Visa
Visa: 13 or 16 digits. Run Luhn separately.
\b4\d{12}(?:\d{3})?\b
4111111111111111
Regex patterns for DLP
Pick regular expressions to teach your DLP to detect sensitive formats (SSN, IBAN, passport-shaped fields, cards, secrets). Three engines are available: ECMAScript (JavaScript), RE2 / Go, and PCRE2 — so you can see how the same rule behaves across products. Everything runs in your browser.
Synthetic / format only. Patterns do not validate checksums (Luhn, IBAN MOD-97, TFN, NRIC, Aadhaar) — use the generator for that. Below — ready templates: click a card to load it into the tester. After tuning a rule, prove the channel with HTTPS POST or FTP.
| # | Match | Position | Groups |
|---|
Pattern breakdown
The pattern is split into tokens: classes, quantifiers, groups, lookaround. Breakdown depends on the engine — ECMAScript/PCRE2 constructs may be unavailable in RE2.
DLP pattern library
61 ready templates for DLP rules — US / EU / APAC PII, payment cards, secrets, network, healthcare. Click a card to load the expression and sample into the tester above. This checks format (length, separators, prefixes), not SSN/IBAN checksums or Luhn — use the generator for those, or grab a fixed pack from the sample library. Examples are synthetic only.
Showing 61 of 61
No patterns found.
Mastercard
Mastercard: 16 digits (51–55 range). Run Luhn separately.
\b5[1-5]\d{14}\b
5500005555555559
American Express
American Express: 15 digits. Run Luhn separately.
\b3[47]\d{13}\b
340000000000009
Discover
Discover: 16 digits. Run Luhn separately.
\b6(?:011|5\d{2})\d{12}\b
6011000000000004
Major card brands (Visa/MC/Amex/Discover/JCB/Diners)
One pattern for Visa, Mastercard, Amex, Discover, JCB, and Diners.
\b(?:4\d{12}(?:\d{3})?|5[1-5]\d{14}|3[47]\d{13}|3(?:0[0…
4111111111111111
Card grouped by 4
Payment card with spaces or dashes every 4 digits.
\b\d{4}[ -]\d{4}[ -]\d{4}[ -]\d{4}\b
4111 1111 1111 1111
Amex with spaces
American Express in 4-6-5 grouped format.
\b3[47]\d{2}[- ]\d{6}[- ]\d{5}\b
3782 822463 10005
Labeled CVV
CVV or CVV2 near a short digit run.
\bCVV2?:?\s*\d{3,4}\b
CVV: 123
IBAN
IBAN format. Validate MOD-97 outside the regex.
\b[A-Z]{2}\d{2}[A-Z0-9]{4}\d{7}([A-Z0-9]?){0,16}\b
GB82WEST12345698765432
SWIFT / BIC
SWIFT/BIC code: 8 or 11 characters.
\b[A-Z]{6}[A-Z0-9]{2}([A-Z0-9]{3})?\b
DEUTDEFF500
Bitcoin address
Bitcoin address (legacy or bech32).
\b[13][a-km-zA-HJ-NP-Z1-9]{25,34}\b|\bbc1[a-z0-9]{39,59…
1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa
Ethereum address
Ethereum address: 0x plus 40 hex digits.
\b0x[a-fA-F0-9]{40}\b
0x52908400098527886E0F7030069857D2E4169EE7
US SSN (validated areas)
US SSN with invalid area/group/serial rejected. Format check only — not a live registry.
\b(?!000)(?!666)(?!9\d{2})\d{3}[\s-](?!00)\d{2}[\s-](?!…
123-45-6789
US SSN with label
SSN near an SSN label. Works in RE2.
\bSSN:?\s*\d{3}-?\d{2}-?\d{4}\b
SSN: 123-45-6789
US phone
US phone: optional +1, area code starting 2–9.
(?:\+?1[-.\s]?)?(?:\([2-9]\d{2}\)[-.\s][2-9]\d{2}[-.\s]…
(415) 555-2671
US ITIN
US Individual Taxpayer Identification Number (ITIN).
\b9\d{2}-?[78]\d-?\d{4}\b
912-78-1234
US EIN with label
EIN near EIN, FEIN, or Tax ID label.
\b(?:EIN|FEIN|Tax ID):?\s*\d{2}-\d{7}\b
EIN: 12-3456789
Vehicle VIN
VIN: 17 characters excluding I, O, and Q.
