Guide
A library of tested regular expressions and how to use them safely
Regular expressions are compact, powerful and easy to get subtly wrong. Email, IP address, date and password checks are written again and again, and each rewrite risks letting bad values through or blocking good ones. This library collects 29 common patterns, each with examples that show what it accepts and rejects, and generates the code to use it in six languages.
What is in the library
Patterns are grouped by purpose. Web covers email addresses, URLs, domain names and URL slugs. Network has IPv4, IPv6, MAC addresses and port numbers. Identifiers include UUIDs, semantic versions and hex colours. Dates has ISO dates, RFC 3339 timestamps and 24-hour times. Personal covers phone numbers in E.164 form, US ZIP and UK postcodes, card number shapes, passwords and usernames. Text and Code add whitespace trimming, repeated words, HTML tags, decimal numbers, hashtags, JWTs, identifiers and file extensions.
Tested, not just collected
Every pattern carries a list of strings it must match and a list it must reject. The site’s test suite runs each pattern against its own list on every build, so a pattern cannot be edited into a broken state without a failing test. You can also type your own test strings, one per line, and see each marked as matching or not.
Anchors and flags
Validation patterns use ^ and $ so the entire value has to match; search patterns do not, because they look for pieces inside larger text. Flags change behaviour: i ignores case, g finds every match, m makes anchors work per line and u enables Unicode features such as \p{L}. The code generator carries them over: JavaScript keeps them after the closing slash, Python uses re.IGNORECASE, Java uses Pattern.CASE_INSENSITIVE, and C# uses RegexOptions.IgnoreCase.
Language differences
Most languages share the basics, but engines differ. Go’s regexp package uses RE2, which guarantees linear-time matching by leaving out lookahead, lookbehind and back-references, so patterns that need them, such as the domain-name and MAC address patterns, will not compile there and the page says so. JavaScript supports lookbehind in modern engines, PHP uses PCRE with delimiters, and C# verbatim strings double their quotes. The generated snippet handles escaping, so backslashes survive.
A worked example
Choose “IPv4 address”. The pattern limits each of four dot-separated octets to 0 through 255 without leading zeros. The built-in examples show 192.168.1.1 and 8.8.8.8 as matches and 256.1.1.1, 01.2.3.4 and 1.2.3 as rejections, so the list reads pass, pass, fail, fail, fail. Switching the language to Python produces re.compile(r"^(?:(?:25[0-5]… as a raw string.
What a regex cannot prove
A pattern checks shape, not truth. A valid-looking email may have no mailbox; a well-formed date such as 2026-02-31 does not exist; a phone number in the right format may not be assigned; a postcode may not be in use. Parse dates with a date library, confirm emails by sending a message and use a phone-number library for real validation. The password pattern checks composition only, and current guidance favours length and breach checks over character rules.
Performance and safety
Patterns with nested quantifiers can take exponential time on crafted input, known as ReDoS. The library avoids the common traps, but if you write your own, test long non-matching strings, set input length limits before matching, and prefer engines with linear-time guarantees for untrusted data.
Related tools
- Regex Tester tries your own patterns with explanations and match highlighting.
- Redact Log Secrets applies detection patterns to mask sensitive data.
- CSS to XPath covers another pattern language for documents.
- Extract Emails pulls addresses out of text without writing a pattern.
Checked against the current version of the Regex Pattern Library on .