Base64 Regular Expression – Free, Online, Private

The pattern

Standard Base64 uses A–Z, a–z, 0–9, +, and /, and pads with = so the length is a multiple of four. SGVsbG8= is 'Hello' and matches. TQ== matches. A string of exclamation marks does not. YWJjZA is 'abcd' without the padding the alphabet requires for that length, and it does not match this pattern. URL-safe Base64 uses - and _ instead of + and /. It is a different alphabet and is not accepted here.

The source is ^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$. The flags on this page are m. i means case-insensitive. m means ^ and $ match at line breaks, which is how the sample can show several candidates. g is not set. The tester finds non-overlapping matches, and without g a pattern with no anchor still reports the matches it walks. The box under the title is a tester with this pattern and the sample already filled in. Edit either one. Nothing you type is uploaded. The same tester, without a preset, is the regex tool.

How to read it

(?:[A-Za-z0-9+/]{4})* is zero or more complete quartets. The optional group at the end is either two data characters and two equals, or three data characters and one equals. An unpadded remainder is not in either alternative, so a missing pad fails. The empty string matches, because both groups may be absent. If an empty field should fail, require at least one quartet or one padded group. Anchors and the m flag test each line. The pattern does not decode the value.

What it will not do

Whitespace and line breaks inside PEM bodies are not allowed. Strip them before testing. The pattern does not accept the URL-safe alphabet. If you add - and _, also decide what to do with padding, because URL-safe Base64 often omits it. The pattern does not prove the bytes are valid UTF-8. Decoding can still fail. The Base64 converter on this site decodes. This page only recognizes the alphabet. A very long line matches. Browsers and servers have their own limits.

A match is not a parsed value. An email pattern does not send mail, a UUID pattern does not allocate an id, and a password pattern does not store a password. When the next step needs a real parser, use one: the URL constructor, a date library, a semver library, or the converters on this site. The expression is the part you can see.

JavaScript, Python, and Go

The JavaScript snippet uses the RegExp constructor so the source does not have to be escaped for a literal slash. The Python snippet uses a normal string with the same escapes JSON would emit, which keeps \d as a regex digit class. Go's snippet uses a raw string. If the pattern contains a lookahead, the Go snippet says so and does not call MustCompile, because RE2 would reject it at runtime.

JavaScriptconst re = new RegExp("^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$", "m");
const found = text.match(re);
console.log(found ? found[0] : "no match");

Pythonimport re

pattern = re.compile("^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$", re.MULTILINE)
found = pattern.search(text)
print(found.group(0) if found else "no match")

Gopackage main

import (
	"fmt"
	"regexp"
)

func main() {
	text := ""
	re := regexp.MustCompile(`(?m)^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$`)
	fmt.Println(re.FindString(text))
}