Email regex: copy-ready patterns that actually work

01Copy-ready email regex

Pattern	Use it when
^\S+@\S+$	Simple. A quick sanity check, such as filtering logs or a search box.
^[^\s@]+@[^\s@]+\.[^\s@]+$	Practical (our pick). Sign-up and contact forms: every real address passes, common typos don't.
^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$	Strict. You need to accept exactly what a browser's type="email" field accepts.

Try any of them on your own addresses in the Playground, or practise on the Format validators pack. The rest of this post explains why the practical one is the right default.

Search for "email regex" and you'll find patterns of every size, from ten characters to several thousand. People have tried to encode the full email standard in one regular expression, and the results are famously unreadable.

The good news: you don't need any of that. Below are the pattern we recommend, why stricter patterns cause more trouble than they prevent, and what to do instead. Every example is live, so edit the patterns and see what changes.

02Why a "perfect" email regex doesn't exist

The email address format allows far more than most people expect. All of these are valid:

• x+newsletter@site.io (a plus tag, used to filter mail)
• j.doe@mail.co.uk (a subdomain and a two-part country ending)
• ana@studio.photography (a long top-level domain)
• josé@exemplo.com.br (non-English letters, supported by mail servers that handle international addresses)

And a pattern can't tell you whether an address exists. ana@example.com has a perfect shape and still might bounce. The only real check is sending a message and asking the person to click a link.

So the job of a regex is smaller than it looks: catch obvious typos before you send that message.

03The pattern we recommend

Read it in four parts:

1. ^[^\s@]+ one or more characters that aren't whitespace or @
2. @ exactly one at sign
3. [^\s@]+\. a domain name, then a literal dot
4. [^\s@]+$ the rest of the domain, to the end

It's short, it's readable, and it doesn't reject anyone with a real address.

04Mistake 1: forgetting the anchors

Without ^ and $, a regex only needs to find an email-shaped piece somewhere in the text:

05Mistake 2: being too strict

The most common email patterns online look like this one. It seems careful, and it locks out real people:

It fails three ways at once:

• \w+ before the dot allows only one domain part, so mail.co.uk fails.
• [\w.] has no +, so plus-tagged addresses fail.
• [a-z]{2,4} assumes top-level domains are short. Hundreds are longer: .photography, .software, .museum.

Even a more careful version, ^[\w.+-]+@[\w-]+(\.[\w-]+)+$, still rejects josé@exemplo.com.br, because \w only covers English letters in most engines. A rejected real address is a lost signup. A typo that slips through gets caught by the confirmation email anyway.

06What browsers use

HTML's <input type="email"> checks addresses with its own pattern, published in the HTML standard:

If you use type="email" on a form, the browser already runs this check for you. That's usually enough for the front end.

07A regex golf version

Validation and golf have different goals. A validator has to be safe on any input. A golf board only has to separate these words, so you can look at the smallest difference.

Every monster below has a letter right before the @ and a dot somewhere after it. Each innocent breaks one of those rules:

08Checklist

• Use ^[^\s@]+@[^\s@]+\.[^\s@]+$ or the browser's type="email".
• Always anchor with ^ and $ when validating a whole input.
• Don't limit top-level domains to 2 to 4 letters.
• Don't reject +, extra dots in the domain, or non-English letters.
• Send a confirmation email. It's the only test that proves the address works.

09Keep practising

• The guide has a section of common patterns with live examples.
• Try today's hunt.