Regex that won't
embarrass you in production.
Stop copying from Stack Overflow. 417 patterns audited for ReDoS risk, each one published with the test cases behind it.
JavaScript, Python, Go, Java, PHP/PCRE — all five, all free, no account needed.
417
PATTERNS
5
ENGINES
417
REDOS CHECKED
FREE
PRICE
FEATURED PATTERNS
Curated selection across 6 categories
IPv4 Address (Strict 0–255)
Validates a complete IPv4 address, strictly enforcing that each octet is between 0 and 255. Rejects leading zeros, out-of-range values, and malformed syntax.
IPv4 with CIDR Notation
Matches an IPv4 address in CIDR block notation (e.g. 192.168.1.0/24). Validates both the address portion (strict 0–255) and the prefix length (0–32).
IPv4 Private Address Ranges
Matches only RFC 1918 private IPv4 addresses: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
Cron Expression (Standard 5-Field)
Matches a standard 5-field Unix cron expression: minute hour day-of-month month day-of-week. Each field accepts a number, range, step, list, or wildcard.
Cron Minute Field
Validates the minute field of a cron expression: 0-59, wildcard, range, list, or step.
Cron Hour Field
Validates the hour field of a cron expression: 0-23, wildcard, range, list, or step.
ISO 4217 Currency Code
Matches a 3-letter ISO 4217 currency code.
Decimal Monetary Amount
Matches a monetary amount with up to 2 decimal places and optional thousands separators.
Monetary Amount with Currency Code
Matches a monetary amount prefixed or suffixed with an ISO 4217 currency code.
ISO 8601 Date (YYYY-MM-DD)
Matches a calendar date in ISO 8601 basic date format with full validation of month and day ranges.
US Date Format (MM/DD/YYYY)
Matches a US-style date in M/D/YYYY or MM/DD/YYYY format.
UK / European Date Format (DD/MM/YYYY)
Matches a UK/European-style date in D/M/YYYY or DD/MM/YYYY format.
Email Address (RFC 5321 Practical)
Matches a practical email address: local part + @ + domain. Balances RFC compliance with real-world usage.
Email Local Part Only
Matches only the local part of an email address (before the @), with common character set.
Email Domain Part Only
Matches only the domain part of an email address (after the @).
Generic Bearer Token (Authorization Header)
Matches an HTTP Bearer token in an Authorization header value.
JSON Web Token (JWT) — Structure Validation
Matches a JWT string: three base64url-encoded segments separated by dots.
JWT Header (Decoded Algorithm Field)
Matches a decoded JWT header JSON string for algorithm validation.
Need it from code?
There is a JSON API. No key, no signup — just the patterns.
FREQUENTLY ASKED QUESTIONS
Yes. All 417 patterns and all five engine implementations are free to browse, search, and copy. No account is required for public regex access.
Two passes. Static analysis flags the constructs that cause catastrophic backtracking — nested quantifiers, overlapping alternation, ambiguous repetition. Then the pattern is run against adversarial inputs and timed. Patterns that clear both are marked "ReDoS Checked"; anything that doesn't is either left out or published without the badge and flagged as a risk, with the concern spelled out on its page. That's an audit, not a proof: engines backtrack differently, so the test cases are published alongside every pattern for you to check against your own inputs.
That's what they're for — but read the test cases and edge-case notes against your own inputs first. Regex behaviour shifts with the engine and the data it sees. We show our working so you can check it, not so you can skip it.
Visit /submit and fill out the form with your pattern, test cases, and documentation. Submissions are validated automatically and then join the review queue.