Regex for URL Validation
Test regex patterns for validating URLs. Match HTTP, HTTPS, and other URL formats with real-time highlighting.
Open Regex Tester →URL Regex Patterns
A basic URL regex is
https?:\/\/[^\s/$.?#].[^\s]*. For stricter validation: ^https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&\/=]*)$. URL validation with regex is notoriously tricky — the RFC 3986 URI specification is complex. For production use, consider the URL constructor in JavaScript, which parses and validates according to the spec.URL Validation Approaches
- Regex: Fast for basic pattern matching. Good for input hints, not for security-critical validation.
- URL constructor:
new URL(str)throws on invalid URLs — the most reliable browser-native method. - Libraries: validator.js, is-url, and similar packages handle edge cases like internationalized domain names (IDN).
Always validate URLs server-side before using them in redirects, link previews, or database storage to prevent open redirect vulnerabilities and SSRF attacks.
// Basic URL pattern
/https?:\/\/[^\s/$.?#].[^\s]*/
// Strict URL with protocol
/^https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&\/=]*)$/
// JavaScript - use URL constructor instead
try {
new URL(str); // valid
} catch {
// invalid
}