The one marked as winning, by @diegoperini, has problems. The way it defines passwords is wrong, so you can trick it into accepting almost anything by putting

The one marked as winning, by @diegoperini, has problems. The way it defines passwords is wrong, so you can trick it into accepting almost anything by putting the domain somewhere else: re_weburl.test("http://127.0.0.1/") => false re_weburl.test("http://127.0.0.1/@example.com") => true re_weburl.test("http://999.999.999.999.999/@example.com") => true oops. I disagree that it should be rejecting rfc1918 addresses anyway, because this makes it less useful in an intranet context, where you want those to work. There's also an apples-to-oranges comparison going on here. The Gruber pattern is not for validation, but for detecting url-like-things in text, which is why it excludes a whole bunch of punctuation chars from appearing at the end - when I say 'google.com.' in text, I mean 'google.com'. Edited to add: I misremembered suggesting trailing punctuation exclusion to Gruber, what we discussed was xxx.xxx/xxx as an alternate pattern, catching protocol-less shortened urls in tweets.