detection
 (?i)(union|select|insert|update|delete|drop|--|;|or\s+1=1) Simple SQLi patterns
XSS Script Tag
Script detection
 <\s*script\b[^>]*>[\s\S]*?<\s*\/\s*script\s*> Find script blocks

Note: These are battle-tested starting points. Always test against real data. Some patterns are simplified for readability — production systems may need stricter or more permissive versions depending on requirements. Regex flavour differences exist between languages.