Regular expressions (regex) are one of the most powerful tools in a developer's arsenal. They let you search, match, and manipulate text with surgical precision. But let's be honest — regex syntax can feel like reading hieroglyphics the first time you encounter it.
This cheat sheet is designed to be your go-to reference. Whether you're validating email addresses, parsing log files, or building search features, you'll find the patterns you need here. Every example is tested and ready to paste into your code. And if you want to experiment interactively, try our free Regex Tester — it shows matches in real time with capture group highlighting.
Basic Syntax
At its core, a regex pattern is a sequence of characters that defines a search pattern. Here are the fundamental building blocks:
Literal Characters
The simplest regex is just a literal string. The pattern hello matches the exact text "hello". Case matters by default — Hello won't match hello unless you use the case-insensitive flag (i).
Metacharacters
These characters have special meaning in regex. To match them literally, escape with a backslash (\).
. Any character except newline
^ Start of string (or line with m flag)
$ End of string (or line with m flag)
* Zero or more of the preceding element
+ One or more of the preceding element
? Zero or one of the preceding element
| Alternation (OR)
\ Escape character
() Grouping
[] Character class
{} QuantifierCharacter Classes
Character classes match any single character from a set. They're defined with square brackets:
[abc] Match a, b, or c
[^abc] Match any character EXCEPT a, b, or c
[a-z] Match any lowercase letter
[A-Z] Match any uppercase letter
[0-9] Match any digit
[a-zA-Z] Match any letter
[a-zA-Z0-9] Match any alphanumeric characterShorthand Character Classes
\d Digit [0-9]
\D Non-digit [^0-9]
\w Word character [a-zA-Z0-9_]
\W Non-word character [^a-zA-Z0-9_]
\s Whitespace [ \t\n\r\f\v]
\S Non-whitespace [^ \t\n\r\f\v]
\b Word boundary
\B Non-word boundary
These shorthands save you from writing out character classes manually. \d+ is much cleaner than [0-9]+.
Quantifiers
Quantifiers control how many times an element must appear for a match:
* Zero or more a* matches "", "a", "aaa"
+ One or more a+ matches "a", "aaa" but not ""
? Zero or one a? matches "" or "a"
{3} Exactly 3 a{3} matches "aaa"
{2,5} Between 2 and 5 a{2,5} matches "aa" to "aaaaa"
{2,} 2 or more a{2,} matches "aa", "aaa", "aaaa"...Greedy vs Lazy Quantifiers
By default, quantifiers are greedy — they match as much text as possible. Add ? after a quantifier to make it lazy (match as little as possible):
.* Greedy: matches everything
.*? Lazy: matches as little as possible
.+? Lazy one-or-more
.?? Lazy zero-or-one
This distinction is critical when parsing HTML or extracting quoted strings. The pattern ".*" applied to "hello" and "world" would match the entire string (greedy), while ".*?" would correctly match "hello" and "world" separately.
Groups and Capturing
Parentheses () serve two purposes: grouping and capturing. You can use groups to apply quantifiers to sub-patterns and extract matched content.
(abc) Capturing group — captures "abc"
(?:abc) Non-capturing group — groups without capturing
(?<name>abc) Named capturing group
\1 Backreference to group 1
\k<name> Backreference to named groupExample: Extracting Dates
To extract year, month, and day from a date string like 2026-03-19:
(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})In JavaScript:
const match = '2026-03-19'.match(/(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})/);
console.log(match.groups);
// { year: '2026', month: '03', day: '19' }Try this pattern in our Regex Tester to see the capture groups highlighted in real time.
Anchors and Boundaries
^ Start of string
$ End of string
\b Word boundary
\B Non-word boundary
(?=...) Positive lookahead
(?!...) Negative lookahead
(?<=...)Positive lookbehind
(?<!...)Negative lookbehindLookaheads and Lookbehinds
Lookaheads and lookbehinds assert that a pattern exists (or doesn't) without including it in the match. They're incredibly useful for complex validations:
# Password must have: 8+ chars, uppercase, lowercase, digit
^(?=.*[A-Z])(?=.*[a-z])(?=.*\d).{8,}$
# Match a number NOT followed by "px"
\d+(?!px)
# Match a dollar amount (number preceded by $)
(?<=\$)\d+(\.\d{2})?Password validation is one of the most common uses of lookaheads. You can test complex password patterns with our Password Generator to verify your regex catches the right cases.
Flags / Modifiers
Flags change how the regex engine interprets the pattern:
g Global — find all matches, not just the first
i Case-insensitive
m Multiline — ^ and $ match start/end of each line
s Dotall — . matches newline characters too
u Unicode — enable full Unicode matching
y Sticky — match from lastIndex position only
In JavaScript: /pattern/gi. In Python: re.compile(pattern, re.IGNORECASE | re.MULTILINE).
Real-World Regex Patterns
Here are battle-tested patterns for common validation and extraction tasks. Copy-paste them directly into your code.
