Regex is the single highest-leverage skill a QA engineer can sharpen in a weekend. The same ten patterns show up in every test suite: extract an OTP from an email, assert a UUID in a response, validate a URL, match a JWT, parse a currency string. Memorize them once and you stop pasting from Stack Overflow forever.
This guide gives you ten patterns that earn their keep in real Cypress, Playwright, and Postman suites — plus the Regex Assistant workflow we use to build new ones quickly.
How to read these patterns
Every example uses standard JavaScript / PCRE syntax. They're written to be strict enough to fail on garbage and loose enough to survive minor formatting drift. Where a stricter version exists, it's called out.
1. Six-digit OTP
\b\d{6}\b
The single most-used pattern in any test suite that touches signup. The word boundaries (\b) keep it from matching the 2026 in a year or the 123456 inside a longer transaction ID. Pair it with YoBox Temp Mail to read the OTP straight out of the email body. See the Cypress + YoBox guide for the full pattern.
2. Email address (pragmatic)
[A-Z0-9._%+-]+@[A-Z0-9.-]+.[A-Z]{2,}
Add the i flag. Don't try to implement RFC 5322 — nobody actually wants it. This pattern catches every realistic address and a few weird ones, which is exactly the trade-off you want in a QA assertion.
3. UUID v4
[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}
The 4 in position 13 and the [89ab] in position 17 are what make it a v4 assertion, not just "32 hex chars with dashes." Useful when you want to assert a freshly minted ID and not a recycled one from a fixture.
4. JWT structure
^[A-Za-z0-9_-]+.[A-Za-z0-9_-]+.[A-Za-z0-9_-]*$
Three base64url segments separated by dots. The signature segment can be empty for unsigned tokens — keep the * if you test those.
5. ISO 8601 timestamp
^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(.\d{1,6})?(Z|[+-]\d{2}:\d{2})$
Handles UTC and offset zones. Use this for API responses where the timestamp shape matters more than the value.
6. URL (loose but useful)
https?:\/\/[^\s)]+
Specifically tuned for extracting magic links from email bodies. The [^\s)]+ stops at whitespace or a closing paren so it survives markdown links.
7. Currency string
^[\$€£]?\d{1,3}(,\d{3})*(.\d{2})?$
Matches $1,299.00, €42, 1234.56. Tighten the optional decimal to .\d{2} only when your backend always returns two-decimal money.
Continue Reading
This article is part of the YoBox Developer Blog.
Read the complete guide here:
https://yobox.dev/blog/testing-apis-with-postman-yobox-2026-workflow
⭐ More developer tools:
https://yobox.dev
⭐ GitHub examples:
https://github.com/hocineman4/yobox-examples
About YoBox
YoBox is a collection of free developer tools for API testing, disposable email, webhook inspection, Docker utilities, regex testing, password generation, and QA workflows.
⭐ GitHub Examples
Top comments (0)