Regex Generator
Describe the pattern you need in plain English and get a working regular expression back, with an explanation of what each part does.
Free, no account, and it runs on a description rather than requiring you to already know the syntax.
What This Tool Does
Two things.
Generate. You write "match an email address, but only from a company domain, not gmail or outlook" and get a pattern with an explanation of each component.
Explain. You paste a regex you inherited from a codebase, or found in a Stack Overflow answer from 2013, and get a breakdown of what it actually matches.
The second is arguably more useful day to day. Most developers write regex rarely and read it often, usually under pressure, usually in a file nobody has touched in two years.
This is not a tester. regex101 and RegExr are excellent at testing and you should keep using them. The gap those tools leave is the first draft: they assume you can already write something to test. This one starts from a description.
How to Generate a Regex (3 Fields)
[Developer note: written against the recommended field set at the top of this document. If you ship with only the description field, remove steps 2 and 3 and the flavor section.]
Step 1: Describe What You Want to Match (required)
Plain English. Be specific about edge cases, because that is where regex generation goes wrong.
Weak input: "match a phone number"
Better input: "match UK mobile numbers starting 07, allowing optional spaces, and also the +44 international form"
The second tells the generator about the leading zero, the country code alternative and the whitespace tolerance. The first leaves all three to guesswork, and the guesses will not match your data.
Include the awkward cases. If your data contains both 2024-01-15 and 15/01/2024, say so. If some records have a trailing comma, say so. The failures in generated regex are almost always in the cases you did not mention.
Step 2: Flavor (optional, but set it)
JavaScript, Python, PCRE / PHP, Java, .NET / C#, Go or SQL. These are genuinely different engines with different feature support, and a pattern that runs in one may not compile in another. Details in the next section.
Step 3: Mode (optional)
Generate from description or Explain existing regex. Default is generate.
Then test the output against your real data before it goes anywhere near production.
Regex Flavors: Why the Same Pattern Behaves Differently
Regex is not one language. It is a family of related dialects, and the differences are the most common cause of "it worked on my machine".
| Engine | Notable characteristics |
|---|---|
| JavaScript | Lookbehind support arrived relatively late, so older runtimes and some environments may not support it. Named groups use (?<name>...). The u flag matters for Unicode handling |
| Python | Named groups use (?P<name>...), which is not portable to most other engines. Rich Unicode support via the re module, with regex as a third party alternative offering more features |
| PCRE / PHP | Very feature rich. Recursion, possessive quantifiers, atomic groups. Patterns written here often do not port cleanly elsewhere |
| Java | Requires double escaping in string literals, so \\d in source for \d in pattern. A frequent source of confusion |
| .NET / C# | Supports variable length lookbehind, which most engines do not. Good named group support |
| Go (RE2) | Deliberately omits backreferences and lookarounds. This is a design decision that guarantees linear time matching and eliminates catastrophic backtracking. If a pattern uses lookahead, it will not work in Go |
| SQL | Varies substantially by database. PostgreSQL, MySQL and others differ in operators and syntax. Check your specific database's documentation |
The practical implications:
- If you are targeting Go, avoid lookarounds and backreferences entirely
- If you are targeting JavaScript in older environments, verify lookbehind support
- If your team works across languages, prefer the common subset over clever engine specific constructions
- Always double check escaping when embedding a pattern in a string literal, particularly in Java
Example Patterns
Descriptions and what they should produce. Test all of these against your own data.
| Description | Notes on the pattern |
|---|---|
| UK postcode | Needs to handle the optional space and both single and double letter area codes. The full official pattern is longer than most people expect |
| ISO 8601 date | Straightforward for the basic form. Validating that the day is legal for the month is not something regex should do |
| Hex colour | Must handle three digit and six digit forms, and optionally the eight digit alpha form |
| URL | A loose pattern is usually correct. Fully validating a URL by regex is a bad idea, use your language's URL parser |
| Semantic version | The semver specification publishes an official regex, and you should use theirs rather than writing your own |
| Whitespace collapse | \s+ replaced with a single space. One of the few genuinely simple ones |
| Capture between delimiters | Use a lazy quantifier, otherwise the greedy default runs to the last delimiter in the string, not the first |
On that last one: greedy versus lazy quantifiers cause more silent regex bugs than anything else. .* matches as much as possible. .*? matches as little as possible. If your capture group is swallowing half the document, this is why.
