Regex Cheat Sheet 2026: Regular Expressions Made Simple

Character Classes

Character classes let you match one character from a set of possibilities. They go inside square brackets.

The caret ^ inside a character class means negation. Outside a character class, it means start of string. Context matters.

Shorthand Character Classes

Regex provides shortcuts for the most common character classes:

These are the ones you'll use constantly. \d{3} matches exactly three digits. \s+ matches one or more whitespace characters. Once these are muscle memory, you can read most regex patterns without slowing down.

Quantifiers: How Many?

Quantifiers specify how many times the preceding element should occur.

Greedy vs Lazy

By default, quantifiers are greedy — they match as much text as possible. Add ? after a quantifier to make it lazy (match as little as possible).

This is one of the most common regex gotchas. When you're extracting content between delimiters, you almost always want the lazy version.

Anchors: Position Matters

Anchors don't match characters — they match positions.

Word boundaries are incredibly useful. Without \b, searching for cat will match inside "concatenate", "scattered", and "education". With \bcat\b, you match the standalone word only.

Groups and Capturing

Parentheses serve two purposes: grouping parts of a pattern and capturing matched text for later use.

Backreferences

Captured groups are numbered starting at 1. You can reference them with \1, \2, etc.

This pattern is a classic. It captures a word, looks for whitespace, then checks if the exact same word appears again. It's how most "find duplicate words" features work in text editors.

Named Groups

For readability, you can name your groups:

In JavaScript, named groups show up in match.groups.year, match.groups.month, etc. Much easier to maintain than remembering that group 1 is the year and group 3 is the day.

Non-Capturing Groups

When you need grouping but don't need to capture:

The ?: at the start tells the engine to skip storing this match. It's a small performance improvement, but more importantly it keeps your capture group numbering clean.

Lookaheads and Lookbehinds

These are the patterns that make people say regex is unreadable. But they solve problems that nothing else can.

Lookaheads and lookbehinds check if something exists before or after the current position without including it in the match.

A practical example: password validation that requires at least one uppercase letter, one digit, and is at least 8 characters long.

Each lookahead runs independently from the start of the string. (?=.*[A-Z]) checks that an uppercase letter exists somewhere. (?=.*\d) checks that a digit exists somewhere. Then .{8,} actually consumes the string and ensures it's at least 8 characters.

Real-World Patterns

Here's where it all comes together. These are patterns I actually use in production.

Email Validation

This covers the vast majority of valid email addresses. It's not RFC 5322 compliant (almost nothing is), but it catches obviously invalid input while allowing real addresses through.

• [a-zA-Z0-9._%+-]+ — one or more valid local-part characters
• @ — literal at symbol
• [a-zA-Z0-9.-]+ — domain name
• \.[a-zA-Z]{2,} — dot followed by TLD (2+ letters)

URL Matching

This matches HTTP and HTTPS URLs with optional www, domain, TLD, and path/query parameters.

Phone Numbers (US Format)

Matches these formats:

• 555-123-4567
• (555) 123-4567
• +1 555 123 4567
• 5551234567

Phone number validation is one of those problems where regex gets you 80% of the way. For international numbers with all their formatting variations, a dedicated library is the better choice.

IPv4 Address

This validates that each octet is between 0 and 255. Breaking it down:

• 25[0-5] — matches 250-255
• 2[0-4]\d — matches 200-249
• [01]?\d\d? — matches 0-199

It's repeated three times with dots, then once more without the trailing dot.

Date (YYYY-MM-DD)

Matches ISO 8601 date format with basic validation:

• Month: 01-12
• Day: 01-31

It won't catch February 30th — that's a semantic validation problem, not a pattern matching problem. Regex handles syntax; your application logic handles semantics.

HTML Tags

For simple tag matching. But honestly, don't parse HTML with regex. Use a proper parser. The regex above breaks on nested tags, self-closing tags with attributes, and about a hundred other edge cases. I include it because people always ask for it, and it's genuinely useful for quick log scanning — just not for production HTML processing.

Extracting Numbers from Text

Matches integers and decimals, including negative numbers: 42, -7, 3.14, -0.5.

Hex Color Codes

Matches both 6-digit (#FF5733) and 3-digit (#F00) hex color codes.

Slug Validation (URL-friendly strings)

Matches lowercase alphanumeric strings separated by single hyphens. No leading hyphens, no trailing hyphens, no consecutive hyphens.

Flags / Modifiers

Flags change how the entire pattern behaves:

In JavaScript:

Common Mistakes to Avoid

Forgetting to escape metacharacters. If you want to match a literal period in a filename like file.txt, use file\.txt not file.txt (which matches fileTtxt, file5txt, etc.).

Not anchoring your pattern. Without ^ and $, the pattern \d{3} matches inside 12345 — it'll find 123 and 234 and 345. If you mean "exactly three digits and nothing else", write ^\d{3}$.

Catastrophic backtracking. Nested quantifiers like (a+)+ can cause exponential processing time on certain inputs. If your regex is hanging, look for nested repetition. A tool like the Regex Tester will highlight performance issues.

Over-engineering validation. A regex that tries to validate every possible edge case of an email address is 6,000 characters long. In practice, the simple version above catches 99.9% of bad input. Let the verification email handle the rest.

Quick-Reference Table

Here's everything on one screen. Bookmark this section.

| Category | Pattern | Matches | | ------------------- | ---------- | ---------------------------------- | ------------------ | | Any character | . | Everything except newline | | Digit | \d | 0-9 | | Non-digit | \D | Anything except 0-9 | | Word char | \w | a-z, A-Z, 0-9, _ | | Whitespace | \s | Space, tab, newline | | Zero or more | * | Preceding element, 0+ times | | One or more | + | Preceding element, 1+ times | | Optional | ? | Preceding element, 0 or 1 time | | Exact count | {n} | Preceding element, exactly n times | | Range | {n,m} | Preceding element, n to m times | | Start of string | ^ | Position at start | | End of string | $ | Position at end | | Word boundary | \b | Between word and non-word char | | Capture group | (...) | Groups and captures | | Non-capture | (?:...) | Groups without capturing | | Lookahead | (?=...) | Asserts what follows | | Neg. lookahead | (?!...) | Asserts what does NOT follow | | Lookbehind | (?<=...) | Asserts what precedes | | OR | a | b | Matches a or b |

Testing Your Patterns

Reading about regex and writing regex are two different skills. The fastest way to learn is to write a pattern, test it against sample text, and iterate. The Regex Tester tool breaks down your pattern visually and shows matches in real time, which makes it much easier to see what's happening than staring at the pattern in your head.

For more complex scripting with regex, the Code Playground lets you run JavaScript, Python, or any other language with full regex support — useful for testing backreferences and replacements in the context of actual code.

Regex isn't something you memorize once and know forever. It's something you look up, test, adjust, and look up again. That's fine. That's how everyone uses it, including people who've been writing regex for 20 years. Keep this cheat sheet in your bookmarks, and the next time you're staring at a wall of text that needs parsing, you'll know exactly where to start.