Regex Reference

Ready-made regular expressions, with what each one matches and an example of text it finds. Copy one, or open it in the Regular Expression Lab to see it work.

IPv4 address

\b(?:\d{1,3}\.){3}\d{1,3}\bFour dot-separated groups of one to three digits. Shape only, not a range check.Matches: host 10.0.0.1 up, gateway 192.168.1.254, bogus 999.1.1.1

IPv4 address (range checked)

\b(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\bEach octet held to 0-255, so 999.1.1.1 is rejected rather than matched.Matches: 203.0.113.42 is valid; 999.1.1.1 and 256.0.0.1 are not

IPv4 private range

\b(?:10\.(?:\d{1,3}\.){2}\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})\bThe three RFC 1918 blocks: 10/8, 172.16/12 and 192.168/16.Matches: 10.4.5.6, 172.20.0.1 and 192.168.0.10 are private; 8.8.8.8 is not

IPv6 address (full form)

\b(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}\bEight colon-separated groups of hex digits (the full, uncompressed form).Matches: 2001:0db8:85a3:0000:0000:8a2e:0370:7334

IPv6 address (compressed)

\b(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}\bAlso matches the :: compressed form. Deliberately loose: it will match a bare ::.Matches: link local fe80::1 and loopback ::1 on the bridge

CIDR block (IPv4)

\b(?:\d{1,3}\.){3}\d{1,3}/\d{1,2}\bAn IPv4 network in slash notation, prefix length one or two digits.Matches: route 10.1.0.0/16 via eth0, drop 0.0.0.0/0

CIDR block (IPv6)

\b(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}/\d{1,3}\bAn IPv6 network in slash notation, compressed form included.Matches: documentation prefix 2001:db8::/32

MAC address

\b[0-9A-Fa-f]{2}(?:[:-][0-9A-Fa-f]{2}){5}\bSix hex pairs joined by colons or hyphens.Matches: arp 00:1b:44:11:3a:b7 and 00-1B-44-11-3A-B7 on br0

Hostname or FQDN

\b(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,}\bDot-separated labels ending in an alphabetic top-level label.Matches: connect to db-01.internal.example.com from web.example.org

Host and port

(?:[A-Za-z0-9.-]+|\[[0-9A-Fa-f:]+\]):\d{1,5}\bA host or bracketed IPv6 literal followed by a colon and a port.Matches: upstream 10.0.0.5:8080, backend [::1]:9090, api.example.com:443

Autonomous system number

\bAS\d{1,10}\bAn ASN in the conventional AS-prefixed form.Matches: the prefix is announced by AS13335 and AS15169

URL (http/https)

https?://[^\s/$.?#].[^\s]*An http or https URL up to the next whitespace.Matches: see https://example.com/a/b?c=1#d and http://localhost:8000/ for details

URL (any scheme)

\b[A-Za-z][A-Za-z0-9+.-]*://[^\s]+Any scheme with an authority: ssh, ftp, redis, postgres and the rest.Matches: git clone ssh://git@host/repo.git; cache at redis://127.0.0.1:6379/0

Email address

[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}A pragmatic email shape: local part, at sign, domain, dotted top-level.Matches: mail [email protected] or [email protected]

Query-string parameter

[?&]([A-Za-z0-9_.\[\]%-]+)=([^&\s#]*)One key and value out of a query string, captured separately.Matches: /search?q=regex&page=2&safe=#results

Hex colour

#(?:[0-9A-Fa-f]{8}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{3})\bA CSS hex colour in its three, six or eight digit form.Matches: background:#0b0f14; accent:#f90; overlay:#0b0f1480;

HTML tag

</?[A-Za-z][A-Za-z0-9-]*(?:\s[^<>]*)?>An opening or closing tag with its attributes. Not an HTML parser.Matches: <div class="row"><span>hi</span></div>

HTML attribute

\b([A-Za-z-]+)="([^"]*)"A double-quoted attribute, name and value captured separately.Matches: <a href="/x" data-id="7" aria-label="open">

Data URI

data:[A-Za-z0-9.+/-]+;base64,[A-Za-z0-9+/=]+A base64 data URI, media type included.Matches: src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUg=="

