Free tool
DLP regex tester
Test detection patterns against sample data, with 50 regular expressions already written for the data types DLP policies actually target — cards, API keys, PII and PHI. Runs entirely in your browser: no account, no upload, nothing logged.
Nothing you type here leaves your browser. Matching runs locally in a sandboxed worker — there is no request to a server, no logging, and no account required. Still, prefer the sample data below over real production values.
Matching…
DLP pattern library
50 patterns used in real DLP policies. Click one to load it with sample data.
Why this one
A regex tester that knows what a DLP engine has to survive.
Nothing leaves the browser
Matching runs in a local sandboxed worker. There is no server call, so pasting a sample record doesn't put it in someone else's logs — the reason generic online testers are a poor fit for this work.
Catches patterns that hang
Runs are killed after NaN seconds. A pattern that trips catastrophic backtracking here is a pattern that will hurt an inline engine inspecting live traffic — better to find that at design time than in production.
Real DLP patterns, not toys
50 patterns across 7 categories — payment data, credentials and secrets, personal identity, health identifiers, network and enterprise records — each with sample data that matches.
Reference
All 50 DLP regex patterns
The complete library, grouped by data type. Click any pattern in the tool above to load it with matching sample data, or copy an expression straight from here.
Payment & Banking
11 patterns
| Pattern | What it matches | Regular expression |
|---|---|---|
| Visa Card | Visa credit/debit card numbers (13 or 16 digits) | \b4[0-9]{12,15}\b |
| Mastercard | Mastercard numbers (51–55 series, 16 digits) | \b5[1-5][0-9]{14}\b |
| American Express | Amex card numbers starting with 34 or 37 | \b3[47][0-9]{13}\b |
| Discover Card | Discover card numbers (16 digits, 6xxx prefix) | \b6[0-9]{15}\b |
| Any Credit Card | Visa, Mastercard, Amex, Discover — broad 13-19 digit card match | \b[3-6][0-9]{13,18}\b |
| US Routing Number | ABA bank routing numbers (9 digits) | \b[0-9]{9}\b |
| UK Sort Code | UK bank sort codes (XX-XX-XX) | \b[0-9]{2}[-\s][0-9]{2}[-\s][0-9]{2}\b |
| SWIFT / BIC | SWIFT/BIC bank identifier codes (8 or 11 chars) | \b[A-Z]{4}[A-Z]{2}[A-Z0-9]{2}([A-Z0-9]{3})?\b |
| IBAN | International Bank Account Numbers (2-letter country code + digits) | \b[A-Z]{2}[0-9]{2}[A-Z0-9]{4,30}\b |
| Bitcoin Address | Bitcoin wallet addresses (P2PKH and P2SH) | \b[13][a-km-zA-HJ-NP-Z1-9]{25,34}\b |
| Ethereum Address | Ethereum wallet addresses (0x + 40 hex chars) | \b0x[a-fA-F0-9]{40}\b |
Personal Identity
9 patterns
| Pattern | What it matches | Regular expression |
|---|---|---|
| US SSN | US Social Security Numbers (NNN-NN-NNNN) — edge-case prefixes 000/666/9xx may match | \b[0-9]{3}-[0-9]{2}-[0-9]{4}\b |
| US EIN | US Employer Identification Numbers (NN-NNNNNNN) | \b[0-9]{2}-[0-9]{7}\b |
| US ITIN | US Individual Taxpayer Identification Numbers (starts with 9) | \b9[0-9]{2}[- ][0-9]{2}[- ][0-9]{4}\b |
| Indian Aadhaar | 12-digit Indian national ID | \b[2-9][0-9]{3}\s?[0-9]{4}\s?[0-9]{4}\b |
| Indian PAN | Indian Permanent Account Number (income tax) | \b[A-Z]{5}[0-9]{4}[A-Z]\b |
| UK NI Number | UK National Insurance numbers | \b[A-CEGHJ-PR-TW-Z]{2}[0-9]{6}[A-D]\b |
| UK NHS Number | UK National Health Service numbers | \b[0-9]{3}\s[0-9]{3}\s[0-9]{4}\b |
| Passport Number | Generic alphanumeric passport numbers (1-2 letters + 6-7 digits) | \b[A-Z]{1,2}[0-9]{6,7}\b |
| Date of Birth | Dates in MM/DD/YYYY, DD/MM/YYYY, or YYYY-MM-DD format | \b[0-9]{1,2}[\/-][0-9]{1,2}[\/-][0-9]{2,4}\b |
Contact & Location
10 patterns
| Pattern | What it matches | Regular expression |
|---|---|---|
