40 Production-Tested Regex Patterns & Live Testing Lab

Regular Expression Pattern Library

Browse, test, and implement battle-tested regular expressions. Complete with live match highlighting, token breakdowns, validation matrices, and copy-ready code snippets in 6 languages.

Authentication & Security (8)

Emails, passwords, JWT tokens, XSS, and SQL injection sanitization.

Email Address Validation

Standard, robust regular expression to validate email addresses including alphanumeric characters, dots, plus signs, and modern TLDs.

/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/

Strong Password Policy

Enforces minimum 8 characters, at least one uppercase letter, one lowercase letter, one digit, and one special character.

/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&#])[A-Za-z\d@$!%*?&#]{8,}$/

JSON Web Token (JWT)

Validates standard 3-part JSON Web Tokens (Header.Payload.Signature) in Base64URL encoding.

/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/

Alphanumeric Username

Standard web application username policy: 3 to 20 characters, starting with a letter, allowing underscores.

/^[a-zA-Z][a-zA-Z0-9_]{2,19}$/

SQL Injection Detection Pattern

Detects common SQL injection attempts including OR 1=1, UNION SELECT, comment dashes, and drops.

/('(''|[^'])*')|(;\s*(SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|UNION)\b)|(\b(OR|AND)\b\s+['"\d]+[=<>]+['"\d]+)|(--|#|\/\*)/i

Cross-Site Scripting (XSS) Script Tag

Detects malicious `<script>` tags, javascript: pseudo-protocols, and inline event handlers (onload, onerror).

/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>|javascript:|on[a-z]+\s*=/i

MD5 Hash Checksum

Matches 32-character hexadecimal MD5 hash checksum strings.

/^[a-fA-F0-9]{32}$/

SHA-256 Hash Checksum

Matches 64-character hexadecimal SHA-256 cryptographic digest strings.

/^[a-fA-F0-9]{64}$/

Network & Web (7)

URLs, domain names, IPv4, IPv6, MAC addresses, and YouTube video IDs.

HTTP & HTTPS URL Validation

Matches fully qualified URLs starting with http:// or https://, including subdomains, paths, ports, and query parameters.

/^https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}(?:\.[a-zA-Z0-9()]{1,6})?(?::[0-9]{1,5})?\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*)$/i

Domain Name Matcher

Validates Fully Qualified Domain Names (FQDN) adhering to DNS hostname specification (RFC 1035).

/^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/

IPv4 Address Validator

Strictly validates IPv4 addresses ensuring each octet is within the valid 0 to 255 numerical range.

/^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/

IPv6 Address Validator

Matches standard 8-group IPv6 addresses as well as compressed double-colon (::) formats.

/^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$|^::1$|^::$/i

MAC Address Matcher

Matches 6-byte IEEE 802 Media Access Control (MAC) hardware addresses with colons or hyphens.

/^(?:[0-9A-Fa-f]{2}[:-]){5}(?:[0-9A-Fa-f]{2})$/

YouTube Video ID Extractor

Extracts the unique 11-character video ID from watch?v=, youtu.be, shorts/, and embed/ links.

/(?:youtu\.be\/|youtube\.com\/(?:embed\/|v\/|shorts\/|watch\?v=|watch\?.+&v=))([\w-]{11})/

Localhost Web Origin

Matches local development origins including http://localhost:PORT and 127.0.0.1 with ports 1024-65535.

/^https?:\/\/(?:localhost|127\.0\.0\.1)(?::[0-9]{1,5})?$/

Data & Formatting (12)

Dates, times, ISO 8601, UUIDs, Base64, whitespace, and Unicode.

UUID v4 Identifier

Strictly matches version 4 UUIDs with 36 canonical characters including hyphens and version bit 4.

/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/

URL Slug Matcher

Matches lowercase alphanumeric strings separated by single hyphens, ideal for SEO permalinks.

/^[a-z0-9]+(?:-[a-z0-9]+)*$/

ISO Date (YYYY-MM-DD)

Validates 4-digit year, 2-digit month (01-12), and 2-digit day (01-31) in ISO format.

/^\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$/

24-Hour Time Format (HH:mm:ss)

Matches 24-hour military and standard timestamps in HH:mm or HH:mm:ss format.

/^(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d)?$/

ISO 8601 Combined Timestamp

Matches ISO 8601 timestamps like 2026-10-14T22:30:00.000Z or with +/- timezone offsets.

/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/

5-Field Cron Expression

Matches standard Unix crontab schedules (minute, hour, day of month, month, day of week).

/^(?:\*(?:\/[0-9]+)?|[0-9,-\/]+)\s+(?:\*(?:\/[0-9]+)?|[0-9,-\/]+)\s+(?:\*(?:\/[0-9]+)?|[0-9,-\/]+)\s+(?:\*(?:\/[0-9]+)?|[0-9,-\/]+|[a-zA-Z]{3})\s+(?:\*(?:\/[0-9]+)?|[0-9,-\/]+|[a-zA-Z]{3})$/

Leading & Trailing Whitespace

Matches beginning and ending spaces, tabs, and newlines for string sanitization.