Markdown link

\[([^\]]+)\]\(([^)\s]+)(?:\s+"[^"]*")?\)Link text and target, with the optional title, captured separately.Matches: see [the spec](/docs/spec.md "Spec") and [home](/) for more

UUID

\b[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}\bThe canonical 8-4-4-4-12 hyphenated hex form.Matches: id 550e8400-e29b-41d4-a716-446655440000 ok

UUID with version and variant

\b[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-([1-8])[0-9A-Fa-f]{3}-([89ABab][0-9A-Fa-f]{3})-[0-9A-Fa-f]{12}\bCaptures the version digit and the variant nibble so you can read them.Matches: v4 550e8400-e29b-41d4-a716-446655440000, v1 c232ab00-9414-11ec-b3c8-9f6bdeced846

MD5 hash

\b[0-9a-fA-F]{32}\bThirty-two hex digits.Matches: 5d41402abc4b2a76b9719d911017c592 hello.txt

SHA-1 hash

\b[0-9a-fA-F]{40}\bForty hex digits.Matches: aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d hello.txt

SHA-256 hash

\b[0-9a-fA-F]{64}\bSixty-four hex digits.Matches: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 hello.txt

SHA-512 hash

\b[0-9a-fA-F]{128}\bOne hundred and twenty-eight hex digits.Matches: 9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043

Git commit SHA

\b[0-9a-f]{7,40}\bA short or full commit id. Lowercase hex only, so it does not eat every word.Matches: fixed in 1389502 and reverted by b5e4bd6c1f2a3e4d5c6b7a8990112233445566aa

ULID

\b[0-7][0-9A-HJKMNP-TV-Z]{25}\bA 26-character Crockford base32 ULID, timestamp first.Matches: order 01ARZ3NDEKTSV4RRFFQ69G5FAV created

Base64 blob

\b[A-Za-z0-9+/]{16,}={0,2}A run of standard-alphabet base64 with its padding. Sixteen chars or more.Matches: payload=SGVsbG8sIHdvcmxkISBUaGlzIGlzIGJhc2U2NC4=

bcrypt hash

\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}A modular-crypt bcrypt digest with its cost factor and salt.Matches: user:$2b$12$KIXQ2xY0y1r7wPqe0kZ4iuOa8ZbW4nEeQ1yYb0sJ3lM5cV7dR9tGu

JSON Web Token

\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*Three base64url segments starting from the eyJ of a JSON header.Matches: Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk

AWS access key id

\b(?:AKIA|ASIA|AIDA|AROA|ANPA|AIPA)[0-9A-Z]{16}\bThe four-letter type prefix and sixteen uppercase base32 characters.Matches: aws_access_key_id = AKIAIOSFODNN7EXAMPLE

AWS secret access key (shape)

\b[A-Za-z0-9/+=]{40}\bForty characters of the secret alphabet. Noisy by nature: treat a hit as a lead.Matches: aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

GitHub token

\bgh[pousr]_[A-Za-z0-9]{36}\bA classic personal access, OAuth, user, server or refresh token.Matches: GH_TOKEN=ghp_1234567890abcdefghijklmnopqrstuvwxyz

GitHub fine-grained token

\bgithub_pat_[A-Za-z0-9_]{22,}\bThe newer fine-grained personal access token prefix.Matches: github_pat_11ABCDEFG0abcdefghijkl_mnopqrstuvwxyz0123456789

Slack token

\bxox[baprs]-[A-Za-z0-9-]{10,}A bot, app, personal, refresh or legacy Slack token.Matches: SLACK_TOKEN=xoxb-123456789012-1234567890123-AbCdEfGhIjKlMnOpQrStUvWx

Google API key

\bAIza[0-9A-Za-z_-]{35}The AIza prefix and thirty-five characters of key material.Matches: key=AIzaSyA1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q7R

Stripe API key

\b[sprw]k_(?:live|test)_[A-Za-z0-9]{16,}\bA secret, publishable or restricted key, live or test.Matches: STRIPE_SECRET=sk_live_51HabcdefghijklmnopqrstuvwX

