Every pattern below is verified against real pass/fail input, not just written to look right — regex is exactly the kind of code where "looks right" and "actually matches what you think it matches" diverge more often than usual. Each entry also lists what it deliberately doesn't handle, since that's the part that causes production incidents when someone assumes a pragmatic pattern is a complete specification.
1. Email address
/^[\w.+-]+@[\w-]+\.[\w.-]+$/Matches jane.doe@example.com and jane+newsletter@example.com. The full RFC 5322 email grammar is famously absurd — this pattern covers the common case instead. Full breakdown and known limitations (doubled dots pass, apostrophes don't) in Regex for Email.
2. Phone number (US/Canada)
/^\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}$/Matches 555-123-4567, (555) 123-4567, and 5551234567. Phone numbers have no single international standard — E.164 alone allows 8-15 digits — so this is deliberately scoped to the 10-digit US/Canada shape. See Regex for Phone Number.
3. Username
/^[a-zA-Z][a-zA-Z0-9_]{2,19}$/Matches john_doe99, rejects 1user (must start with a letter) and anything under 3 or over 20 characters total. Adjust the {2,19} bound and the leading-character class to match whatever your actual signup rules are — this is a common shape, not a standard.
4. UUID
/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/Matches any RFC 9562 UUID (versions 1-8) by checking the version and variant digits, not just the 8-4-4-4-12 hex-and-hyphen shape — a string that merely looks UUID-shaped can still fail this. Full breakdown, including the Nil UUID edge case, in Regex for UUID.
5. URL
/^https?:\/\/[\w.-]+(?:\/[\w\-./?%&=]*)?$/Matches https://example.com and https://example.com/search?q=cats&page=2. Deliberately doesn't handle ports, credentials, or fragments — for a link that needs to actually work, not just look like a URL, use a real URL parser. See Regex for URLs.
6. URL slug
/^[a-z0-9]+(?:-[a-z0-9]+)*$/Matches hello-world, rejects Hello-World (no uppercase), hello--world (no doubled hyphens), and a leading or trailing hyphen. Useful both for validating a slug field and for checking one you generated yourself came out clean.
7. Hashtag
/#[a-zA-Z0-9_]+/gAn extraction pattern, not a whole-string validator — run it with matchAll against a block of text to pull every hashtag out: "Loving #javascript and #TypeScript today".matchAll(/#[a-zA-Z0-9_]+/g) returns both matches. Drop the g flag and anchor it with ^/$ if you need to validate a single hashtag string instead.
8. @Mention
/@[a-zA-Z0-9_]+/gSame extraction shape as the hashtag pattern, for pulling @username-style mentions out of free text instead of a hashtag's #.
9. Hex color code
/^#(?:[0-9a-fA-F]{3}){1,2}$/Matches both the 3-digit shorthand (#fff) and the full 6-digit form (#a1b2c3) with one pattern, by repeating a 3-hex-digit group once or twice. Doesn't match 8-digit hex-with-alpha (#ffffffff) — extend the repeat count if your color format needs alpha.
10. Currency amount
/^\$\d{1,3}(,\d{3})*(\.\d{2})?$/Matches $1,234.56, $5, and $1,234,567.89 — the comma-grouping and the optional cents are each their own piece, so both a bare dollar amount and a fully-formatted one pass. Scoped to USD-style grouping (commas every three digits, dot for decimals); plenty of locales group or punctuate differently.
11. Number (integer or decimal, signed)
/^-?\d+(\.\d+)?$/Matches 42, -3.14, and 0.5; rejects 1.2.3 and a bare .5 with no leading digit. A plain, general-purpose numeric check for form input before you hand it to Number() or parseFloat.
12. ISO 8601 date (YYYY-MM-DD)
/^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$/Checks the month is 01-12 and the day is 01-31 — but it's format validation, not calendar validation: 2026-02-30 passes this pattern despite February never having a 30th. Catching that requires actually constructing a Date and checking it round-trips, not a regex.
13. 24-hour time (HH:MM or HH:MM:SS)
/^([01]\d|2[0-3]):([0-5]\d)(:([0-5]\d))?$/Matches 00:00, 23:59, and 13:45:30; rejects 24:00 and a one-digit hour like 1:30. Seconds are optional — drop the trailing group entirely if your input is always just hours and minutes.
14. Strong password
/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9])[A-Za-z\d\S]{8,}$/Requires at least one lowercase letter, one uppercase letter, one digit, one non-alphanumeric character, and 8+ characters total — each requirement is its own lookahead, checked independently of the others, so abcdefgh and ABCDEFGH both correctly fail even though each is 8 characters. This checks composition, not actual strength — a common, guessable password that happens to meet all four rules still passes. For real strength checking, compare against a breached-password list instead of pattern rules.
15. IPv4 address
/^(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/Each octet is bounded to 0-255 individually rather than just matching "1 to 3 digits" — that's the difference between this and the much shorter (and wrong) /^\d{1,3}(\.\d{1,3}){3}$/, which would happily accept 999.999.999.999. This pattern correctly rejects it, along with 256.1.1.1.
16. A single HTML tag
/<\/?[a-zA-Z][a-zA-Z0-9]*(?:\s+[^<>]*)?\/?>/Matches one opening, closing, or self-closing tag — <div>, </div>, <img src="x.png" />. This is the standard "don't parse HTML with regex" territory: fine for spotting or stripping a single known tag shape, unreliable for anything involving nested structure, malformed markup, or a full document — use an actual HTML parser for that.
17. File extension
/\.([a-zA-Z0-9]+)$/Captures the extension after the last dot — against archive.tar.gz this returns gz, not tar.gz, since the pattern only anchors to the final dot. Worth knowing deliberately: if you need the full compound extension for double-extension formats, this pattern alone won't give it to you.
18. Collapse repeated whitespace
str.replace(/\s+/g, " ")Turns any run of spaces, tabs, or newlines into a single space — "hello world\t\tfoo" becomes "hello world foo". A one-line cleanup step for user-pasted text before displaying or storing it.
19. US ZIP code (5 or ZIP+4)
/^\d{5}(-\d{4})?$/Matches both 12345 and 12345-6789 — the extended four-digit suffix is entirely optional, so a plain 5-digit ZIP isn't rejected for lacking it. US-only; postal code formats vary widely by country.
20. Credit card number (format only)
/^(?:\d{4}[-\s]?){3}\d{4}$/Matches a 16-digit number in groups of four, with optional space or dash separators — 4111 1111 1111 1111 or 4111111111111111. This checks shape only: it says nothing about whether the number could actually be a real, issuable card. That requires a Luhn checksum on top of this pattern, which a regex can't compute — see the digit-by-digit algorithm rather than trying to encode it as a pattern.
Try it yourself
Paste any of these into Regex Tester for live match highlighting against your own input, or Regex Visualizer to see a pattern broken into a diagram when one of the longer ones (IPv4, strong password) is hard to read at a glance. Building a variation from scratch? Regex Builder lets you assemble character classes, quantifiers, and groups without hand-writing the syntax. All three run entirely in your browser.