Regex for IPv4 Addresses

Read it left to right. Each piece below matches one part of the input:

• 25[0-5] 250 to 255.
• |2[0-4]\d or 200 to 249.
• |1\d\d or 100 to 199.
• |[1-9]?\d or 0 to 99, with no leading zero (so 01 and 007 fail).
• (?:…\.){3} Three octets, each followed by a dot.
• (?:…)$ The fourth octet, then the end of the string.

The whole input must match, from the first character to the last. Every row below is checked against the pattern by our automated test suite before each release.

Because different software reads them differently. In the classic BSD inet_aton behavior (still followed by some libraries and by ping on many systems), 010.0.0.1 is octal and means 8.0.0.1. Other parsers treat it as decimal 10. That ambiguity has caused real security bugs in allow-lists and SSRF filters, which is why modern parsers such as Python's ipaddress (since 3.9.5) reject leading zeros outright.

This pattern follows the strict rule: each octet is 0 or a number without a leading zero. If you must accept legacy input, normalize it explicitly instead of loosening the regex.

A regex can do it, but a parser is clearer and tracks the official registry. In Python, ipaddress.ip_address(s).is_private; in Go, netip.ParseAddr(s) and addr.IsPrivate(); in Node.js, net.isIPv4(s) for the format plus a CIDR check.

Blocking these ranges matters when your server fetches user-supplied URLs.

The pattern is translated for each engine rather than pasted as is: named groups, anchors, escapes, shorthand classes and flags are adjusted so each snippet behaves as closely to the JavaScript version as its engine allows. Differences that remain (Go's RE2 has no lookarounds or backreferences, for example) are called out under each one. The Code tab in the tester above also exports Dart, and updates as you edit the pattern.

JavaScript and TypeScript

const regex = /^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/;

function isValid(value) {
  return regex.test(value);
}

console.log(isValid("192.168.1.1"));

Python

import re

pattern = re.compile(r"^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\Z")

def is_valid(value: str) -> bool:
    return pattern.search(value) is not None

print(is_valid("192.168.1.1"))

• \d and \w are written as [0-9] and [A-Za-z0-9_] because in Python they also match digits and letters from other scripts.
• JavaScript's $ only matches at the very end of the string. Python's $ also matches before a trailing newline, so the pattern uses \Z instead.

Go

package main

import (
	"fmt"
	"regexp"
)

func main() {
	re := regexp.MustCompile(`^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$`)
	fmt.Println(re.MatchString("192.168.1.1"))
}

C#

using System;
using System.Text.RegularExpressions;

// The timeout stops a pathological input from hanging the thread (ReDoS).
var regex = new Regex(@"^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\z", RegexOptions.None, TimeSpan.FromSeconds(1));
Console.WriteLine(regex.IsMatch("192.168.1.1"));

• \d and \w are written as [0-9] and [A-Za-z0-9_] because in .NET they also match digits and letters from other scripts.
• JavaScript's $ only matches at the very end of the string. .NET's $ also matches before a trailing newline, so the pattern uses \z instead.

PHP

<?php

$pattern = '/^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/D';

function isValid(string $value, string $pattern): bool
{
    return preg_match($pattern, $value) === 1;
}

var_dump(isValid('192.168.1.1', $pattern));

• The D modifier makes $ match only at the very end, like JavaScript (PCRE's $ also matches before a trailing newline).

• Regex for IPv6 Addresses: Eight hextets, or fewer with a single :: compression, like 2001:db8::1.
• Regex for MAC Addresses: Six hex pairs with consistent : or - separators, or Cisco's dotted form.
• Regex for Domain Names: Hostnames with valid labels, a 253-character limit and Punycode support.
• Regex for URL Validation: http and https links with a real domain, optional port, path, query and fragment.

Browse all 25 patterns in the regex pattern library, or build your own in the regex tester.