URL Regex Validator
URL validation is useful when a form requires a link and the application needs quick feedback before saving. Regex can check a simple shape, but a platform URL parser should still handle real URL interpretation.
Open the Formalint Regex Matcher to test this URL pattern with your data.
HTTP and HTTPS URL Regex
^https?:\/\/[^\s/$.?#].[^\s]*$This pattern requires http or https, then allows a non-space URL body. It is intentionally practical rather than exhaustive. It catches missing protocols and spaces, which are common input mistakes.
Test Values
https://formalint.com/
http://example.com/path?x=1
example.com
ftp://example.com
https://bad url.com
https://example.com/docs#sectionTest links with paths, query strings, fragments, local-looking hosts and internationalized domains if those appear in your product. A regex that is too strict can reject URLs that browsers and APIs handle correctly.
Use Regex Before a Parser
A good workflow is regex first for friendly UI feedback, then the JavaScript URL constructor or a server-side parser for canonical parsing. The parser can normalize hosts, read query parameters and reject malformed edge cases more reliably than a hand-written expression.
Security Notes
Valid URL shape does not mean safe destination. For redirects, webhooks or callback URLs, review allowed protocols, private IP ranges, localhost access and domain allowlists. URL validation should not become an open redirect or server-side request forgery risk.
Implementation Checklist
Trim the value, require a protocol when your workflow needs one and reject spaces before passing the value to a parser. If the URL is stored for later crawling or webhook delivery, validate it again on the server and log why it was rejected.
When accepting user-provided URLs, decide whether localhost, private network ranges, file URLs and non-HTTP protocols are allowed. Many applications should reject them even if the string is technically parseable.
Common URL Regex Mistakes
Do not try to encode every valid URL rule into one expression. Internationalized domains, encoded paths and query strings quickly make the pattern hard to maintain. Use regex to catch obvious form mistakes, then use a real URL parser for interpretation.
Frequently Asked URL Regex Questions
Should example.com without a protocol be accepted? That depends on your product. If the system will open the link directly, requiring http or https removes ambiguity.
Can regex prevent phishing links? No. Regex checks format, not reputation or intent. Phishing defense needs domain review, user interface warnings and security controls outside the pattern.
Related Formalint Pages
Use URL Encoder and Decoder for percent-encoded strings, Regex Examples for more patterns and API Debugging Checklist for request troubleshooting.