Regex Cheatsheet for Common Data Extraction
These are simplified, readable versions of the patterns behind DataExtract's own extractors — good enough for most real text, with notes on where each one cuts corners (every one of these has an edge case a fully spec-compliant pattern would need hundreds of characters to handle).
/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/gCatches the vast majority of real addresses including plus-addressing. Doesn't validate that the domain actually exists or accepts mail — it's a shape match, not a deliverability check.
IPv4 address
/\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d?\d)\b/gThe verbose alternation per octet is what keeps this from matching invalid values like 999.999.999.999 — a naive \d{1,3}(\.\d{1,3}){3} would over-match.
UUID
/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/giMatches the shape shared by every UUID version (v1–v5) — it doesn't distinguish between them, since the version only lives in a couple of specific hex digits most casual use doesn't need to check.
MD5 / SHA hash
/\b[a-f0-9]{32}\b/gi // MD5
/\b[a-f0-9]{40}\b/gi // SHA-1
/\b[a-f0-9]{64}\b/gi // SHA-256Hash detection is purely length-based — any hex string of the right length matches, whether or not it's actually a hash of anything. There's no way to distinguish a real hash from an unrelated 64-character hex string in plain text.
CVE ID
/CVE-\d{4}-\d{4,}/giThe MITRE-assigned format is simple enough that this rarely over- or under-matches.
JWT
/eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/gAnchoring on the eyJ prefix (Base64URL for {") is a practical shortcut — every real JWT header starts this way since JWT headers are always a JSON object.
The one that isn't worth memorizing: phone numbers
International phone formats vary enough (country codes, optional parentheses, spacing, extensions) that a single clean regex is a losing battle — real-world extractors combine several alternatives rather than one pattern. If you need this often, use the built-in phone number extractor instead of maintaining your own pattern.
Want to run any of these without writing code? Paste text into DataExtract, or enable the Custom Regex module to test your own pattern against real text (with ReDoS protection built in).
Frequently asked questions
Are these patterns production-ready?
They cover the common real-world shape of each format, not the full formal spec — good enough for extracting from logs, documents and pastes, but not a substitute for format-specific validation libraries in a security-critical path.
Why length-based hash detection instead of something smarter?
There’s no way to tell a hash from an arbitrary hex string of the same length by looking at the text alone — length is the only signal plain-text hash detection has.
Can I test a pattern against my own text?
Yes — DataExtract’s Custom Regex module accepts /pattern/flags, validates it, and screens for catastrophic backtracking before running it.