Regex Cheat Sheet: Regular Expressions Reference for Developers

A regular expression (regex or regexp) is a sequence of characters that defines a search pattern. Regex patterns are used to search, match, validate, extract, and replace text. They are supported in virtually every programming language — JavaScript, Python, PHP, Java, Go, Ruby, Rust — and in many text editors, command-line tools like grep and sed, and databases.

Regex is one of the most efficient tools for text processing tasks that would otherwise require many lines of string manipulation code. A single regex pattern can validate an email address, extract all URLs from an HTML document, or find all lines in a log file that contain a specific HTTP status code. The same pattern works consistently across millions of lines of text in milliseconds.

The syntax for regular expressions is largely consistent across programming languages, with minor differences in features and how patterns are delimited. JavaScript wraps regex patterns in forward slashes: /pattern/flags. Python uses the re module with strings: re.search(r'pattern', text). The core syntax — character classes, anchors, quantifiers, groups — works the same way in all major languages.

Literal characters in a regex match themselves exactly. The pattern hello matches the string hello anywhere in the input. Most letters and digits are literal characters. Special characters with regex meaning — . * + ? ^ $ { } [ ] ( ) | — must be escaped with a backslash when you want to match them literally: \. matches a period, \$ matches a dollar sign.

A character class is a set of characters enclosed in square brackets. [abc] matches any single character that is a, b, or c. [0-9] matches any digit. [a-zA-Z] matches any ASCII letter. A caret inside the brackets negates the class: [^0-9] matches any character that is not a digit. Character classes can contain both literal characters and ranges.

The dot (.) is a special character that matches any single character except a newline by default. It is the most commonly misused character in regex — when you want to match a literal period, always escape it as \. rather than using the bare dot, which matches any character. In JavaScript, the s (dotAll) flag makes the dot also match newlines.

Anchors do not match characters — they match positions in the string. The caret (^) matches the beginning of the string (or the beginning of a line in multiline mode). The dollar sign ($) matches the end of the string (or the end of a line in multiline mode). Without anchors, a pattern can match anywhere inside the string.

The pattern hello matches the word hello anywhere in the string: it matches in hello world and in say hello and in ohello. Adding anchors changes the behavior: ^hello matches hello only at the start, hello$ matches hello only at the end, and ^hello$ matches only the string that is exactly hello with nothing else.

\b is a word boundary anchor that matches the position between a word character (letter, digit, or underscore) and a non-word character. It is useful for matching whole words: \bcat\b matches cat as a word but not catfish or tomcat. Word boundaries are particularly useful for searching logs, code, and documents where you want exact word matches without splitting words.

Quantifiers specify how many times the preceding element must occur. The asterisk (*) means zero or more times. The plus sign (+) means one or more times. The question mark (?) means zero or one time (making the element optional). These are greedy by default — they match as many characters as possible.

The curly-brace quantifiers give precise control: {n} matches exactly n times, {n,} matches n or more times, {n,m} matches between n and m times inclusive. For example, [0-9]{3} matches exactly three consecutive digits. [a-z]{2,5} matches a lowercase word between 2 and 5 characters long.

Greedy quantifiers match as much as possible and then backtrack. This can cause unexpected behavior when the pattern has multiple matches. Adding a question mark after a quantifier makes it lazy (non-greedy), matching as little as possible: .*? instead of .*. For example, the greedy <.*> applied to <b>hello</b> matches the entire string from the first < to the last >. The lazy <.*?> matches only <b> (the shortest possible match).

Regex provides shorthand character classes for commonly used sets. \d matches any digit, equivalent to [0-9]. \w matches any word character — letters, digits, and underscore — equivalent to [a-zA-Z0-9_]. \s matches any whitespace character — space, tab, newline, carriage return, form feed.

The uppercase versions are negations: \D matches any non-digit (equivalent to [^0-9]). \W matches any non-word character. \S matches any non-whitespace character. These are concise and readable alternatives to explicit character classes.

In Unicode-aware regex engines (JavaScript with the u flag, Python 3 with re.UNICODE which is the default), \d may match Unicode digits beyond 0-9, \w may match Unicode word characters, and \s may match Unicode whitespace. This is usually desirable for internationalized text processing but can cause surprises if you expect ASCII-only matching. Specify [0-9] instead of \d if you need to restrict to ASCII digits only.

