Securityflags: g

GitHub Personal Access Token

Match GitHub Personal Access Tokens (classic + fine-grained) and OAuth tokens by their `ghX_` prefix.

Available in

JavaScript / ECMAScript code

jsJavaScript

const re = new RegExp("gh[pousr]_[A-Za-z0-9]{36,255}", "g");
const input = "Use ghp_AbCd1234EfGh5678IjKl9012MnOp3456QrSt for the API";
const matches = [...input.matchAll(re)];
console.log(matches.map(m => m[0]));

Uses `String.prototype.matchAll` for global iteration (Node 12+ / all modern browsers).

Python (re) code

pyPython

import re

pattern = re.compile(r"gh[pousr]_[A-Za-z0-9]{36,255}")
input_text = "Use ghp_AbCd1234EfGh5678IjKl9012MnOp3456QrSt for the API"
for m in pattern.finditer(input_text):
    print(m.group(0))

Stdlib `re` module — no third-party dependency. Works on Python 3.6+.

Go (RE2) code

goGo

package main

import (
	"fmt"
	"regexp"
)

func main() {
	re := regexp.MustCompile(`gh[pousr]_[A-Za-z0-9]{36,255}`)
	input := `Use ghp_AbCd1234EfGh5678IjKl9012MnOp3456QrSt for the API`
	for _, match := range re.FindAllString(input, -1) {
		fmt.Println(match)
	}
}

Uses `regexp.MustCompile` (panics on bad patterns at startup) and `FindAllString` for all matches.

Pattern

regexengine-agnostic

gh[pousr]_[A-Za-z0-9]{36,255}   (flags: g)

Raw source: gh[pousr]_[A-Za-z0-9]{36,255}

How it works

gh[pousr]_ matches the GitHub token-type prefix: ghp_ (PAT classic), gho_ (OAuth), ghu_ (user-to-server), ghs_ (server-to-server), ghr_ (refresh). [A-Za-z0-9]{36,255} matches the token body — GitHub fine-grained tokens are longer than the classic 36-char tokens, so we allow up to 255.