Validate any email address with a regex
Run a single email or a whole list against a basic pragmatic pattern or a closer-to-RFC pattern. Each pattern is shown alongside the result.
/^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$/How to validate an email address
Pick a regex variant calibrated against RFC 5322, drop one address or a list, and read pass/fail with the failing pattern surfaced alongside each result.
- 01
Pick a pattern variant
Basic accepts the common shape local@domain.tld and catches typos; RFC-ish is closer to RFC 5322 — allows dots, plus-tags, and subdomains while still rejecting obvious noise. Neither covers RFC 6531 internationalised (IDN) addresses, so non-ASCII inputs need a separate punycode pass.
Patterns compile through the JavaScript RegExp constructor, so syntax errors surface immediately and engine quirks like Unicode property escapes (\p{L}) work when the u flag is on.
patternECMAScriptliterallivevariant · Basic | RFC-ish · literalRFC 5322 · ASCII · regexBasic | RFC-ishloaded · ECMAScriptPCRE · ready - 02
Type one or paste many
Single mode validates as you type. Batch mode reads one email per line — handy for vetting a CSV column or a subscriber export. Common false negatives to watch for: tagged addresses like alice+filter@x.com, long TLDs like .photography, and quoted local parts.
Each flag character mirrors the ECMAScript literal: g enables iteration, i folds case, m anchors per line, s lets . match newlines, u unlocks proper Unicode, y is sticky, and d emits indices.
flagsoptionsg · i · mlivemode · single | batch · optionsRFC 5322 · ASCII-only · flagsalice@example.comflags applied · liveECMA · live - 03
Read the verdict
Each line shows VALID or INVALID with the reason. The exact regex literal is shown beneath the result, so you can paste it into the Regex Tester to debug a near-miss without re-typing the pattern.
Watch for catastrophic backtracking on nested quantifiers — a common ReDoS source. The tool caps match counts to keep the page responsive on pathological patterns.
matchgroupshighlightReDoS-saferesult · VALID/INVALID · outputreason · with regex · matchesVALID · 3 / INVALID · 2matches · livegroups · live - 04
Copy or export
Grab the output as JSON, CSV, or plain text — ready for your editor or pipeline.
Copy writes via navigator.clipboard.writeText; downloads use a Blob and object URL, so nothing transits the network and the output is byte-identical to what you see on screen.
copyexportclipboardblobexport · exportedready · savedCopied report — 3 VALID · 2 INVALIDready to shipsuccess
Regex patterns that don't melt down
Use named groups
(?<year>\d{4}) reads better than $1 and survives reordering. Supported in ECMAScript 2018+.
Anchor strictly
Use ^/$ with the m flag when matching whole lines. Without anchors, partial matches sneak through.
Avoid catastrophic backtracking
Nested quantifiers like (a+)+ can explode. Run patterns through ReDoS Detector first.
Escape every literal
Backslash any meta character you want literally: \.\$\^\*\+\?\(\)\[\]\{\}\|\\.
Test edge cases
Empty string, single character, unicode, the maximum length you expect — write fixtures for each.
Patterns aren’t parsers
Don’t parse HTML, JSON, or balanced parens with regex. Use a proper parser when the grammar is recursive.
When to validate email
From signup forms to data cleanup.
Form validation
Reject malformed addresses at the edge before they hit your DB or trigger SMTP retries. Compiles through the JavaScript RegExp constructor — engine quirks (Unicode property escapes, sticky matching, named groups) work when their flags are on. Error messages cite the exact position of any syntax issue.
ReDoS-safeBulk list audit
Sanity-check a CSV of subscribers — flag rows that won't even parse as RFC 5322. Pairs with the ReDoS detector to catch catastrophic backtracking before you deploy. A pattern that handles 1k-character input fine can become a denial-of-service vector on attacker-controlled 1M-character input.
ECMA-compliantSignup flows
Pair regex with a confirm-email round-trip to filter typos and obvious noise. Output exports as JavaScript, Python re, Java util.regex, .NET System.Text.RegularExpressions, PCRE, and POSIX — language quirks are highlighted on conversion so you don't ship a JS-only pattern to a Go service.
spec-gradeMigration cleanup
Surface broken rows before importing into a system that enforces strict address syntax. Capture groups (named or numbered) round-trip cleanly into replacement strings, JSON output, or CSV extraction without re-typing. Backreferences ($1, ${name}) preserve semantics across languages.
cross-engineQA fixtures
Generate seed data that you know satisfies the project's chosen pattern variant. Test against edge cases — empty input, single character, max length, multibyte boundaries — to catch off-by-one and zero-length match bugs before they reach production.
test-readySupport triage
Quickly answer 'is this reported address even valid?' without spinning up a mailbox. All matching runs client-side so secret patterns never leave the browser. Useful when the pattern itself is sensitive (PII regexes, internal data formats, security filters).
production-readyFrequently asked questions
Something missing?
Tell us what you need. We ship the top requests every two weeks.