Regex Quick Reference
| Token | Matches |
|---|---|
. | Any character except newline, unless the dotall flag is set |
\d \w \s | Digit, word character, whitespace. Uppercase versions negate |
[abc] | Any one of a, b or c |
[^abc] | Any character except a, b or c |
* + ? | Zero or more, one or more, zero or one |
{2,5} | Between two and five times |
*? +? | Lazy versions. Match as few as possible |
^ $ | Start and end of string, or line with the multiline flag |
\b | Word boundary |
(...) | Capturing group |
(?:...) | Non capturing group. Use when you do not need the capture |
(?<name>...) | Named group. Syntax varies by engine |
(?=...) (?!...) | Positive and negative lookahead |
(?<=...) (?<!...) | Positive and negative lookbehind. Not supported everywhere |
| | Alternation |
Common flags: g global, i case insensitive, m multiline, s dotall. Names and availability vary by engine.
Always Test the Output
Non negotiable, and the reason belongs on the page rather than in a disclaimer.
A generated regex is a plausible interpretation of your description. It is not verified against your data, because the tool has never seen your data. Two patterns can both be reasonable readings of the same sentence and behave completely differently on real input.
Test with:
- Positive cases. Strings that should match, including the awkward ones
- Negative cases. Strings that should not match. This is where over broad patterns get caught, and over broad patterns are the common failure mode
- Edge cases. Empty strings, very long strings, unusual Unicode, leading and trailing whitespace
- Real data. A sample from the actual source, not invented examples
Paste the pattern into regex101 or RegExr with a realistic test corpus before it goes into a codebase. Both are free, both show you exactly what is matching, and regex101 will explain the pattern token by token.
Catastrophic Backtracking and ReDoS
Worth understanding, because it is the one way a generated regex can cause a genuine production incident.
Most regex engines use backtracking. When a match attempt fails, the engine backs up and tries a different combination. Certain pattern shapes make the number of combinations grow exponentially with input length, so a modest input can take effectively forever.
The classic dangerous shape is a nested quantifier, such as a quantified group that itself contains a quantifier, followed by something that can fail. On a string that almost matches, the engine explores an enormous number of paths before giving up.
Why this matters here: if the pattern ends up in an input validator on a public endpoint, an attacker who can send a crafted string can hang a request thread. That is a denial of service class known as ReDoS, and it is a real, documented vulnerability category rather than a theoretical concern.
Practical mitigation:
- Be suspicious of nested quantifiers. A quantifier applied to a group that already contains one deserves a second look
- Prefer specific character classes over
.where you can.[^"]*is safer than.*inside a quoted string pattern - Test with adversarial input, not just valid input. Try long strings that nearly match but fail at the end
- Consider an engine with linear time guarantees for untrusted input. Go's RE2 eliminates the problem by design, at the cost of dropping backreferences and lookarounds
- Apply a timeout where your platform supports it. .NET allows a match timeout, and several other environments offer equivalents
If a pattern will validate input that arrives from the internet, this deserves a few minutes of thought regardless of where the pattern came from.
The Email Validation Problem
Worth being direct about, since "validate an email address" is the single most common request any regex tool receives.
There is no short regex that correctly validates every valid email address. The addressing specification permits quoted local parts, comments, unusual characters and forms that essentially nobody uses but which are formally legal. The regex that genuinely implements it is long enough to be famous for being unreadable.
More importantly, a syntactically valid address tells you nothing about whether it exists or whether the person controls it.
What to do instead:
- Use a loose pattern. Something has an at sign, has something before it, has something after it with a dot. That catches typos and obvious rubbish
- Send a confirmation email. This is the only real validation, and it verifies the thing you actually care about
- Consider your language's built in validator if it has one, or the HTML
type="email"input for client side hinting - Do not reject unusual but legal addresses. People with plus addressing, apostrophes in their name, or newer top level domains get wrongly rejected by strict patterns constantly
A generator will happily produce an "email validation regex" if you ask. Ask for a loose one, and pair it with confirmation.
When Not to Use Regex
Regex is excellent at matching flat patterns in text. It is the wrong tool for several things it gets used for anyway.
