Email Address Validation
A standard regex pattern to validate most common email address formats.
/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/How it works
This pattern ensures that an email address contains an alphanumeric prefix (which can include dots, underscores, percents, and plus signs), followed by an '@' symbol, a domain name, a dot, and a top-level domain of at least 2 characters.
Test Cases
Should Match
- user@example.com
- firstname.lastname@domain.co.uk
- email+filter@example.com
Should NOT Match
- plainaddress
- @missingusername.com
- username@.com
Quick Summary
Validates that a string follows the standard email format: local-part@domain.tld. Covers the vast majority of real-world email addresses but intentionally skips edge cases from RFC 5322 that are rarely used in practice.
Key Takeaways
- Matches local-part@domain.tld with alphanumeric local parts including dots, underscores, percent, plus, and hyphens
- Requires a TLD of at least 2 characters, covers .com, .io, .co.uk, etc.
- Does NOT validate whether the email address actually exists, only that it is syntactically plausible
- For strict RFC 5322 compliance, use a dedicated email validation library instead
When to use it
- Form input validation before submitting to a backend
- Filtering user-submitted data for obviously invalid addresses
- Quick sanity checks in CLI scripts or data pipelines
Common Mistakes
- Assuming this regex guarantees deliverability, it does not; use SMTP verification for that
- Forgetting the ^ and $ anchors, which allows partial matches inside longer strings
- Using this in a security context to block malicious input, email validation is not a security control
Email Address Validation, Frequently Asked
Does this match all valid RFC 5322 emails?
No. RFC 5322 allows quoted strings, comments, and IP literals in email addresses. This pattern covers the 99%+ of real-world addresses and is intentionally simpler.
Should I validate email on the client or server?
Both. Client-side validation improves UX; server-side validation is the security gate. Never rely solely on client-side regex.
How do I also check if the email domain exists?
Use a DNS MX record lookup or a third-party email verification API, regex cannot check DNS.