Authorization header

\bAuthorization:\s*(?:Bearer|Basic|Token|Digest)\s+(\S+)The header and its credential, with the credential captured.Matches: Authorization: Basic b3BzOmh1bnRlcjI=

Private key PEM header

-----BEGIN (?:RSA |DSA |EC |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----The line that says a paste contains key material rather than a cert.Matches: -----BEGIN OPENSSH PRIVATE KEY-----

Secret assignment

(?i)\b(?:api[_-]?key|secret|token|password|passwd|pwd)\s*[:=]\s*["']?([^\s"']{6,})A credential assigned in config or code. The inline (?i) flag makes it case-blind.Matches: DB_PASSWORD = "hunter2swordfish" apiKey: abcdef123456

ISO 8601 timestamp

\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?A date and time in ISO 8601, with an optional fractional second and zone.Matches: started 2026-08-03T19:52:11.482Z, ended 2026-08-03 20:14:02+01:00

ISO 8601 date

\b\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])\bA calendar date with the month and day held to plausible ranges.Matches: released 2026-08-03, superseded 2026-12-31

Time of day (24-hour)

\b(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d)?\bHours and minutes, seconds optional, with real range limits.Matches: window 23:59:59 through 00:05 and 13:37

Common Log Format time

\d{2}/[A-Za-z]{3}/\d{4}:\d{2}:\d{2}:\d{2} [+-]\d{4}The bracketed timestamp of an Apache or nginx access log.Matches: [03/Aug/2026:19:52:11 +0000]

Syslog timestamp (RFC 3164)

\b[A-Z][a-z]{2}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}\bMonth, space-padded day and time, as BSD syslog writes it.Matches: Aug 3 19:52:11 host sshd[2311]: accepted publickey

HTTP date (RFC 7231)

\b[A-Z][a-z]{2}, \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} (?:GMT|[+-]\d{4})The Date and Expires header format.Matches: Date: Mon, 03 Aug 2026 19:52:11 GMT

Unix epoch (seconds)

\b1[0-9]{9}\bA ten-digit epoch second, which covers 2001 to 2033.Matches: ts=1785000000 expires=1785086400

Unix epoch (milliseconds)

\b1[0-9]{12}\bA thirteen-digit epoch millisecond.Matches: "timestamp": 1785000000000

Duration with unit

\b\d+(?:\.\d+)?(?:ns|us|ms|s|m|h|d|w)\bThe Go and Prometheus duration form, decimals allowed.Matches: timeout 1.5s, scrape 15s, retention 30d, jitter 250ms

Common Log Format line

^(\S+) \S+ \S+ \[([^\]]+)\] "([^"]*)" (\d{3}) (\S+)A whole CLF access-log line: host, identity, user, time, request, status, size.Matches: 127.0.0.1 - ops [03/Aug/2026:19:52:11 +0000] "GET /index.html HTTP/1.1" 200 2326

Combined Log Format line

^(\S+) \S+ \S+ \[([^\]]+)\] "([^"]*)" (\d{3}) (\S+) "([^"]*)" "([^"]*)"CLF plus the referer and user agent that Combined keeps.Matches: 127.0.0.1 - - [03/Aug/2026:19:52:11 +0000] "GET / HTTP/1.1" 200 612 "https://example.com/" "curl/8.5.0"

HTTP request line

\b(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE|CONNECT) (\S+) (HTTP/[\d.]+)Method, target and version, each captured.Matches: POST /api/v2/session HTTP/2.0

HTTP status line

\bHTTP/[\d.]+ (\d{3})(?: ([A-Za-z ]+))?The version, the code and the reason phrase where there is one.Matches: HTTP/1.1 404 Not Found

HTTP error status

\b[45]\d{2}\bAny 4xx or 5xx code, for sweeping a log for failures.Matches: 422 and 503 need attention; 200 and 301 do not

Syslog header (RFC 5424)

<(\d{1,3})>(\d) (\S+) (\S+) (\S+) (\S+) (\S+)Priority, version, timestamp, host, app, procid and msgid.Matches: <34>1 2026-08-03T19:52:11.000Z host su 1234 ID47 - failed

