⌘ K
hyphen · digits · length · start-letter

Build a custom URL slug regex

Pick separator, allow digits, choose length range, and require letter-start. Verify against samples live. Runs locally.

Slug Regex Builder
Matches
1
samples
Failed
4
samples
Length
43
chars
Status
/
flag
options · build the regex
Separator
Min length
Max length
Test (one per line)
output · pattern + verification
Generated regex
/^(?=.{3,64}$)[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/
Matches (1)
my-cool-post
Non-matching (4)
2026-recap
foo--bar
MyPost
hello_world
Quick Start

How to build a URL slug regex

Pick separator, allow digits, choose length range, and decide whether slugs must start with a letter.

  1. 01

    Pick separator

    Hyphen is standard for URLs. Underscore is rare but supported.

    Patterns compile through the JavaScript RegExp constructor, so syntax errors surface immediately and engine quirks like Unicode property escapes (\p{L}) work when the u flag is on.

    patternECMAScriptliterallive
    input · literalsep · regex
    - | _
    loaded · ECMAScriptPCRE · ready
  2. 02

    Pick policy

    Allow digits, set length range, require letter-start.

    Each flag character mirrors the ECMAScript literal: g enables iteration, i folds case, m anchors per line, s lets . match newlines, u unlocks proper Unicode, y is sticky, and d emits indices.

    flagsoptionsg · i · mlive
    config · optionspolicy · flags
    [x] start letter 3-64 chars
    flags applied · liveECMA · live
  3. 03

    Verify samples

    Each line gets a verdict. foo--bar fails (double separator).

    Watch for catastrophic backtracking on nested quantifiers — a common ReDoS source. The tool caps match counts to keep the page responsive on pathological patterns.

    matchgroupshighlightReDoS-safe
    run · outputverify · matches
    ok my-cool-post no foo--bar
    matches · livegroups · live
  4. 04

    Copy or export

    Grab the output as JSON, CSV, or plain text — ready for your editor or pipeline.

    Copy writes via navigator.clipboard.writeText; downloads use a Blob and object URL, so nothing transits the network and the output is byte-identical to what you see on screen.

    copyexportclipboardblob
    export · exportedready · saved
    Copied
    ready to shipsuccess
Pro tips

Regex patterns that don't melt down

Use named groups

(?<year>\d{4}) reads better than $1 and survives reordering. Supported in ECMAScript 2018+.

Anchor strictly

Use ^/$ with the m flag when matching whole lines. Without anchors, partial matches sneak through.

Avoid catastrophic backtracking

Nested quantifiers like (a+)+ can explode. Run patterns through ReDoS Detector first.

Escape every literal

Backslash any meta character you want literally: \.\$\^\*\+\?\(\)\[\]\{\}\|\\.

Test edge cases

Empty string, single character, unicode, the maximum length you expect — write fixtures for each.

Patterns aren&rsquo;t parsers

Don’t parse HTML, JSON, or balanced parens with regex. Use a proper parser when the grammar is recursive.

Related toolsUsername Regex BuilderRegex TesterRegex BuilderRegex LibraryRegex Character ClassesRegex Cheatsheet
Use Cases

When to build a slug regex

Enforce a consistent URL slug policy.

CMS slug input

Reject malformed slugs at write time. Compiles through the JavaScript RegExp constructor — engine quirks (Unicode property escapes, sticky matching, named groups) work when their flags are on. Error messages cite the exact position of any syntax issue.

ReDoS-safe

URL generation

Validate slugs derived from titles. Pairs with the ReDoS detector to catch catastrophic backtracking before you deploy. A pattern that handles 1k-character input fine can become a denial-of-service vector on attacker-controlled 1M-character input.

ECMA-compliant

SEO audit

Find content with off-policy slugs. Output exports as JavaScript, Python re, Java util.regex, .NET System.Text.RegularExpressions, PCRE, and POSIX — language quirks are highlighted on conversion so you don't ship a JS-only pattern to a Go service.

spec-grade

Username-like IDs

Reuse for human-readable IDs. Capture groups (named or numbered) round-trip cleanly into replacement strings, JSON output, or CSV extraction without re-typing. Backreferences ($1, ${name}) preserve semantics across languages.

cross-engine

Document policy

Codify what 'slug' means in your team. Test against edge cases — empty input, single character, max length, multibyte boundaries — to catch off-by-one and zero-length match bugs before they reach production.

test-ready

Bulk migration

Find content needing slug fixes. All matching runs client-side so secret patterns never leave the browser. Useful when the pattern itself is sensitive (PII regexes, internal data formats, security filters).

production-ready
FAQ

Frequently asked questions

foo--bar produces messy URLs. The regex enforces single-separator joins by construction.
Most CMS engines refuse all-digit slugs (could be confused with IDs). Toggle off if not needed.
ASCII-only. For international slugs, use Punycode or a transliteration step before validating.
3-64 is a sensible default. SEO best practice keeps slugs under 80 chars.
No. The tool runs entirely in your browser — your pattern and sample text never leave the page.
Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

Sent straight to the maintainers · no account needed
47 in queue·8 shipped this month
Request queued. Thanks!