- HTML and XML. These are nested structures. Regex cannot reliably parse arbitrary nesting. Use a parser. This is the most famous piece of advice on Stack Overflow for a reason
- JSON. Same problem. Use a JSON parser
- Anything with recursion or balanced delimiters. Some engines have recursion extensions, but if you need them the answer is usually a parser
- Complex date validity. Regex can check the shape of a date. It should not be checking whether February has thirty days
- CSV with quoted fields containing commas. Use a CSV library. Every language has one
- Very simple string operations. If
includes,startsWithorsplitdoes the job, they are faster to read and faster to run
Knowing when to reach for something else is a large part of using regex well.
Features
| Feature | What it does |
|---|---|
| Plain English input | Describe the pattern, no syntax knowledge required |
| Explain mode | Paste an existing regex and get a breakdown |
| Flavor selection | JavaScript, Python, PCRE, Java, .NET, Go, SQL |
| Explained output | Each component described, not just the pattern |
| Quick reference on page | Token table for when you are close and just need a reminder |
| Safety guidance | Backtracking and ReDoS covered rather than ignored |
| No sign up | No account, no email, no gate |
| Unlimited | No usage cap |
Common Regex Mistakes
- Greedy when you meant lazy.
.*runs to the last match on the line. Use.*? - Forgetting to escape. Dot, plus, question mark, brackets and parentheses are all special. Escape them or use a character class
- Double escaping confusion. In Java and some other languages,
\din a string literal needs writing as\\d - Assuming
^and$mean string start and end. With the multiline flag they mean line start and end - Over broad character classes.
[a-zA-Z]excludes accented characters, which breaks on non English names - Using capturing groups where non capturing would do.
(?:...)when you do not need the capture keeps group numbering clean - Copying a pattern from the internet without reading it. Especially the famous email one
- Not anchoring a validation pattern. Without
^and$a validator matches a substring, soabc123xyzpasses a numeric check - Testing only the happy path. Most regex bugs are false positives, not false negatives
Who Uses a Regex Generator?
- Developers who write regex a few times a year and never retain the syntax
- Data analysts cleaning and extracting from messy text
- QA engineers building validation test cases
- DevOps and SREs writing log parsing patterns and alert filters
- SEO specialists filtering in Google Search Console, GA4 and Screaming Frog, all of which accept regex
- Spreadsheet users, since Google Sheets and newer Excel versions both support regex functions
- Students learning pattern matching
- Anyone who inherited a regex and needs to know what it does before changing it
Frequently Asked Questions
What is a regex generator?
It is a tool that turns a plain English description of a pattern into a working regular expression, and can also explain an existing regex you paste in.
Is this regex generator free?
Yes. No account, no email, no usage cap.
Which regex flavors are supported?
JavaScript, Python, PCRE and PHP, Java, .NET and C#, Go, and SQL. Flavor matters because engines differ in feature support and syntax.
Why does my regex work in Python but not JavaScript?
Different engines support different features. Named group syntax differs, lookbehind support varies, and Go's RE2 deliberately omits lookarounds and backreferences entirely. Set the flavor before generating.
Can I paste a regex and have it explained?
Yes. Use explain mode. This is often more useful than generation, since developers read regex far more often than they write it.
Should I trust generated regex in production?
Test it first, always. A generated pattern is a plausible interpretation of your description, not something verified against your data. Test positive cases, negative cases and edge cases before deploying.
What is catastrophic backtracking?
A pattern shape, typically nested quantifiers, that causes exponential time matching on inputs that nearly match. If such a pattern validates untrusted input it becomes a denial of service risk known as ReDoS. Be cautious with nested quantifiers and test with adversarial input.
Can regex validate email addresses properly?
Not fully. No short pattern correctly validates every legal address. Use a loose pattern to catch typos and send a confirmation email, which validates the thing that actually matters.
Can I use regex to parse HTML or JSON?
No, not reliably. Both are nested structures and regex cannot handle arbitrary nesting. Use a proper parser.
What is the difference between greedy and lazy quantifiers?
Greedy quantifiers like .* match as much as possible. Lazy quantifiers like .*? match as little as possible. Greedy defaults cause a large share of unexpected regex behaviour.
Where should I test the generated pattern?
regex101 and RegExr are both free and excellent. Paste the pattern with realistic test data. regex101 also explains patterns token by token.
Does this work for SQL or spreadsheet regex?
Select SQL as the flavor, and check your specific database's documentation since implementations differ. Google Sheets and recent Excel versions support regex functions with their own syntax notes.
Generate Your Pattern
Describe what you want to match, pick your flavor, and test the result before you ship it.