\b[A-HJ-NPR-Z0-9]{17}\b
1HGBH41JXMN109186
UK National Insurance number
UK National Insurance Number (NINO).
\b[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z]\d{6}[A-D]\b
AB123456C
Canada SIN
Canadian SIN format. Check digit not validated here.
\b\d{3}[- ]?\d{3}[- ]?\d{3}\b
046-454-286
IN Aadhaar
Aadhaar format: 12 digits, not starting with 0 or 1.
\b[2-9]\d{3}\s\d{4}\s\d{4}\b|\b[2-9]\d{11}\b
2234 5678 9012
IN PAN
Indian Permanent Account Number format.
\b[A-Z]{5}\d{4}[A-Z]\b
ABCDE1234F
Brazil CPF
Brazilian CPF with separators or 11 plain digits.
\b\d{3}\.\d{3}\.\d{3}-\d{2}\b|\b\d{11}\b
123.456.789-09
Italy Codice Fiscale
Italian tax code, 16 characters.
\b[A-Z]{6}\d{2}[A-Z]\d{2}[A-Z]\d{3}[A-Z]\b
RSSMRA85T10A562S
AWS access key
AWS access key id with common prefixes (AKIA, ASIA, …).
\b(?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASI…
AKIAIOSFODNN7EXAMPLE
GitHub token (ghp_)
Classic GitHub PAT with ghp_ prefix.
\bghp_[A-Za-z0-9]{36}\b
ghp_1234567890abcdefghijklmnopqrstuvwxyz
GitHub fine-grained token
GitHub token with github_pat_ prefix.
\bgithub_pat_[A-Za-z0-9_]{22,}\b
github_pat_11ABCDEFG0abcdefghijkl
GitLab token
GitLab PAT with glpat- prefix.
\bglpat-[A-Za-z0-9_-]{20}\b
glpat-12345678901234567890
Slack token
Slack token (xoxb-, xoxp-, …).
\bxox[baprs]-[A-Za-z0-9-]{10,48}\b
xoxb-123456789012-abcdefghijkl
Google API key
Google API key with AIza prefix.
\bAIza[0-9A-Za-z_-]{35}\b
AIzaSyAbCdEfGhIjKlMnOpQrStUvWxYz0123456
Stripe key
Stripe sk_, pk_, or rk_ (live or test).
\b(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{24,}\b
sk_test_0123456789abcdefghijABCD
OpenAI-style key
sk-… style key. May overlap Stripe without live/test cues.
\bsk-[A-Za-z0-9]{32,}\b
sk-abcdefghijklmnopqrstuvwxyz123456
JWT
JWT with three base64url segments.
\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U
PEM private key header
BEGIN … PRIVATE KEY PEM header.
-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----
-----BEGIN RSA PRIVATE KEY-----
Bearer header
Authorization: Bearer …
\bBearer\s+[A-Za-z0-9._-]{10,}\b
Bearer abcdef1234567890
Basic auth header
Authorization: Basic …
\bBasic\s[A-Za-z0-9+/]{16,}={0,2}
Basic dXNlcjpwYXNzd29yZA==
Credentials in URL
user:password@host inside a URL.
\b[a-z]+://[^:@\s]+:[^@\s]+@[^\s/]+
https://admin:secret@example.com
npm token
npm token with npm_ prefix.
\bnpm_[A-Za-z0-9]{36}\b
npm_123456789012345678901234567890123456
Twilio Account SID
Twilio Account SID: AC + 32 hex digits.
\bAC[a-f0-9]{32}\b
AC0123456789abcdef0123456789abcdef
Slack webhook
Incoming Slack webhook URL.
https://hooks\.slack\.com/services/[A-Z0-9]{9}/[A-Z0-9]…
https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX
SendGrid key
SendGrid key shaped SG.xxx.yyy.
\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b
SG.abcdefghijklmnopqrstuv.0123456789abcdefghij0123456789abcdefghijklm
Shopify token
Shopify Admin API token with shpat_ prefix.
\bshpat_[a-fA-F0-9]{32}\b
shpat_1234567890abcdef1234567890abcdef
Telegram bot token
Telegram bot token: numeric id + secret.
\b\d{8,10}:[A-Za-z0-9_-]{35}\b
123456789:ABCdefGHIjklMNOpqrSTUvwxYZ123456789
Discord bot token
Discord bot token (three segments).