Log level tag

\b(?i:TRACE|DEBUG|INFO|NOTICE|WARN(?:ING)?|ERROR|CRIT(?:ICAL)?|ALERT|EMERG|FATAL)\bThe eight syslog severities plus the names application loggers add.Matches: [WARN] disk 84% full [error] upstream timed out INFO ready

Key and value pair

\b([A-Za-z_][A-Za-z0-9_.]*)=("[^"]*"|\S+)Logfmt style, quoted values kept whole.Matches: level=info msg="server started" port=8000 tls=false

ANSI escape sequence

\x1b\[[0-9;]*[A-Za-z]A CSI colour or cursor sequence, for stripping colour out of a log.Matches: red plain bold green

Stack frame

\bat ([\w.$<>]+) \(([^)]+):(\d+):(\d+)\)A JavaScript style frame: function, file, line and column.Matches: at Object.run (/app/src/index.js:42:15)

Unix absolute path

(?:/[\w.-]+)+/?A rooted path of word, dot and hyphen segments.Matches: tail -f /var/log/nginx/access.log from /home/ops/

Windows path

[A-Za-z]:\\(?:[^\\/:*?"<>|\r\n]+\\)*[^\\/:*?"<>|\r\n]*A drive letter and backslash-separated path, invalid characters excluded.Matches: copy C:\Users\ops\report.txt D:\backup\

UNC path

\\\\[A-Za-z0-9._-]+\\[A-Za-z0-9._$-]+(?:\\[^\\/:*?"<>|\r\n]+)*A server, share and optional path in UNC notation.Matches: net use Z: \\fileserver\share\docs

Filename with extension

\b[\w.-]+\.(?:log|txt|json|ya?ml|toml|csv|pem|key|crt|tar|gz|zip|rs|py|js|ts|sh|md)\bA file name ending in one of the extensions an operator meets daily.Matches: config.yaml, id_rsa.pem, dump.tar.gz and notes.md

Dotfile

(?:^|/)\.[A-Za-z][\w.-]*A hidden file or directory, at the start of the text or after a slash.Matches: /home/ops/.ssh/config and /home/ops/.bashrc

Unix permission string

[-dlbcps](?:[r-][w-][xsS-]){2}[r-][w-][xtT-]The ten-character mode ls prints, setuid and sticky bits included.Matches: drwxr-xr-x 2 ops ops 4096 Aug 3 19:52 logs -rw------- 1 ops ops 1675 id_rsa

Passwd file line

^([^:]+):([^:]*):(\d+):(\d+):([^:]*):([^:]*):(.*)$The seven colon-separated fields of an /etc/passwd entry.Matches: ops:x:1000:1000:Operator:/home/ops:/bin/bash

Docker image reference

\b(?:[a-z0-9.-]+(?::\d+)?/)*[a-z0-9._-]+:[\w.-]+\bRegistry, repository and tag. The digest form is a separate pattern.Matches: ghcr.io/piercehanlon/pahmoi:1.2.3 and alpine:3.20

S3 URI

\bs3://[a-z0-9.-]{3,63}/\S*A bucket and key in the s3 scheme.Matches: aws s3 cp s3://my-bucket/logs/2026-08-03.gz .

File size with unit

\b\d+(?:\.\d+)?\s?(?:[KMGTP]i?B|[kmgt]b)\bA byte count with a binary or decimal unit suffix.Matches: image 4.7 GiB, log 512KB, archive 3 TB

Semantic version

\bv?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+([0-9A-Za-z.-]+))?Major, minor, patch, prerelease and build metadata, each captured.Matches: bumped to v1.4.0-rc.2+build.7 from 1.3.9

CVE identifier

CVE-\d{4}-\d{4,7}A CVE id: the year and a sequence number of four to seven digits.Matches: see CVE-2021-44228 and CVE-2014-0160

CWE identifier

\bCWE-\d{1,4}\bA weakness class id from the CWE catalogue.Matches: classified CWE-79 and CWE-1333

TODO or FIXME comment

\b(TODO|FIXME|HACK|XXX|NOTE)\b[:( ]?\s*(.*)The marker and the rest of the line after it.Matches: // TODO: retire the shim before 2027 # FIXME handle the empty case