Parentheses create a capturing group. The pattern (\d{4})-(\d{2})-(\d{2}) matches a date in YYYY-MM-DD format and captures the year, month, and day in three separate groups. In JavaScript, match[1] returns the year, match[2] the month, match[3] the day. Capturing groups also allow backreferences: \1 refers back to what the first group matched.

Non-capturing groups use the syntax (?:...) — they group characters for quantifier application or alternation without capturing the match. Use non-capturing groups when you need grouping but do not need to extract the matched content, as they are slightly faster and keep the match array smaller.

The pipe character (|) is the alternation operator, matching the expression on either side: cat|dog matches either cat or dog. Alternation has the lowest precedence in regex — (cat|dog)s matches cats or dogs, while cats|dogs matches cats or dogs (same result here but the grouping becomes important in more complex patterns). Always use explicit groups around alternation when the scope might be ambiguous.

Lookaheads match a position where the pattern is followed by (or not followed by) another pattern, without including the following pattern in the match. A positive lookahead uses the syntax (?=...): \d+(?= dollars) matches a number only if it is followed by the word dollars, but the matched text does not include dollars. A negative lookahead uses (?!...): \d+(?! dollars) matches a number only if it is not followed by dollars.

Lookbehinds work in the opposite direction — they match a position based on what comes before. A positive lookbehind uses (?<=...): (?<=\$)\d+ matches digits only when preceded by a dollar sign, without including the dollar sign in the match. A negative lookbehind uses (?<!...): (?<!\$)\d+ matches digits not preceded by a dollar sign.

Lookaheads and lookbehinds are zero-width assertions — they match a position, not characters, so they do not consume characters from the input. They are powerful for extracting or replacing content that appears in a specific context without altering the surrounding text. Not all regex engines support lookbehinds (older JavaScript before ES2018 did not), so check compatibility before using them in production code.

Email validation (simplified): /^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$/. This covers the most common email formats. A fully RFC 5322-compliant email regex is hundreds of characters long and often impractical. The simplified version catches the vast majority of invalid inputs.

URL matching: /https?:\/\/[^\s]+/g. This matches http or https followed by :// and any non-whitespace characters. It is intentionally simple and will match URLs in text without trying to validate the full URL structure. For stricter URL validation, use the URL constructor in JavaScript (new URL(str)) rather than a regex.

IPv4 address: /^(25[0-5]|2[0-4]\d|[01]?\d\d?)\.(25[0-5]|2[0-4]\d|[01]?\d\d?)\.(25[0-5]|2[0-4]\d|[01]?\d\d?)\.(25[0-5]|2[0-4]\d|[01]?\d\d?)$/. This validates that each octet is between 0 and 255. ISO date (YYYY-MM-DD): /^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$/. Hex color: /^#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$/.

Regex flags modify the behavior of the pattern matching. The most commonly used flags: g (global) finds all matches rather than stopping at the first match. i (case-insensitive) matches letters regardless of case. m (multiline) makes ^ and $ match the start and end of each line rather than the start and end of the entire string.

s (dotAll) makes the dot (.) match any character including newlines. This flag is available in JavaScript (ES2018+), Python (re.DOTALL), and most modern regex engines. Without the s flag, a dot in a pattern does not match a newline character, which can cause patterns to fail when the input spans multiple lines.

u (unicode) enables full Unicode matching in JavaScript. When using the u flag, \d, \w, and character ranges behave correctly with Unicode code points, and the pattern syntax is stricter (some sequences that were silently ignored become syntax errors). Always use the u flag in JavaScript when working with text that may contain non-ASCII characters.

Using . when you mean a literal period. The dot matches any character, so [a-z]+.[a-z]+ matches any string with two groups of letters and any single character between them, not necessarily a period. Always escape it as \. when matching a literal period.

Catastrophic backtracking: patterns like (a+)+ applied to a long string of non-matching characters can cause the regex engine to take exponential time testing all possible ways the pattern could match. This is a real denial-of-service vulnerability in web applications. Avoid nested quantifiers and write patterns that fail fast on non-matching input.

Anchoring failures: forgetting to add ^ and $ when validating a complete string means the pattern matches anywhere in the string. The pattern \d{4} without anchors matches a 4-digit number anywhere in 1234567, including the first 4 digits, which might not be what you intend. Add ^ at the start and $ at the end when you want the pattern to match the entire string.