| Email Address | Standard email addresses | [a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,} |
| US Phone | US/Canada phone numbers (various formats) | \b[+]?1?[\s.-]?[2-9][0-9]{2}[\s.-]?[2-9][0-9]{2}[\s.-]?[0-9]{4}\b |
| UK Phone | UK landline and mobile numbers | \b(\+44\s?|0)[0-9]{4}\s?[0-9]{3}\s?[0-9]{3,4}\b |
| Int'l Phone (E.164) | International phone numbers in E.164 format | \+[1-9][0-9]{6,14}\b |
| IPv4 Address | IPv4 addresses — broad match, may include invalid octets above 255 | \b[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\b |
| IPv6 Address | Full IPv6 addresses (8 colon-separated hex groups) | \b[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}\b |
| MAC Address | Network hardware MAC addresses (colon or hyphen separated) | \b[0-9A-Fa-f]{2}[:\-][0-9A-Fa-f]{2}[:\-][0-9A-Fa-f]{2}[:\-][0-9A-Fa-f]{2}[:\-][0-9A-Fa-f]{2}[:\-][0-9A-Fa-f]{2}\b |
| US ZIP Code | US 5-digit and ZIP+4 postal codes | \b[0-9]{5}(-[0-9]{4})?\b |
| UK Postcode | UK postal codes | \b[A-Z]{1,2}[0-9][0-9A-Z]?\s?[0-9][ABD-HJLNP-UW-Z]{2}\b |
| Canadian Postal Code | Canadian postal codes (A1A 1A1 format) | \b[ABCEGHJ-NPRSTVXY][0-9][ABCEGHJ-NPRSTV-Z]\s?[0-9][ABCEGHJ-NPRSTV-Z][0-9]\b |
Credentials & Secrets
10 patterns
| Pattern | What it matches | Regular expression |
|---|---|---|
| AWS Access Key | AWS Access Key IDs (AKIA/ASIA prefix) | \b(AKIA|ABIA|ACCA|ASIA)[0-9A-Z]{16}\b |
| AWS Secret Key | AWS secret access keys in config/env files | (aws[_-]?secret[_-]?access[_-]?key|AWS_SECRET_ACCESS_KEY)[^=:\s]*[=:\s]+[A-Za-z0-9\/+=]{40} |
| GitHub PAT | GitHub classic personal access tokens (ghp_) | \bghp_[A-Za-z0-9]{36}\b |
| Stripe Secret Key | Stripe live and test secret API keys | \bsk_(live|test)_[A-Za-z0-9]{24,}\b |
| Google API Key | Google Cloud/Maps/Firebase API keys (AIza prefix) | \bAIza[0-9A-Za-z\-_]{35}\b |
| Slack Token | Slack bot and user OAuth tokens (xoxb/xoxp) | \bxox[baprs]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[0-9a-f]{32}\b |
| Bearer Token / API Key | Authorization headers and inline API key assignments | (Bearer\s+|api[_-]?key[=:\s]+|token[=:\s]+)[A-Za-z0-9\-_=+\/]{20,} |
| JWT Token | JSON Web Tokens (three Base64URL-encoded segments) | \beyJ[A-Za-z0-9\-_]+\.eyJ[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_.+\/]* |
| PEM Private Key | RSA/EC/DSA/OpenSSH private key headers | -----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY----- |
| Database URL | Database connection strings with embedded credentials | (mysql|postgresql|postgres|mongodb|redis|mssql|sqlserver):\/\/[^\s"'<>]+ |
Network & Technical
4 patterns
| Pattern | What it matches | Regular expression |
|---|---|---|
| HTTPS URL | HTTP and HTTPS web URLs | https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&\/=]*) |
| IPv4 CIDR Range | IPv4 addresses with CIDR subnet mask (e.g. /24) | \b[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/[0-9]{1,2}\b |
| UUID / GUID | Universally unique identifiers (v1–v5) | \b[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\b |
| Semantic Version | SemVer version numbers (MAJOR.MINOR.PATCH with optional pre-release) | \bv?[0-9]+\.[0-9]+\.[0-9]+(-[0-9a-zA-Z\-]+)?\b |
Healthcare
3 patterns
| Pattern | What it matches | Regular expression |
|---|---|---|
| US NPI Number | National Provider Identifier (10 digits) | \bNPI[:\s#]*([0-9]{10})\b |
| DEA Number | US Drug Enforcement Administration registration numbers | \b[ABCDEFGHJKLMNPQRSTUVWXYZ][ABCDEFGHJKLMNPQRSTUVWXYZ9][0-9]{7}\b |
| ICD-10 Code | International Classification of Diseases codes | \b[A-Z][0-9]{2}(\.[0-9A-Z]{1,4})?\b |
Enterprise & Legal
3 patterns
| Pattern | What it matches | Regular expression |
|---|---|---|
| EU VAT Number | European Union VAT registration numbers | \b(AT|BE|BG|CY|CZ|DE|DK|EE|EL|ES|FI|FR|GB|HR|HU|IE|IT|LT|LU|LV|MT|NL|PL|PT|RO|SE|SI|SK)[0-9A-Z]{6,13}\b |
