Email regex with a live tester

Key facts

Which email regex should I use?

Use the WHATWG pattern from the HTML Standard. It is the rule <input type="email"> applies, so a server check with the same regex agrees with the browser, and it accepts the addresses people actually use: plus-addressing, apostrophes and subdomains. It does not check length, so add the RFC 5321 limits in code: 64 octets before the @ and 254 for the whole address.

The WHATWG regex is copied verbatim from the HTML Standard. The RFC 5322-style pattern was written for this page from the section 3.4.1 grammar, without comments, folding whitespace or obsolete syntax.

What regex does input type=email use?

<input type="email"> uses the "valid email address" rule from the HTML Standard. The rule allows letters, digits and .!#$%&'*+/=?^_`{|}~- before the @, and hostname labels of up to 63 characters after it, and it does not require a dot in the domain, so test@localhost is valid. The standard gives this JavaScript-compatible regex for it: /^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/

Which addresses does each pattern accept?

This matrix runs 16 edge cases through what type="email" accepts when the value is typed, the three raw regexes, and the RFC 5321 length limits. It is generated from the same code as the tester above.

Browser column: what a person sees when typing the value into <input type="email"> in Chromium 152, verified on October 2, 2026. The browser trims surrounding spaces and converts an IDN domain such as bücher.de to punycode (xn--bcher-kva.de) before applying the WHATWG rule, so it can accept input the raw regex rejects. Setting input.value from JavaScript skips the punycode step, and other browsers can differ on IDN.

• The WHATWG rule accepts [email protected] and [email protected], which RFC 5322 does not allow, and test@localhost, which can't receive mail from the internet.
• The simple pattern accepts [email protected] and [email protected]., which browsers reject: a domain label can't start with a hyphen, and the WHATWG rule allows no trailing dot.
• No regex here enforces the 64-octet limit before the @: the 65-character case passes all three.

How do I use the email regex in HTML, JavaScript, Python and PHP?

Use type="email" in HTML and the same WHATWG rule on the server: RegExp.test in JavaScript, re.fullmatch in Python, and filter_var in PHP, which needs no regex. Trim the value first, as browsers do, and check the RFC 5321 lengths in code. For client-side error messages, see how to validate an HTML form with JavaScript.

<!-- type="email" already applies the WHATWG rule. The pattern adds one
     more: a dot after the @, so test@localhost is rejected. -->
<label for="email">Email</label>
<input id="email" type="email" name="email" autocomplete="email"
       required maxlength="254"
       pattern="[^@\s]+@[^@\s]+\.[^@\s]+"
       title="Enter an address like [email protected]">

<!-- For a type="text" field. The raw WHATWG regex does not compile with
     the v flag browsers use for pattern, so { | } and - are escaped. -->
<input type="text" name="email" inputmode="email" autocomplete="email"
       pattern="[a-zA-Z0-9.!#$%&'*+\/=?^_`\{\|\}~\-]+@[a-zA-Z0-9](?:[a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?)*">

const EMAIL_RE =
  /^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;

function isValidEmail(value) {
  const email = value.trim();
  const local = email.slice(0, email.lastIndexOf("@"));
  return email.length <= 254 && local.length <= 64 && EMAIL_RE.test(email);
}

import re

EMAIL_RE = re.compile(
    r"[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*"
)

def is_valid_email(value: str) -> bool:
    email = value.strip()
    local, _, _ = email.rpartition("@")
    return (
        len(email) <= 254
        and len(local) <= 64
        and EMAIL_RE.fullmatch(email) is not None
    )

<?php
function is_valid_email(string $value): bool
{
    return filter_var(trim($value), FILTER_VALIDATE_EMAIL) !== false;
}

Why doesn't the email regex work in a pattern attribute?

Browsers compile pattern with the RegExp v flag, and the raw WHATWG regex is invalid under it: inside a character class the v flag requires { } | and - to be escaped, so compiling it throws a SyntaxError ("Invalid character in character class" in Chromium). The HTML Standard says a pattern that fails to compile is ignored, so the field enforces nothing extra and shows no error. Escape those four characters, as in the HTML snippet on this page, and paste your pattern into the tester, which reports whether it compiles with v.

Why not use a full RFC 5322 email regex?

Because RFC 5322 describes message headers, not what a sign-up form should accept. Its addr-spec grammar (section 3.4.1) allows quoted local parts with spaces, bracketed domain literals and domains such as a bare hyphen, yet rejects [email protected], which browsers accept. Length limits come from RFC 5321, so no RFC 5322 regex enforces them either. The HTML Standard calls its own email rule a "willful violation of RFC 5322" for these reasons.

What is the maximum length of an email address?

254 octets, which is 254 characters for an ASCII address. RFC 5321 caps a path at 256 octets including the angle brackets around the address, leaving 254, and caps the part before the @ at 64 octets. RFC 1034 limits each domain label to 63 characters. The WHATWG regex enforces the 63-character label limit but not the 64 or 254 limits, so check those in code.

Does input type=email accept international (IDN) domains?

Yes, when a person types one. Chromium converts the domain to punycode before validating, so jane@bücher.de becomes [email protected] and passes (verified in Chromium 152 on October 2, 2026). The raw WHATWG regex rejects the Unicode form, and setting input.value from JavaScript skips the conversion, so validate the punycode value on the server. Unicode before the @, as in jösé@example.com, is rejected.

Does an email regex check that the address exists?

No: a regex checks shape, not deliverability. It can't tell whether the domain accepts mail, whether the mailbox exists, or whether gmial.com was meant to be gmail.com. The only proof an inbox exists is a message it receives, such as a confirmation link. The Check addresses tab on this page adds typo, disposable-domain and role-address checks, all run in your browser.

What each check means

Email validation vs verification

More email regex questions

Sources

• HTML Standard: valid email address and the pattern attribute
• RFC 5322 §3.4.1, addr-spec
• RFC 5321 §4.5.3.1, size limits
• MDN: <input type="email"> and RegExp v flag
• PHP manual: FILTER_VALIDATE_EMAIL
• Python docs: re.fullmatch

Related

• Phone number regex tester: the same treatment for phone numbers.
• HTML input reference: every input type, including email, in a working form.
• Server-side form validation: re-check what the browser already checked.
• How to validate an HTML form with JavaScript: custom error messages and the Constraint Validation API.
• How to stop contact form spam: honeypots, time-traps and content rules together.
• All free form tools