Regex Cheat Sheet: A Complete Guide to Regular Expressions

Test Your Patterns

Try any pattern from this guide against your own text. Matches and capture groups highlight in real time.

The quick brown fox jumps over 13 lazy dogs.

[The] [quick] [brown] [fox] [jumps] [over] [13] [lazy] [dogs].

Character Classes

Character classes match a single character from a defined set. These are the foundation.

The shorthands (\d, \w, \s) and their negations cover most needs. Square-bracket character classes handle everything else.

Quantifiers

Quantifiers control how many times a preceding element must appear.

• * — zero or more. ab*c matches ac, abc, abbc.
• + — one or more. ab+c matches abc, abbc, but not ac.
• ? — zero or one (optional). colou?r matches color and color.
• {3} — exactly 3 times. \d{3} matches exactly three digits.
• {2,5} — between 2 and 5 times.
• {3,} — 3 or more times.

Greedy vs lazy

By default, quantifiers are greedy — they match as much as possible. Adding ? makes them lazy (match as little as possible). This matters enormously for parsing quoted strings or HTML.

Greedy: ".*"  applied to  he said "hello" and "goodbye"
Matches: "hello" and "goodbye"  (first quote to last quote)

Lazy:   ".*?" applied to  he said "hello" and "goodbye"
Matches: "hello" then "goodbye"  (shortest possible matches)

Anchors

Anchors don’t match characters — they match positions. ^ matches the start of a string, $ matches the end, and \b matches a word boundary (the transition between a word character and a non-word character).

• ^ — start of string (or start of line in multiline mode).
• $ — end of string (or end of line in multiline mode).
• \b — word boundary. \bcat\b matches cat but not caterpillar or concatenate.

Groups and Alternation

Capturing groups

Parentheses () extract matched substrings. (\d{4})-(\d{2})-(\d{2}) applied to 2026-03-31 captures 2026, 03, 31.

Named groups

(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2}) lets you reference matches by name instead of index. Far more readable in complex patterns.

Non-capturing groups

(?:...) groups elements without capturing. Useful when you need grouping for alternation or quantifiers but do not need the match. (?:https?|ftp):// groups protocol options without wasting a capture slot.

Alternation

| means “or”. cat|dog matches either. Use with groups: (cat|dog) food matches cat food or dog food.

Lookaheads and Lookbehinds

Zero-width assertions — they check what comes before or after the current position without consuming characters.

• (?=...) — positive lookahead. \d+(?= dollars) matches 100 in 100 dollars but not 100 euros.
• (?!...) — negative lookahead. \d+(?! dollars) matches 100 in 100 euros but not 100 dollars.
• (?<=...) — positive lookbehind. (?<=\$)\d+ matches 50 in $50.
• (?<!...) — negative lookbehind. (?<!\$)\d+ matches 50 in 50 items but not $50.

10 Practical Patterns

Paste any of these into the Regex Tester to see them work.

For real-world examples beyond this reference, the regex patterns you’ll actually use in daily development shows each pattern against real data with commentary on edge cases.

1. Email address (simplified)

^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$

Covers the vast majority of real email addresses. The full RFC 5322 spec is absurdly complex and not worth implementing in regex.

2. URL

https?:\/\/[^\s/$.?#].[^\s]*

Matches HTTP and HTTPS URLs. For strict validation, use your language’s URL parser.

3. UK phone number

^(?:0|\+44)\d{9,10}$

Numbers starting with 0 or +44 followed by 9-10 digits.

4. Date (YYYY-MM-DD)

^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$

Validates format, restricts months to 01-12, days to 01-31. Does not check whether February 30th exists — use a date library for that.

5. IPv4 address

^((25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(25[0-5]|2[0-4]\d|[01]?\d\d?)$

Validates each octet is 0-255.

6. Hex color code

^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$

Matches #fff and #1a2b3c.

7. Strong password

^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$

At least 8 characters with one lowercase, one uppercase, one digit, one special character. Four positive lookaheads check each requirement independently.

8. HTML tag

<([a-z][a-z0-9]*)\b[^>]*>(.*?)<\/\1>

Matches opening and closing tags. \1 backreference ensures they match. Fine for quick extraction — do not use regex to parse HTML in production.

9. Trailing whitespace

[ \t]+$

Clean up code files. In multiline mode, matches whitespace at the end of each line.

10. Duplicate words

\b(\w+)\s+\1\b

Catches repeated words like “the the” or “is is”. The \1 backreference matches whatever the first group captured.

Common Mistakes

Forgetting to escape special characters. . matches any character, not a literal dot. Use \. for a period. Same for (, ), [, ], {, }, +, *, ?, ^, $, |, \.

Greedy when you need lazy. ".*" matches from the first quote to the last quote in the entire string. Use ".*?" for the nearest closing quote.

Anchoring only one end. ^\d+ checks that the string starts with digits but says nothing about what follows. ^\d+$ ensures the entire string is digits.

Over-engineering validation. Regex matches format. It does not validate semantics. Match the pattern with regex, then validate the logic in code.

Catastrophic backtracking. Nested quantifiers like (a+)+ cause exponential backtracking on almost-matching inputs. This freezes your application. Never nest quantifiers inside groups that are themselves quantified.

Keep Going

Start with the Regex Tester and experiment against real data. Build confidence with character classes and quantifiers before tackling lookaheads. And when a pattern grows beyond two lines — stop, and write a proper parser instead. Regex also pairs naturally with SQL for data validation — the SQL cheat sheet covering queries and joins covers how to use regex inside WHERE clauses in PostgreSQL and MySQL.