Regex validation patterns
Sixteen regex patterns for the validation and text cleanup you reach for again and again: email, URL, phone, password strength, IDs, dates, and a couple of find-and-replace helpers. Click a card to copy the bare pattern, no slashes or flags, then paste it into the regex tool's Pattern field to test it against real text. Most patterns here are anchored (^...$) for whole-string validation; the tag-stripping and whitespace ones are unanchored so they find every match inside a longer text.
Open the tool →
Email address
^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$
URL (http/https)
^https?://[\w.-]+(?::\d+)?(?:/\S*)?$
Phone number (E.164 international)
^\+[1-9]\d{1,14}$
Korean mobile number
^01[016789]-?\d{3,4}-?\d{4}$
Strong password (8+ chars, upper/lower/digit/symbol)
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^\w\s]).{8,}$
Username (3-16 chars, letters/digits/underscore)
^[a-zA-Z0-9_]{3,16}$
URL slug (kebab-case)
^[a-z0-9]+(?:-[a-z0-9]+)*$
UUID v4
^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
Hex color code
^#(?:[0-9a-fA-F]{3}){1,2}$
Strip HTML tags
<[^>]+>
IPv4 address
^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)$
ISO 8601 date (YYYY-MM-DD)
^\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$
24-hour time (HH:MM)
^([01]\d|2[0-3]):[0-5]\d$
US ZIP code
^\d{5}(?:-\d{4})?$
Credit card number (format only, 16 digits grouped)
^\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{1,4}$
Collapse repeated whitespace
\s{2,}FAQ
- How do I use these patterns?
- Click a card to copy the bare pattern string, no slashes and no flags. Paste it into the regex tool's Pattern field and type or paste text into the test area to see matches highlighted live. Flags are set separately in the tool (the default is g, which matches every occurrence instead of stopping at the first).
- Does the email pattern catch every valid address?
- No. The full RFC 5322 grammar is complex enough that a fully correct pattern runs dozens of lines. In practice, a pragmatic pattern like this one is used to reject obvious typos and empty input, and a verification email confirms the address actually exists.
- Does the credit card pattern check whether a card number is valid?
- No, it only checks that 16 digits are grouped in fours, optionally separated by spaces or dashes. It does not run the Luhn checksum, and it does not match 15-digit layouts like American Express. Leave real validity checks to your payment gateway.
- What do the (?=...) groups in the password pattern do?
- They're lookaheads: they check a condition without consuming any characters, which is how a single pattern can require lowercase, uppercase, a digit, and a symbol regardless of the order they appear in. That reads far more clearly than one long pattern that forces a specific character order.