/^\s+|\s+$/g

Duplicate Consecutive Words

Finds repeated words separated by whitespace like 'the the' or 'is is' using backreferences.

/\b(\w+)\s+\1\b/gi

CSV Comma-Separated Line Parser

Splits a CSV line into fields respecting quotes around fields with embedded commas.

/(?:^|,)(?:"([^"]*(?:""[^"]*)*)"|([^,"]*))/g

Base64 Encoded String

Validates Base64 encoded data with proper 4-character padding multiples using = characters.

/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/

Image File Extension Matcher

Matches filenames ending with common web image formats (png, jpg, jpeg, webp, svg, avif, gif).

/\.(jpe?g|png|gif|webp|svg|avif|ico|bmp)$/i

Arabic Unicode Characters

Matches Arabic script characters (Unicode block U+0600 to U+06FF) including letters, digits, and diacritics.

/[\u0600-\u06FF\u0750-\u077F\u08A0-\u08FF]+/gu

Numbers & Finance (4)

International phone numbers, US phone, credit cards, and IBAN accounts.

International Phone (E.164)

Matches international standard phone numbers starting with a plus sign and 7 to 15 digits.

/^\+[1-9]\d{1,14}$/

US Phone Number Format

Flexible US phone number validator matching standard parentheses, hyphens, and spaces.

/^(?:\+?1\s*(?:[.-]\s*)?)?(?:\(\s*([2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8][02-9])\s*\)|([2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8][02-9]))\s*(?:[.-]\s*)?([2-9]1[02-9]|[2-9][02-9]1|[2-9][02-9]{2})\s*(?:[.-]\s*)?([0-9]{4})$/

Credit Card (Visa & Mastercard)

Detects Visa and Mastercard credit card format with optional space or hyphen delimiters.

/^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|2(?:22[1-9]|2[3-9][0-9]|[3-6][0-9]{2}|7[01][0-9]|720)[0-9]{12})$/

IBAN Bank Account Matcher

Validates canonical IBAN structure: 2-letter country code, 2-digit checksum, and up to 30 alphanumeric characters.

/^[A-Z]{2}[0-9]{2}[A-Z0-9]{4}[0-9]{7}([A-Z0-9]?){0,16}$/

Code & Markup (9)

HTML tags, Markdown links, SemVer, Docker tags, Hex/RGB colors, and Git SHAs.

Hexadecimal Color Code

Matches CSS hex colors in #RGB, #RRGGBB, and #RRGGBBAA (with alpha transparency) formats.

/^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/

RGB & RGBA CSS Color

Matches CSS rgb(r, g, b) and rgba(r, g, b, a) expressions with values between 0 and 255.

/^rgba?\(\s*(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\s*,\s*(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\s*,\s*(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(?:\s*,\s*(?:0|1|0?\.\d+))?\s*\)$/i

HTML Tags Matcher & Stripper

Matches HTML markup tags for sanitization, stripping, or token extraction.

/<\/?[a-zA-Z][a-zA-Z0-9]*(?:\s+[^>]*?)?\/?>/g

Markdown Links Parser

Captures anchor text and target URL from Markdown link syntax `[text](url)`.

/\[([^\]]+)\]$(https?:\/\/[^\s$]+)\)/g

Semantic Version (SemVer 2.0)

Full SemVer 2.0.0 specification regex validating major, minor, patch, and optional pre-release/build tags.

/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/

Docker Image Name & Tag

Validates Docker image references such as repository/image:tag or standard official tags.

/^(?:(?=[^:\/]{1,253})(?!-)[a-zA-Z0-9-]{1,63}(?<!-)(?:\.(?!-)[a-zA-Z0-9-]{1,63}(?<!-))*(?::[0-9]{1,5})?\/)?(?:[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?\/)*[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?(?::[\w][\w.-]{0,127})?$/

JSON Object Key Extractor

Captures all property keys from JSON formatted strings using lookahead for the colon separator.

/"([a-zA-Z_][a-zA-Z0-9_]*)"\s*:/g

Git Commit SHA-1 & SHA-256

Matches Git commit SHA hashes: 7-character short commit IDs or 40-character full SHA-1 hashes.

/^\b([a-f0-9]{7}|[a-f0-9]{40})$/i

.env Configuration Key-Value

Parses standard `.env` file entries matching uppercase snake_case keys and their string values.

/^([A-Z_][A-Z0-9_]*)=(.*)$/m

Frequently Asked Questions

Are these regular expressions compatible with multiple programming languages?

Yes! Every pattern in the Castov Regex Library adheres to standard PCRE / ECMAScript syntax and includes instant code generators for JavaScript, TypeScript, Python, Go, Rust, PHP, and Java.

Can I test custom strings against these patterns before using them in production?

Yes. Every pattern page features an interactive lab where you can test live strings, modify flags (g, i, m, s, u), and run validation matrices across pre-configured test cases.

Is any data sent to external servers when testing regex on Castov?

No. 100% of pattern evaluation and testing runs directly in your browser using the local JavaScript engine with zero telemetry.

Need a specific regular expression?

Pick any pattern above to open the live interactive laboratory and test your strings in real time.

Email Validation Regex URL Validation Regex Strong Password Regex