Regular Expressions Cheat Sheet: Patterns Every Developer Needs

What Are Regular Expressions?

Regular expressions (regex or regexp) are sequences of characters that define search patterns. They are used in virtually every programming language for string searching, matching, validation, and replacement. A regular expression can match a simple word, validate an email address, or extract structured data from unstructured text.

Regex is one of the most powerful tools in a developer's arsenal, but it has a steep learning curve. This cheat sheet provides a comprehensive reference that you can bookmark and return to whenever you need to write or debug a regular expression. To test patterns in real time, use our Regex Tester tool.

Basic Metacharacters

Metacharacters are the building blocks of regular expressions. Each metacharacter has a special meaning that goes beyond its literal character value. Understanding these is the foundation for writing effective regex patterns.

Character Classes

Character classes let you match any one character from a specific set. They are defined using square brackets and can include ranges, negation, and shorthand notations that dramatically simplify common patterns.

Quantifiers

Quantifiers specify how many times a preceding element must occur for the pattern to match. They are essential for defining patterns that match variable-length strings, from optional characters to repeated sequences.

The difference between greedy and lazy quantifiers is critical. Greedy quantifiers (default) match as much as possible, while lazy quantifiers (with ? suffix) match as little as possible. This distinction matters most when working with HTML or nested delimiters.

Groups and Backreferences

Groups let you treat multiple characters as a single unit, apply quantifiers to complex patterns, and capture matched text for extraction or backreferencing. They are essential for sophisticated search-and-replace operations.

// JavaScript: Extract date components
const dateRegex = /(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})/;
const match = "2026-03-06".match(dateRegex);
console.log(match.groups.year);  // "2026"
console.log(match.groups.month); // "03"
console.log(match.groups.day);   // "06"

// Find duplicate words
const dupeRegex = /\b(\w+)\s+\1\b/gi;
"the the quick brown fox".match(dupeRegex); // ["the the"]

Lookaheads and Lookbehinds

Lookaheads and lookbehinds (collectively called lookarounds) let you match a pattern only if it is followed by or preceded by another pattern, without including the lookaround in the match itself. These are zero-width assertions, meaning they do not consume characters in the string.

// Match a number followed by "px" (without capturing "px")
/\d+(?=px)/g.exec("font-size: 16px");  // ["16"]

// Match "USD" NOT followed by a digit
/USD(?!\d)/.test("USD amount");  // true
/USD(?!\d)/.test("USD100");      // false

// Match a number preceded by "$"
/(?<=\$)\d+/.exec("Price: $42"); // ["42"]

// Password validation: at least 1 uppercase, 1 digit, 8+ chars
/^(?=.*[A-Z])(?=.*\d).{8,}$/

Regex Flags

Flags (also called modifiers) change how the regex engine interprets the pattern. Different languages use slightly different flag names, but the core set of flags is consistent across JavaScript, Python, PHP, and most other languages.

Common Regex Patterns for Validation

Below are battle-tested regex patterns for the most common validation tasks. These patterns balance strictness with practical usability. You can test any of these patterns immediately in our Regex Tester.

Email Validation

// Simple but effective email regex
/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/

// Test cases:
// [email protected]       ✓
// [email protected]  ✓
// [email protected]              ✗
// @example.com           ✗

URL Validation

// URL with optional protocol
/^(https?:\/\/)?([\w-]+\.)+[\w-]+(\/[\w-./?%&=]*)?$/

// Strict HTTPS URL
/^https:\/\/([\w-]+\.)+[\w-]+(\/[\w-./?%&=]*)?$/

Phone Number (US)

// US phone with optional country code and formatting
/^(\+1[- ]?)?\(?\d{3}\)?[- ]?\d{3}[- ]?\d{4}$/

// Matches: +1-555-123-4567, (555) 123-4567, 5551234567

IPv4 Address

// IPv4 validation (strict - checks 0-255 range)
/^((25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(25[0-5]|2[0-4]\d|[01]?\d\d?)$/

// Matches: 192.168.1.1, 10.0.0.0, 255.255.255.255
// Rejects: 256.1.1.1, 192.168.1

Strong Password

// Min 8 chars, 1 uppercase, 1 lowercase, 1 digit, 1 special
/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$/

Date (YYYY-MM-DD)

// ISO date format
/^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$/

// Matches: 2026-03-06, 2025-12-31
// Rejects: 2026-13-01, 2026-00-15

Hex Color Code

// 3 or 6 digit hex color
/^#([0-9A-Fa-f]{3}|[0-9A-Fa-f]{6})$/

// Matches: #fff, #FF5733, #0a0a0a

Need to convert hex colors to other formats? Try our Color Converter or Color Picker tools.

Regex in Different Programming Languages

While regex syntax is largely universal, each programming language has its own API for using regular expressions. Here are quick references for the most popular languages.

JavaScript

// Literal syntax
const regex = /pattern/flags;

// Constructor syntax
const regex2 = new RegExp("pattern", "flags");

// Methods
"hello".match(/h(e)(l)/);        // Match with groups
"hello".replace(/l/g, "r");      // "herro"
/^test/.test("test string");      // true
"a1b2".matchAll(/[a-z](\d)/g);   // Iterator of matches

Python

import re

# Search and match
re.search(r"\d+", "abc 123 def")       # Match object for "123"
re.match(r"^abc", "abc def")            # Matches at start
re.findall(r"\d+", "a1 b2 c3")         # ["1", "2", "3"]
re.sub(r"\d", "X", "a1b2c3")           # "aXbXcX"

# Compiled patterns (faster for repeated use)
pattern = re.compile(r"[A-Z][a-z]+")
pattern.findall("Hello World Test")     # ["Hello", "World", "Test"]

For counting words and analyzing text that you have processed with regex, our Word Counter can give you detailed statistics. And if you need to compare regex outputs, the Diff Checker is ideal for spotting differences between two text blocks.

Regex Performance Tips

Poorly written regex patterns can cause catastrophic backtracking, where the regex engine takes exponential time to evaluate certain inputs. This is a common source of ReDoS (Regular Expression Denial of Service) vulnerabilities. Following these performance guidelines will keep your patterns efficient and safe.

1. Be specific -- Use [a-z] instead of . when you know the expected character set.
2. Avoid nested quantifiers -- Patterns like (a+)+ can cause catastrophic backtracking.
3. Use atomic groups or possessive quantifiers -- When available, these prevent backtracking into subexpressions.
4. Anchor your patterns -- Use ^ and $ to avoid unnecessary scanning.
5. Compile once, use many -- Compile regex patterns outside of loops for better performance.
6. Use non-capturing groups -- Use (?:...) when you do not need the captured value.
7. Set time limits -- In production code, set regex execution timeouts to prevent ReDoS.

Related Articles