Regex Cheat Sheet for Form Validation: Email, Phone, ZIP and More

Every form needs a little validation: an email that looks like an email, a ZIP code with the right number of digits, a password that is not "123". Regular expressions are the usual tool. The patterns below are deliberately forgiving: they catch typos and junk without rejecting real people, because every valid customer your form turns away is a lead you never see.

Using a regex in an HTML form

You do not need JavaScript for basic checks. Add a pattern attribute and the browser blocks the submit and shows a message until the value matches:

<input name="zip" inputmode="numeric"
       pattern="\d{5}(-\d{4})?"
       title="5 digit ZIP code, e.g. 94107"
       required>

Two things to know. The browser wraps your pattern as ^(?:pattern)$, so it must match the whole value and you leave out ^ and $. And the title text is shown in the error bubble, so write it as a helpful example, not "Invalid input".

The cheat sheet

Email

^[^\s@]+@[^\s@]+\.[^\s@]{2,}$

Something, an @, something, a dot, at least two characters. That is intentionally loose. The official email grammar allows quotes, plus signs, IP addresses and much more, and "perfect" email regexes are hundreds of characters long and still wrong. Use type="email" in HTML for the same basic check, then confirm the address can receive mail with the email validator or a confirmation email.

Phone number (international)

^\+?[0-9][0-9 ()-]{6,18}[0-9]$

An optional +, then 8 to 20 digits, spaces, brackets or dashes. People type phone numbers in many formats, such as +92 300 1234567, (415) 555-0100 and 0300-1234567, so accept them all and normalise on the server by removing everything except digits and the leading plus.

US ZIP code and other postal codes

US ZIP        ^\d{5}(-\d{4})?$
UK postcode   ^[A-Za-z]{1,2}\d[A-Za-z\d]? ?\d[A-Za-z]{2}$
Canada        ^[A-Za-z]\d[A-Za-z] ?\d[A-Za-z]\d$
Pakistan      ^\d{5}$

Only use a country-specific pattern when the form serves one country. For international forms, accept any short string of letters, digits, spaces and dashes: ^[A-Za-z0-9 -]{3,10}$.

Date (YYYY-MM-DD)

^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$

This checks the shape, not the calendar: it accepts 2026-02-31. For real date input, use <input type="date">, which gives people a date picker and always submits YYYY-MM-DD.

Password strength

^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$

At least 8 characters with a lowercase letter, an uppercase letter and a digit. Each (?=...) is a lookahead that checks for one requirement without consuming characters. Current guidance (NIST 800-63B) actually favours length over character rules, so consider simply .{12,} plus a check against common leaked passwords.

URL

^https?:\/\/[^\s/$.?#].[^\s]*$

Starts with http:// or https:// and contains no spaces. <input type="url"> does a similar check for free.

Username or slug

Username  ^[A-Za-z0-9_]{3,20}$
Slug      ^[a-z0-9]+(?:-[a-z0-9]+)*$

Validating in JavaScript

For custom error messages or live feedback, test the value yourself. Note the ^ and $: in JavaScript the regex is not anchored for you.

const zip = /^\d{5}(-\d{4})?$/;
input.addEventListener('blur', () => {
  input.setCustomValidity(zip.test(input.value.trim()) ? '' : 'Enter a 5 digit ZIP code');
});

Mistakes that cost you submissions

• Rejecting plus signs in emails. [email protected] is valid and common.
• Forcing one phone format. Requiring (xxx) xxx-xxxx blocks every international visitor.
• Forgetting to trim. A pasted value with a trailing space fails a strict pattern. Trim first.
• Blocking non-English names. ^[A-Za-z ]+$ rejects José, Zoë and محمد. Do not validate names with a regex at all.
• Trusting the browser. Anyone can bypass client-side checks. Always validate again where the data arrives.

Where the data arrives

Client-side patterns keep honest typos out, but bots post straight to your endpoint. If your form uses formvoxo as its backend, every submission is still checked on our side: honeypot spam filtering, rate limits and domain whitelisting run before anything reaches your inbox, so your regexes only have to help real people get it right.