Download Cheat sheet PDF 12 pages · syntax, editors, patterns, Unicode, performance, debugging
Home›Patterns›Semantic version
Pattern

Regex for Semantic version

Semver version like 1.2.3 with pre-release and build metadata.

The Semantic version regex is ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$ — copy it below, or open it in the explainer for a token-by-token breakdown.

The pattern

^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$
Try in explainer → Download cheat sheet ↓

What it matches

  • 1.0.0
  • 2.1.3-beta
  • 1.0.0-alpha+001
  • 3.0.0-rc.1

What it doesn't match

  • 1.0
  • 01.0.0
  • 1.0.0-
  • v1.0.0

Notes & gotchas

The official semver.org regex. Handles pre-release identifiers (e.g., -beta.1) and build metadata (e.g., +001). No leading zeros allowed on major/minor/patch.

Code in your language

Use the explainer's Code tab to generate ready-to-paste snippets in JavaScript, Python, Java, .NET, Go, Ruby, and PHP for this pattern.

Open in explainer →

Token-by-token breakdown

Every part of the pattern, left to right:

TokenMeaning
^start of string (or line in multiline mode)
(start of a capturing group
0literal text “0”
|OR — try the alternative
[1-9]any of: 1–9
\d*zero or more: digit (0–9)
)end of group
\.literal “.”
(start of a capturing group
0literal text “0”
|OR — try the alternative
[1-9]any of: 1–9
\d*zero or more: digit (0–9)
)end of group
\.literal “.”
(start of a capturing group
0literal text “0”
|OR — try the alternative
[1-9]any of: 1–9
\d*zero or more: digit (0–9)
)end of group
(?:start of a non-capturing group
-literal text “-”
(start of a capturing group
(?:start of a non-capturing group
0literal text “0”
|OR — try the alternative
[1-9]any of: 1–9
\d*zero or more: digit (0–9)
|OR — try the alternative
\d*zero or more: digit (0–9)
[a-zA-Z-]any of: lowercase letters, uppercase letters, “-”
[0-9a-zA-Z-]*zero or more: any of: digits, lowercase letters, uppercase letters, “-”
)end of group
(?:start of a non-capturing group
\.literal “.”
(?:start of a non-capturing group
0literal text “0”
|OR — try the alternative
[1-9]any of: 1–9
\d*zero or more: digit (0–9)
|OR — try the alternative
\d*zero or more: digit (0–9)
[a-zA-Z-]any of: lowercase letters, uppercase letters, “-”
[0-9a-zA-Z-]*zero or more: any of: digits, lowercase letters, uppercase letters, “-”
)end of group
)*end of group, zero or more
)end of group
)?end of group, optional (zero or one)
(?:start of a non-capturing group
\+literal “+”
(start of a capturing group
[0-9a-zA-Z-]+one or more: any of: digits, lowercase letters, uppercase letters, “-”
(?:start of a non-capturing group
\.literal “.”
[0-9a-zA-Z-]+one or more: any of: digits, lowercase letters, uppercase letters, “-”
)*end of group, zero or more
)end of group
)?end of group, optional (zero or one)
$end of string (or line in multiline mode)

About this pattern

Identifier formats like UUIDs, hashes, and version strings have well-defined structures that regex captures cleanly. The pattern verifies format; checksums and validity against a registry need additional checks.

Quick usage in different languages

This exact pattern — with the correct escaping and idioms for each language:

  • JavaScript: /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/.test(value)
  • Python: re.match(r"^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$", value)
  • Java: Pattern.compile("^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$").matcher(value).matches()
  • C# / .NET: Regex.IsMatch(value, @"^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$")
  • Go: regexp.MustCompile(`^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$`).MatchString(value)
  • Ruby: /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/.match?(value)
  • PHP: preg_match('~^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$~', $value)

The explainer’s Code tab regenerates these for any pattern you paste, and the downloadable cheat sheet bundles the breakdown, all seven snippets, and the pitfalls below onto one printable page.

Common pitfalls

  • Anchored to the whole string. This pattern uses ^ and $, so it requires the entire input to match. To find it inside a longer text, drop the anchors and use the global (g) flag.
  • ASCII letters only. [a-zA-Z] excludes accented and non-Latin letters (é, ü, ß, ñ, and non-Latin scripts). For international input use Unicode properties like \p{L} with the u flag.
  • Watch for backtracking. This pattern nests quantifiers; on adversarial input that can cause exponential backtracking (ReDoS). Test with long non-matching strings, or use an RE2-based engine.
  • Escape it correctly per language. In Java and JavaScript strings each backslash must be doubled (\\d); in Python, Go, and C# use raw/verbatim strings so the backslashes survive.
  • Validate beyond format. Matching the format doesn't guarantee the value is real. Confirm the semantic version against a source of truth (database, API, or checksum) where it matters.

Standards & sources

This pattern is based on the following authoritative specification(s) and issuing authorities. Formats can change — always confirm against the primary source.

Related patterns

More patterns in the Codes & IDs category:

See also

Browse all 300 patterns in the library, or open this regex in the interactive explainer for a token-by-token breakdown, live testing, and code in seven languages.

Want more patterns? Browse the full library →