\b[A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27…
NzkyNzE1NDk0NzI0MzE1ODU4.X-hvzA.Ovy4MCQywSkoMRRclStW4xAYK7I
Docker Hub token
Docker Hub PAT with dckr_pat_ prefix.
\bdckr_pat_[A-Za-z0-9_-]{22,}\b
dckr_pat_1234567890abcdefghijklmnop
MongoDB URI with credentials
MongoDB connection string with user/password.
mongodb(?:\+srv)?://[^\s@]+:[^\s@]+@[^\s/]+
mongodb://user:password@cluster.mongodb.net
JDBC URL
JDBC connection URL.
\bjdbc:[a-z]+://[^\s]+
jdbc:mysql://localhost:3306/db
IPv4
IPv4 with octets 0–255.
\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d?\d)\.){3}(?:25[0-5]|2[…
192.168.1.1
Private IPv4
RFC 1918 private IPv4 (10/8, 172.16/12, 192.168/16).
\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\…
192.168.1.100
MAC address
MAC address with : or - separators.
\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b
00:1B:44:11:3A:B7
UUID v1–v5
UUID versions 1–5. Not a secret by itself.
\b[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-…
550e8400-e29b-41d4-a716-446655440000
AWS ARN
Amazon Resource Name (arn:aws:…).
\barn:aws:[a-z0-9-]+:[a-z0-9-]*:\d{12}:[A-Za-z0-9\-_/:.…
arn:aws:iam::123456789012:user/Bob
S3 URI
S3 object URI (s3://bucket/…).
\bs3://[a-z0-9.-]+/[^\s]*
s3://my-bucket/path/file.txt
HTTP(S) URL
Simple http/https URL without credentials.
https?://[^\s]+
https://example.com/path?id=1
Labeled MRN
Medical record number near MRN, MR, or RECORD.
\b(?:MRN|MR|RECORD)[:\s-]?\d{6,10}\b
MRN:1234567
ICD-10 code
ICD-10 diagnosis code.
\b[A-TV-Z][0-9][0-9AB](?:\.[0-9A-TV-Z]{1,4})?\b
J45.909
NDC drug code
US National Drug Code (NDC).
\b\d{4,5}-\d{3,4}-\d{1,2}\b
12345-6789-01
DEA number
DEA registration number: two letters + six digits. Check digit not validated.
\b[A-Z]{2}\d{7}\b
AB1234567
US ABA routing
9-digit US ABA routing number (format only; pair with context).
\b\d{9}\b
AU Tax File Number
Australian TFN length pattern (apply checksum in policy engine).
\b\d{8,9}\b
SG NRIC/FIN
Singapore NRIC/FIN with prefix and check letter.
\b[STFG]\d{7}[A-Z]\b
Why regex still matters for DLP
Policies often start from structure: SSN with separators, IBAN length and country code, a card BIN. Once detection is stable, you can add alerts or blocks. Prefer a fixed sample file from the sample library when you need a repeatable pilot artifact.
FAQ
How do ECMAScript, RE2, and PCRE2 differ?
ECMAScript is browser JavaScript: lookahead/lookbehind, backreferences, and sticky flags. Closest to many cloud DLP and endpoint agents. RE2 (as in Go) runs in linear time and does not support lookaround or backreferences. PCRE2 is closer to Python re and PHP preg_*; it is not .NET Regex.
Does my text or pattern leave the browser?
No. Matching runs locally. “Copy link” stores the pattern and flags in the URL hash after # — that fragment is not sent to the server.
How should I use these regex templates?
They are format detectors for DLP rules: SSN, IBAN, cards, secrets, network. A template catches shape — separators, length, prefixes. Examples are synthetic; copy carefully into production and watch false positives.
Why does a lookbehind fail in RE2?
RE2 has no lookbehind, lookahead, or backreferences — by design, to avoid catastrophic backtracking. If your DLP claims RE2 or Go, rewrite those pieces with character classes and anchors. The RE2 tab here uses the re2js port, not Google’s native binary.
Can a regex template block a data channel?
This page only shows whether a pattern matches text. Blocking the channel is decided by your DLP product and policy.
Verify leak channels
The tester shows whether a pattern matches text. To confirm DLP stops a transfer, send synthetic data through a live channel.