Postal Code Format by Country: 2026 Regex Reference

The United States uses five digits or ZIP+4, which tempts developers to model postal codes as integers. That model breaks immediately in Canada, the United Kingdom, the Netherlands, Ireland, Malta, and Argentina, where letters are part of the code. It also breaks quietly in Germany, France, Spain, Italy, and Poland, where leading zeros are meaningful and an integer column drops them.

A second class of bugs comes from position. Most Western countries put the postal code after the city, but Germany, France, the Netherlands, and Japan place it before the city, and Japan puts the whole code at the very start of the address. If your form renders a fixed template, it will produce addresses that a local reader finds obviously wrong even though every field is populated.

Most of Europe uses fixed-length numeric codes. Germany, France, Spain, Italy, Greece, Turkey, and Saudi Arabia use five digits; Austria, Belgium, Switzerland, Denmark, Norway, Hungary, and South Africa use four; Poland and Portugal add a hyphen; Sweden uses three digits, a space, and two. Czechia is five digits typically written with a space after the third.

Asia and Latin America are mostly numeric but with different lengths. India, China, Russia, Singapore, and Nigeria use six digits; Japan uses seven with a conventional hyphen after the third; South Korea uses five; Brazil uses eight with a hyphen after the fifth; Chile uses seven; Colombia uses six; Peru and Mexico use five. Length alone is not enough to identify a country, which is why a validator needs the country field before it validates anything.

Canada uses the A1A 1A1 pattern, and the letters are restricted. The first character cannot be D, F, I, O, Q, U, W, or Z, and the remaining letters cannot be D, F, I, O, Q, or U. The space between the two triplets is conventional. A validator that allows any letter will accept codes that Canada Post never issues.

The United Kingdom uses an outward code of two to four characters followed by a single space and a three-character inward code, as in SW1A 1AA. The Netherlands is four digits, a space, and two uppercase letters. Ireland uses a seven-character Eircode split as a three-character routing key and a four-character unique identifier. Malta is three letters, a space, and four digits. Argentina uses the eight-character CPA, a letter followed by four digits, three letters, for example C1425ABC.

Hong Kong and the United Arab Emirates have no postal code system. Both are in this site's 38-country fixture set, and the generator returns an empty postal value for them rather than inventing digits. This is the correct behaviour and it is also a useful test case, because a form that marks postal code as required is broken for both markets.

The UAE convention is a P.O. Box number, which is not a postal code and should not be forced into that field. Hong Kong addresses use the district and street, and mail is delivered without any code. If your data model requires a non-null postal value, use an explicit sentinel such as a country-level flag, not a fake code, because a fake code will pass validation and then fail every downstream check that assumes a real one.

A structure check answers whether a string matches the country pattern. An existence check answers whether the code appears in a reference dataset. Only the second can tell you that a code was never assigned. This site performs the structure check for all 38 countries and an existence check for US ZIPs against 40,979 rows, and it labels them differently so nobody confuses one for the other.

Neither check proves deliverability. A five-digit US ZIP can exist while the street address under it does not, and a structurally valid German code can belong to a different city than the one supplied. If you need that level of assurance, you need a postal reference dataset and a street-level database, which is a different product from a format checker.

Anchor every pattern. An unanchored /\d{5}/ matches the five digits inside a nine-digit string and reports success. Use ^ and $, or the equivalent full-match API. In JavaScript, \d matches only ASCII digits; in Python, \d matches Unicode digits by default, so a pattern can accept Eastern Arabic numerals unless you compile with re.ASCII or write [0-9].

Decide explicitly whether the separator is required. For display, insert the canonical separator yourself. For input, accept zero or one space or hyphen and normalize. Be careful with hyphens inside character classes, where they define ranges unless escaped or placed last. And do not use a case-insensitive flag to paper over a normalization bug: uppercase the value on write and keep the display form canonical.

Store one canonical form and derive the display form. The canonical form is usually uppercase with the standard separator, or digits only when the separator is purely conventional. Keep the raw user input in a separate column if you need an audit trail, because normalization is lossy and a support agent may need to see exactly what was typed.

Country-specific normalization is small but real. Canada wants an uppercase letter-digit-letter space digit-letter-digit. The Netherlands wants uppercase letters after the digits. The UK wants a single space and uppercase. Brazil and Japan use a hyphen that users frequently omit, so normalize to the hyphenated form. Germany wants no separator at all and must keep the leading zero.

Every validator needs a corpus with at least one valid and one invalid case per country, plus cases that specifically test normalization and storage. The table below is a starting set. Notice that several invalid cases are invalid for country-specific reasons rather than generic ones, which is where most hand-written tests stop too early.

Add cases for the countries with no postal code, for leading zeros, and for the separator variants users actually type. If the validator is shared between client and server, run the same corpus against both implementations; a divergence between a permissive client and a strict server is the most common source of "the form accepted it but the API rejected it" reports.