Top 20 Common Regex Patterns Cheat Sheet (Email, URL, IP, Phone, UUID)

Top 20 Production Regex Patterns

Regular expressions are an essential tool for string manipulation, data validation, and text extraction. Below is a battle-tested reference table of standard regex patterns optimized for accuracy, cross-engine compatibility, and execution speed.

1. Web & Identity Validation (Email, URL, Slugs)

When validating user input in web applications, balance strict specification conformance with user experience. For example, the pragmatic email regex ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$ catches 99.9% of common typing mistakes without rejecting valid addresses that use plus-addressing (user+newsletter@domain.com).

// Pragmatic Email Validation in TypeScript
export function isValidEmail(email: string): boolean {
  // Disallow strings over 254 characters (RFC 5321 limit)
  if (!email || email.length > 254) return false;
  
  const emailRegex = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
  return emailRegex.test(email.trim());
}

// URL Slug Validator
export function isValidSlug(slug: string): boolean {
  const slugRegex = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
  return slugRegex.test(slug);
}

2. Networking & Infrastructure (IPv4, IPv6, MAC, Ports)

Validating network addresses requires verifying numeric bounds, not just digit counts. The standard naive regex \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} erroneously accepts 999.999.999.999. The production IPv4 regex below explicitly restricts each octet to the 0-255 range:

Octet breakdown:
25[0-5]        -> Matches 250 - 255
2[0-4][0-9]    -> Matches 200 - 249
[01]?[0-9][0-9]? -> Matches 0 - 199

Combined IPv4 Pattern:
^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$

Port Number (1 - 65535):
^([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$

3. Identifiers & Formats (UUID, ISO 8601, SemVer)

Structured identifiers frequently embed version bits and timestamp components. The UUID v4 pattern checks for the version digit 4 in position 13 and the RFC 4122 variant bits (8, 9, a, or b) in position 17:

import re

UUID_V4_REGEX = re.compile(
    r'^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$',
    re.IGNORECASE
)

def validate_uuid_v4(val: str) -> bool:
    return bool(UUID_V4_REGEX.match(val))

Regex Engine Flags Reference

Regex flags modify the matching execution behavior across the search space:

Preventing ReDoS (Catastrophic Backtracking)

Regular Expression Denial of Service (ReDoS) occurs when an NFA regex engine encounters nested quantifiers with overlapping match paths (e.g., (a+)+$). When evaluated against non-matching strings like "aaaaaaaaaaaaaaaaaaaaX", the engine explores exponential combinations ($O(2^n)$), freezing the CPU thread.

• Avoid Nested Quantifiers: Never write (a+)* or ([a-z]+)+. Refactor into atomic groups or non-overlapping character sets.
• Bound Repeat Loops: Use exact bounds {1,64} instead of unbounded + or * on user inputs.
• Use Atomic Groups or Lookaheads: Where supported, use possessive quantifiers ++ or atomic groups (?>...) to discard backtrack points.
• Implement Execution Timeouts: When evaluating regexes on backend servers, enforce strict execution timeouts (e.g. 50ms) using worker threads.