Regex patterns for DLP

Q: How do ECMAScript, RE2, and PCRE2 differ?

ECMAScript is browser JavaScript: lookahead/lookbehind, backreferences, and sticky flags. Closest to many cloud DLP and endpoint agents. RE2 (as in Go) runs in linear time and does not support lookaround or backreferences. PCRE2 is closer to Python re and PHP preg_*; it is not .NET Regex.

Q: Can a regex template block a data channel?

This page only shows whether a pattern matches text. Blocking the channel is decided by your DLP product and policy.

Pick regular expressions to teach your DLP to detect sensitive formats (SSN, IBAN, passport-shaped fields, cards, secrets). Three engines are available: ECMAScript (JavaScript), RE2 / Go, and PCRE2 — so you can see how the same rule behaves across products. Everything runs in your browser.

Synthetic / format only. Patterns do not validate checksums (Luhn, IBAN MOD-97, TFN, NRIC, Aadhaar) — use the generator for that. Below — ready templates: click a card to load it into the tester. After tuning a rule, prove the channel with HTTPS POST or FTP.

Test text

#	Match	Position	Groups

Pattern breakdown

The pattern is split into tokens: classes, quantifiers, groups, lookaround. Breakdown depends on the engine — ECMAScript/PCRE2 constructs may be unavailable in RE2.

Cheat sheet

Matching

`.`	any character except newline (with `s` — including newline)
`\d` `\D`	digit / non-digit
`\w` `\W`	word char / non-word
`\s` `\S`	whitespace / non-whitespace
`\b` `\B`	word boundary / non-boundary
`[abc]` `[^abc]`	class / negated class
`[a-z]`	range; use `u` for Unicode properties

Quantifiers and groups

`*` `+` `?`	0+, 1+, 0 or 1
`{n}` `{n,}` `{n,m}`	exact / at least n / range
`*?` `+?`	lazy
`(…)`	capturing group
`(?:…)`	non-capturing
`(?<name>…)`	named group
`a\|b`	alternation
`^` `$`	start / end (of line with `m`)

Lookaround and references

`(?=…)` `(?!…)`	lookahead — not in RE2
`(?<=…)` `(?<!…)`	lookbehind — not in RE2
`\1` `\k<name>`	backreference — not in RE2

Why regex still matters for DLP

Policies often start from structure: SSN with separators, IBAN length and country code, a card BIN. Once detection is stable, you can add alerts or blocks. Prefer a fixed sample file from the sample library when you need a repeatable pilot artifact.

FAQ

How do ECMAScript, RE2, and PCRE2 differ?

ECMAScript is browser JavaScript: lookahead/lookbehind, backreferences, and sticky flags. Closest to many cloud DLP and endpoint agents. RE2 (as in Go) runs in linear time and does not support lookaround or backreferences. PCRE2 is closer to Python re and PHP preg_*; it is not .NET Regex.

Does my text or pattern leave the browser?

No. Matching runs locally. “Copy link” stores the pattern and flags in the URL hash after # — that fragment is not sent to the server.

How should I use these regex templates?

They are format detectors for DLP rules: SSN, IBAN, cards, secrets, network. A template catches shape — separators, length, prefixes. Examples are synthetic; copy carefully into production and watch false positives.

Why does a lookbehind fail in RE2?

RE2 has no lookbehind, lookahead, or backreferences — by design, to avoid catastrophic backtracking. If your DLP claims RE2 or Go, rewrite those pieces with character classes and anchors. The RE2 tab here uses the re2js port, not Google’s native binary.

Can a regex template block a data channel?

This page only shows whether a pattern matches text. Blocking the channel is decided by your DLP product and policy.

Verify leak channels

The tester shows whether a pattern matches text. To confirm DLP stops a transfer, send synthetic data through a live channel.

HTTPS POST test Sample data