What regex pattern validates URLs?

^(https?:\/\/)?(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&\/=]*)$ is a widely used practical pattern covering http/https URLs with optional www, paths, queries, and fragments.

Should I require https or allow http too?

For security-sensitive forms (payment, login), require https. For general link input, allow both http and https since many users paste links without thinking about the protocol.

Can regex perfectly validate URLs?

No regex can validate all edge cases of URL syntax as defined by RFC 3986. A regex check is good for basic format validation; for comprehensive URL parsing, use your language's built-in URL parser (e.g. new URL() in JavaScript, urllib.parse in Python).

How do I make the protocol required?

Remove the ? after the protocol group: change ^(https?:\/\/)? to ^https?:\/\/ to make http:// or https:// mandatory.

Does this pattern match URLs without a protocol, like example.com?

Yes. The protocol group is optional. If you want to require a protocol, make that group non-optional as described above.

Browse tools

Free · Fast · Privacy-first

Regex for URL Validation — Pattern, Explanation, and Live Test

A robust URL validation regex needs to handle protocols, domains, paths, query strings, and fragments. FixTools provides a practical URL regex with every part explained — plus a live tester to verify it works for your specific URL formats before adding it to your project.

⚡ Use Tool Now How it works

Cost: Free forever
Sign-up: Not required
Processing: In your browser
Privacy: Files stay local

⚡

Matches http and https URLs

🔒

Handles paths, query strings, and fragments

✨

Optional www and subdomain support

Developer Tool

Regex Tester

All processing happens in your browser — your files are never uploaded to any server.

🚀Open Regex Tester

100% Free · No account · Works on any device

How to use this tool

💡

Test this URL pattern: ^(https?:\/\/)?(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&\/=]*)$ — it matches most common URLs including paths, queries, and fragments.

How It Works

Step-by-step guide to regex for url validation — pattern, explanation, and live test:

1
Use the recommended URL pattern
Start with: ^(https?:\/\/)?(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&\/=]*)$
2
Understand the components
^(https?:\/\/)? matches optional http:// or https://. (www\.)? makes www optional. The domain group matches hostname and TLD. The final group matches optional path, query string, and fragment.
3
Test with valid URLs
Test: https://www.example.com, http://subdomain.example.co.uk/path?query=1#section, and example.com/page.
4
Test with invalid URLs
Verify rejection of: missing TLD (http://localhost), spaces in URL, or malformed protocols (htps://).
5
Adapt for your requirements
If you require https only, change https?:\/\/ to https:\/\/. If a protocol is required, remove the ? making it mandatory.