Regular Expressions Cheat Sheet with Examples

Regular expressions (regex) are a powerful text-matching tool built into virtually every programming language. They can validate input, extract data, and transform text — but their compact syntax can be intimidating. This guide is a practical regex cheat sheet with annotated examples — character classes, quantifiers, groups, lookaround, and real-world patterns for email, URL, IP, date, and HTML matching. To experiment with patterns interactively, open our free Regex Tester in another tab. For a compact syntax-only reference, see the Regex Cheat Sheet.

The Building Blocks

Literal Characters

Most characters match themselves. The regex cat matches the exact string “cat” inside any text. This is the simplest form of regex — a literal search.

Character Classes: Matching Types of Characters

Character classes match one character from a defined set:

\d    → any digit (0-9)
\w    → any word character (letters, digits, underscore)
\s    → any whitespace (space, tab, newline)
.     → any character except newline

Uppercase versions are negations: \D = non-digit, \W = non-word, \S = non-whitespace.

Custom sets use square brackets:

[aeiou]     → any vowel
[0-9a-f]    → any hex digit
[^0-9]      → anything that is NOT a digit

Example — match a hex color code:

#[0-9a-fA-F]{6}\b

This matches #1a2b3c or #FF9900 but not #xyz or #12 (too short).

Quantifiers: How Many Times

Quantifiers control repetition:

*       → 0 or more
+       → 1 or more
?       → 0 or 1 (optional)
{3}     → exactly 3
{2,5}   → between 2 and 5
{3,}    → 3 or more

Example — match a US phone number:

\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}

Breaking it down:

• \(? — optional opening parenthesis
• \d{3} — three digits (area code)
• \)? — optional closing parenthesis
• [-.\s]? — optional separator (dash, dot, or space)
• \d{3} — three digits
• [-.\s]? — optional separator
• \d{4} — four digits

Matches: (555) 123-4567, 555.123.4567, 5551234567

Greedy vs Lazy Matching

By default, quantifiers are greedy — they match as much as possible. Adding ? makes them lazy — matching as little as possible.

Given the string <b>bold</b> and <b>more</b>:

<b>.*</b>      → matches "<b>bold</b> and <b>more</b>" (greedy — one big match)
<b>.*?</b>     → matches "<b>bold</b>" then "<b>more</b>" (lazy — two small matches)

When matching content between delimiters, lazy quantifiers or negated character classes ([^<]* instead of .*?) are almost always what you want.

Anchors: Position Matters

Anchors don’t match characters — they match positions:

^       → start of string (or line, with m flag)
$       → end of string (or line, with m flag)
\b      → word boundary (between \w and \W)

Example — validate that a string is a valid integer (nothing else):

^-?\d+$

Without ^ and $, the regex would match the “42” inside “abc42xyz”. The anchors ensure the entire string must be a number.

Example — match whole words only:

\bfunction\b

Matches “function” in function foo() but not “dysfunction” or “functionality”.

Groups and Capturing

Parentheses create groups that serve two purposes: grouping for quantifiers and capturing matched text.

(ha)+         → matches "ha", "haha", "hahaha" (group + quantifier)
(\d{4})-(\d{2})-(\d{2})   → captures year, month, day separately

Named Groups

Named groups make captures self-documenting:

const dateRegex = /(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})/;
const match = '2026-04-10'.match(dateRegex);
console.log(match.groups.year);   // "2026"
console.log(match.groups.month);  // "04"

Non-Capturing Groups

Use (?:...) when you need grouping without capturing (slightly more efficient):

(?:https?|ftp)://\S+

Groups https? and ftp as alternatives without creating a capture group.

Back-References

\1, \2, etc. refer back to previously captured groups:

<(\w+)>.*?</\1>

Matches an HTML tag and its closing tag: <div>content</div>. The \1 ensures the closing tag matches the opening tag name.

Lookaround: Assert Without Consuming

Lookaround checks what’s before or after the current position without including it in the match:

(?=...)     → lookahead: what follows
(?!...)     → negative lookahead: what must NOT follow
(?<=...)    → lookbehind: what precedes
(?<!...)    → negative lookbehind: what must NOT precede

Example — match a number only if followed by “px”:

\d+(?=px)

In font-size: 16px; margin: 2em, matches 16 but not 2.

Example — password validation (must contain at least one digit, one lowercase, one uppercase, minimum 8 characters):

^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}$

Each (?=...) is a lookahead that scans the entire string for a required character type without consuming any characters, so all three checks run from the same starting position.

Flags

Flags modify how the regex engine behaves:

'Hello World'.match(/hello/i);     // ["Hello"] — case insensitive
'line1\nline2'.match(/^\w+/gm);    // ["line1", "line2"] — multiline

Real-World Patterns

Email Validation (Simple)

^[\w.+-]+@[\w-]+\.[\w.]+$

Good enough for most forms. For strict RFC 5322 compliance, the regex would be absurdly long — use a library or just send a confirmation email.

URL Extraction

https?://[^\s<>"']+

Matches HTTP(S) URLs by starting with the protocol and consuming everything that isn’t whitespace or common delimiters.

IPv4 Address

\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b

Unlike the simpler \d{1,3}(\.\d{1,3}){3}, this validates that each octet is 0–255.

Extract Markdown Links

\[([^\]]+)\]\(([^)]+)\)

Captures the text in group 1 and the URL in group 2. For [Google](https://google.com), group 1 = “Google”, group 2 = “https://google.com”.

Find Duplicate Words

\b(\w+)\s+\1\b

Matches “the the”, “is is”, etc. The \1 back-reference matches exactly what group 1 captured.

Remove HTML Tags

<[^>]+>

Matches any HTML tag for stripping. Note: this is fine for simple cleanup but not for security-sensitive HTML sanitization — use a proper HTML parser for that.

Common Pitfalls

Catastrophic backtracking. Nested quantifiers like (a+)+ can cause the regex engine to try exponentially many paths on non-matching input. Avoid nesting quantifiers where possible, or use atomic groups / possessive quantifiers if your engine supports them.

Forgetting to escape special characters. To match a literal ., *, +, ?, (, ), [, ], {, }, |, ^, $, or \, you must escape it with \.

Multiline confusion. By default, ^ and $ match the start/end of the entire string. To match line boundaries, add the m (multiline) flag. And . doesn’t match newlines unless you add the s (dotAll) flag.

Over-engineering validation. A regex that validates every edge case of an email address is hundreds of characters long. For most validation tasks, a simple regex plus server-side verification is more maintainable than a “perfect” regex.

Try It Yourself

Use our Regex Tester to test patterns in real time with match highlighting, capture group extraction, and flag toggles — all in your browser.

For a compact quick-reference table, see our Regex Cheat Sheet. If you’re building SEO-friendly URL slugs, regex is often part of the transliteration pipeline. And if you work with encoded strings, the URL encoding guide covers percent-encoding of special characters that sometimes interact with regex patterns.

Further Reading

• MDN: Regular Expressions — JavaScript regex guide with interactive examples
• regular-expressions.info — Comprehensive regex tutorial and reference
• regex101.com — Online regex debugger with explanation of each token
• RFC 5322 §3.4 — Email address specification (the “correct” email regex source)
• ReDoS (Regular Expression Denial of Service) — OWASP guide on catastrophic backtracking