Build a custom email validator regex
Toggle options like plus-aliases, required-dot, allowed domains, and TLD length. Sample emails verify live. Runs locally.
/^[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}$/iHow to build an email regex
Toggle options to customise an email validator and watch every sample line pass or fail in real time.
- 01
Pick options
Allow plus-aliases, require a dot in local part, restrict to specific domains, set TLD length.
Patterns compile through the JavaScript RegExp constructor, so syntax errors surface immediately and engine quirks like Unicode property escapes (\p{L}) work when the u flag is on.
patternECMAScriptliteralliveinput · literalopts · regex[x] plus [x] tld>=2loaded · ECMAScriptPCRE · ready - 02
Read the pattern
The regex updates live and shows on top — copy when ready.
Each flag character mirrors the ECMAScript literal: g enables iteration, i folds case, m anchors per line, s lets . match newlines, u unlocks proper Unicode, y is sticky, and d emits indices.
flagsoptionsg · i · mliveconfig · optionsregex · flags/^[A-Za-z0-9...]+@.../flags applied · liveECMA · live - 03
Verify against samples
Drop one email per line. Each gets a pass/fail tick.
Watch for catastrophic backtracking on nested quantifiers — a common ReDoS source. The tool caps match counts to keep the page responsive on pathological patterns.
matchgroupshighlightReDoS-saferun · outputverify · matchesok alice@… no bad@nopematches · livegroups · live - 04
Copy or export
Grab the output as JSON, CSV, or plain text — ready for your editor or pipeline.
Copy writes via navigator.clipboard.writeText; downloads use a Blob and object URL, so nothing transits the network and the output is byte-identical to what you see on screen.
copyexportclipboardblobexport · exportedready · savedCopiedready to shipsuccess
Regex patterns that don't melt down
Use named groups
(?<year>\d{4}) reads better than $1 and survives reordering. Supported in ECMAScript 2018+.
Anchor strictly
Use ^/$ with the m flag when matching whole lines. Without anchors, partial matches sneak through.
Avoid catastrophic backtracking
Nested quantifiers like (a+)+ can explode. Run patterns through ReDoS Detector first.
Escape every literal
Backslash any meta character you want literally: \.\$\^\*\+\?\(\)\[\]\{\}\|\\.
Test edge cases
Empty string, single character, unicode, the maximum length you expect — write fixtures for each.
Patterns aren’t parsers
Don’t parse HTML, JSON, or balanced parens with regex. Use a proper parser when the grammar is recursive.
When to build an email regex
Tailor a validator to your app's rules.
Form input
Roll a stricter validator than the basic library pattern. Compiles through the JavaScript RegExp constructor — engine quirks (Unicode property escapes, sticky matching, named groups) work when their flags are on. Error messages cite the exact position of any syntax issue.
ReDoS-safeAllowed domains
Restrict signups to your company's domains. Pairs with the ReDoS detector to catch catastrophic backtracking before you deploy. A pattern that handles 1k-character input fine can become a denial-of-service vector on attacker-controlled 1M-character input.
ECMA-compliantAnti-abuse
Drop plus-aliases on signup if you forbid them. Output exports as JavaScript, Python re, Java util.regex, .NET System.Text.RegularExpressions, PCRE, and POSIX — language quirks are highlighted on conversion so you don't ship a JS-only pattern to a Go service.
spec-gradeTLD policies
Require a 2+ letter TLD to weed out junk inputs. Capture groups (named or numbered) round-trip cleanly into replacement strings, JSON output, or CSV extraction without re-typing. Backreferences ($1, ${name}) preserve semantics across languages.
cross-engineAudit
Catch malformed addresses in a fixture list. Test against edge cases — empty input, single character, max length, multibyte boundaries — to catch off-by-one and zero-length match bugs before they reach production.
test-readyDocument policy
Copy the regex into your validation docs. All matching runs client-side so secret patterns never leave the browser. Useful when the pattern itself is sensitive (PII regexes, internal data formats, security filters).
production-readyFrequently asked questions
Something missing?
Tell us what you need. We ship the top requests every two weeks.