Block comment

/\*[\s\S]*?\*/A C style block comment. Lazy, so two comments do not merge into one.Matches: let x = 1; /* first spans lines */ let y = 2; /* second */

Function definition

\b(?:pub\s+)?(?:async\s+)?fn\s+([A-Za-z_]\w*)\s*(?:<[^>]*>)?\s*\(A Rust function signature up to the opening parenthesis.Matches: pub fn search_library(query: &str) -> Vec<&'static LibraryEntry> {

Environment variable reference

\$\{?([A-Z_][A-Z0-9_]*)\}?A shell variable expansion, braced or bare, with the name captured.Matches: export PATH="$HOME/.cargo/bin:${PATH}"

Git conflict marker

(?m)^(?:<{7}|={7}|>{7})(?: .*)?$The three markers a merge leaves behind. The inline (?m) flag is included.Matches: <<<<<<< HEAD ours ======= theirs >>>>>>> feature

Language string literal

"([^"\\]*(?:\\.[^"\\]*)*)"A double-quoted string with backslash escapes, ending at the right quote.Matches: msg="he said \"hi\"" level=info

Whole number

\b\d+\bA run of digits standing on its own.Matches: retry 3 times after 500 ms, 12 workers

Decimal number

[-+]?\d+\.\d+A signed or unsigned number with a fractional part.Matches: load 0.75, delta -1.25, ratio +3.5

Scientific notation

[-+]?\d+(?:\.\d+)?[eE][-+]?\d+A mantissa and a signed exponent.Matches: charge 1.6e-19 and Avogadro 6.022E23

Hex literal

\b0[xX][0-9A-Fa-f]+\bA 0x-prefixed hexadecimal number.Matches: mask 0xFF00, offset 0x7f, magic 0xCAFEBABE

Percentage

\b\d+(?:\.\d+)?%A number immediately followed by a percent sign.Matches: disk at 84.2% of 100%, cpu 7%

Currency amount

[$£€]\s?\d{1,3}(?:,\d{3})*(?:\.\d{2})?A currency sign and a grouped amount with optional pence.Matches: total $1,234.56, refund £99, fee €12.00

Grouped number

\b\d{1,3}(?:,\d{3})+\bA number written with thousands separators.Matches: 1,234,567 requests and 12,000 errors

Card number (PAN shape)

\b\d{4}(?:[ -]?\d{4}){3}\bSixteen digits in four groups. Shape only: there is no Luhn check here.Matches: 4111 1111 1111 1111 and 5555555555554444

Phone number (E.164)

\+[1-9]\d{6,14}\bA plus sign, a country code and up to fifteen digits in total.Matches: call +14155550123 or +442071838750

IBAN (shape)

\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\bCountry, check digits and the basic bank account number. No checksum.Matches: pay GB82WEST12345698765432 by Friday

Trailing whitespace

(?m)[ \t]+$Spaces or tabs at the end of a line. The inline (?m) makes it per line.Matches: clean line trailing spaces here tab after this fine

Leading indentation

(?m)^[ \t]+The whitespace at the start of each line.Matches: fn main() { let x = 1; let y = 2; }

Blank line

\n[ \t]*\nAn empty or whitespace-only line between two others.Matches: first paragraph second paragraph third

Repeated space

{2,}Two or more consecutive spaces.Matches: too many spaces here

Tab character

\tA literal tab, which is otherwise invisible in a diff.Matches: col1 col2 col3

Windows line ending

\r\nA carriage return and line feed pair.Matches: line one line two line three

Non-ASCII character

[^\x00-\x7F]Any character outside 7-bit ASCII, one at a time.Matches: naïve café résumé and a Greek σ

Control character

[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]A C0 control other than tab, newline and carriage return, plus delete.Matches: bellhere and escapethere

Word (Unicode aware)

\p{L}[\p{L}\p{M}\p{Pd}']*A letter and the letters, marks, hyphens and apostrophes that follow it.Matches: naïve Zoë can co-operate with O'Brien

Sentence

[^.!?]+[.!?]+A run of text up to its terminating punctuation.Matches: One sentence here. A second one! And a third?

This is generated in browser and is not sent to pah.moi servers.