Email Validation
^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$This covers the vast majority of valid email addresses. For RFC 5322 full compliance you'd need a much more complex pattern, but this works for 99.9% of real-world use cases.
URL Validation
^https?:\/\/[^\s/$.?#].[^\s]*$
Matches HTTP and HTTPS URLs. For more detailed URL parsing, consider using the built-in URL constructor in JavaScript instead of regex. Check and encode URLs with our URL Encoder/Decoder.
IPv4 Address
^(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)$Phone Number (International)
^\+?[1-9]\d{1,14}$
This follows the E.164 standard — up to 15 digits with optional leading +.
HTML Tag Extraction
<(\w+)([^>]*)>(.*?)<\/\1>Captures tag name, attributes, and inner content. Note: regex is not suitable for full HTML parsing — use a proper DOM parser for complex documents. For HTML formatting and cleanup, try our HTML Formatter.
CSS Color (HEX)
^#(?:[0-9a-fA-F]{3}){1,2}$
Matches both 3-digit (#fff) and 6-digit (#ffffff) hex colors. For color format conversion, use our Color Converter tool.
JSON Key-Value Pair
"(\w+)"\s*:\s*"([^"]*)"Extracts key-value pairs from JSON strings. For proper JSON validation and formatting, use our JSON Formatter instead.
UUID v4
^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$Specifically validates UUID version 4 format. Need to generate UUIDs? Try our UUID Generator.
Cron Expression
^(\*|[0-9]|[1-5][0-9])\s+(\*|[0-9]|1[0-9]|2[0-3])\s+(\*|[1-9]|[12]\d|3[01])\s+(\*|[1-9]|1[0-2])\s+(\*|[0-6])$Validates standard 5-field cron expressions. For building cron expressions visually, use our Cron Expression Generator.
Search and Replace Patterns
Regex really shines in search-and-replace operations. Here are common transformation patterns:
camelCase to snake_case
// Pattern: ([a-z])([A-Z])
// Replace: $1_$2
// Then lowercase the result
"myVariableName" → "my_variable_name"For one-click text case conversion, try our Text Case Converter tool.
Remove HTML Tags
// Pattern: <[^>]*>
// Replace: (empty string)
"<p>Hello <b>world</b></p>" → "Hello world"Add Thousands Separators
// Pattern: (\d)(?=(\d{3})+$)
// Replace: $1,
"1234567" → "1,234,567"Regex in Different Languages
JavaScript
// Literal syntax
const re = /\d+/g;
const matches = 'abc 123 def 456'.match(re);
// ['123', '456']
// Constructor syntax
const re2 = new RegExp('\\d+', 'g');
// Named groups
const dateRe = /(?<year>\d{4})-(?<month>\d{2})/;
const { year, month } = '2026-03'.match(dateRe).groups;Python
import re
# Find all matches
matches = re.findall(r'\d+', 'abc 123 def 456')
# ['123', '456']
# Named groups
m = re.match(r'(?P<year>\d{4})-(?P<month>\d{2})', '2026-03')
print(m.group('year')) # '2026'
# Compile for reuse
pattern = re.compile(r'\b\w+@\w+\.\w+\b')
emails = pattern.findall(text)Go
import "regexp"
re := regexp.MustCompile(`\d+`)
matches := re.FindAllString("abc 123 def 456", -1)
// ["123", "456"]Performance Tips
Regex can be a performance bottleneck if used carelessly. Here are key tips:
- Compile once, use many times. In Python, use
re.compile(). In JavaScript, define the regex outside loops. - Avoid catastrophic backtracking. Patterns like
(a+)+can take exponential time on certain inputs. Use atomic groups or possessive quantifiers where available. - Be specific.
[a-z]+is faster than.+because the engine doesn't have to consider every possible character. - Use anchors.
^\d+$fails fast on non-matching strings because the engine knows exactly where to start and end. - Prefer non-capturing groups (
(?:...)) when you don't need the captured value — they're slightly faster.
Common Mistakes
- Forgetting to escape metacharacters. To match a literal dot, use
\.not.. - Greedy vs lazy confusion. When matching quoted strings, always use
".*?"(lazy) not".*"(greedy). - Not using raw strings. In Python, always use
r'\d+'instead of'\\d+'to avoid double-escaping. - Overusing regex. For simple string operations like
startsWith,includes, orsplit, native string methods are clearer and faster. - Parsing HTML with regex. Don't. Use a proper parser like DOMParser, BeautifulSoup, or cheerio.
Quick Reference Card
BASICS QUANTIFIERS GROUPS
. any char * 0 or more () capture
\d digit + 1 or more (?:) non-capture
\w word char ? 0 or 1 (?=) lookahead
\s whitespace {n} exactly n (?!) neg lookahead
\b word boundary {n,m} n to m (?<=) lookbehind
^ start *? lazy (?<!) neg lookbehind
$ end
FLAGS: g(lobal) i(case) m(ultiline) s(dotall) u(nicode)Bookmark this page for quick reference, and use our Regex Tester to experiment with any pattern in real time. Happy pattern matching!