| UK VAT Number | UK VAT registration numbers (GB prefix) | \bGB\s?[0-9]{3}\s?[0-9]{4}\s?[0-9]{2}(\s?[0-9]{3})?\b |
| UK Companies House | UK Companies House registration numbers | \b(SC|NI|OC|LP|SO|NC|R)?[0-9]{6,8}\b |
A pattern is not a detector. Before any of these enforces anything, it normally needs a checksum where the format has one, keyword proximity so a match must sit near supporting terms, and a match threshold so one incidental hit doesn't trigger a policy.
Questions
About this tool
Is this DLP regex tester free?
Yes — free, with no account, no sign-up and no usage limit. It is published as a useful tool for the DLP and security engineering community, not as a trial of anything.
Does my test data get uploaded anywhere?
No. Matching runs entirely inside a sandboxed Web Worker in your own browser, so there is no request to a server and nothing is logged or stored. That is the main reason to use this rather than a general-purpose online regex tester, which posts your input to someone else's backend. Even so, prefer the built-in sample data over real production values.
What is the difference between a DLP regex and an ordinary regex?
The constraint is false positives at scale. A pattern that is broadly correct is fine in a script, but a DLP policy evaluates millions of events a day, so even a small false-positive rate produces enough noise that analysts stop trusting the alerts and the policy gets switched to monitor-only. DLP patterns therefore lean heavily on word boundaries, bounded quantifiers rather than open-ended ones, and supporting context around the match.
Can I paste these patterns straight into my DLP tool?
Treat them as a starting point rather than a finished detector. A card-number expression matches any correctly-shaped 16-digit string, including order numbers and identifiers that merely look like cards. Production detection normally adds a checksum validation such as Luhn, keyword proximity so the match must sit near supporting terms, and a match-count threshold so a single incidental hit does not trigger the policy. The regex is one input to a detector, not the detector.
Which regex flavour does this tester use?
JavaScript (ECMAScript), because it runs in your browser. This matters: regex engines are not interchangeable. Some support lookbehind and backreferences, others deliberately do not in exchange for guaranteed linear-time matching. Named groups, Unicode property escapes and possessive quantifiers all vary too. Use this tool to work out the logic, then confirm the final expression in the platform that will actually enforce it.
Why did my pattern time out?
A run is stopped after 1.5 seconds, which almost always means catastrophic backtracking. Nested quantifiers such as (a+)+ or (.*)* are the usual cause: on input that nearly matches, the engine explores exponentially many paths and effectively never finishes. This is worth catching at design time, because a pattern that hangs here will also hurt an inline engine inspecting live traffic — and in that setting it is an availability problem, not just a slow test.
What data types are covered?
Payment and banking data, credentials and secrets such as API keys and private keys, personal identity data, health identifiers, network and infrastructure detail, and common enterprise record formats. Every pattern ships with a sample value that matches it, so you can see the behaviour without supplying anything real.
A pattern is the easy part. The policy around it isn't.
Knowing that a regex matches is one decision. Which applications it should apply to, what action it should trigger, how it gets configured in your platform, and how you prove it works — that's the rest of the job, and it's what Uraikkal does.