Developer
Encoders, converters & dev utilities
Regex Cheat Sheet & Common Patterns
Regex syntax reference + copy-ready email/date/URL patterns, per-language notes & a live tester. Accurate, instant and free — for United States.
A copy-ready reference for JavaScript-flavour regular expressions: the full token syntax, a library of battle-tested common patterns (each checked in CI against real examples and counter-examples), the per-language differences that trip people up, and a live tester that runs entirely in your browser.
Live regex tester
Test input is capped at 5,000 characters to limit catastrophic-backtracking (ReDoS) risk.
Syntax reference
Anchors
| ^ | Start of string (or line with m flag) | ^abc |
| $ | End of string (or line with m flag) | abc$ |
| \b | Word boundary | \bcat\b |
| \B | Not a word boundary | \Bcat |
Character classes
| . | Any char except newline (all chars with s flag) | a.c |
| \d | Digit — ASCII 0–9 in JS (see engine notes) | \d{3} |
| \w | Word char [A-Za-z0-9_] | \w+ |
| \s | Whitespace (space, tab, newline…) | a\s+b |
| [abc] | Any one of a, b or c | [aeiou] |
| [^abc] | Any char except a, b or c | [^0-9] |
| [a-z] | Any char in the range a–z | [a-z0-9] |
Quantifiers
| * | 0 or more (greedy) | a* |
| + | 1 or more (greedy) | \d+ |
| ? | 0 or 1 (optional) | colou?r |
| {n} | Exactly n times | \d{4} |
| {n,} | n or more times | a{2,} |
| {n,m} | Between n and m times | a{2,4} |
| *? +? ?? | Lazy (non-greedy) — match as few as possible | ".*?" |
Groups & references
| (…) | Capturing group | (ab)+ |
| (?:…) | Non-capturing group | (?:ab)+ |
| (?<name>…) | Named capturing group | (?<yr>\d{4}) |
| \1 | Backreference to group 1 | (\w)\1 |
| a|b | Alternation — a or b | cat|dog |
Lookaround
| (?=…) | Positive lookahead | \d(?=px) |
| (?!…) | Negative lookahead | \d(?!px) |
| (?<=…) | Positive lookbehind | (?<=\$)\d+ |
| (?<!…) | Negative lookbehind | (?<!\$)\d+ |
Flags
| g | Global — find all matches, not just the first | /a/g |
| i | Case-insensitive | /abc/i |
| m | Multiline — ^ and $ match line breaks | /^x/m |
| s | Dotall — . also matches newline | /a.b/s |
| u | Unicode mode (enables \p{…}) | /\p{L}/u |
| y | Sticky — match from lastIndex only | /a/y |
Common patterns (CI-tested)
Email address
^[^\s@]+@[^\s@]+\.[^\s@]+$
Pragmatic email shape: something, an @, a domain, a dot and a TLD — with no spaces.
Caveat: Pragmatic — a perfect RFC-5322 regex is impractical and not worth it; validate deliverability by sending a confirmation email.
ISO date (YYYY-MM-DD)
^\d{4}-\d{2}-\d{2}$A four-digit year, two-digit month and two-digit day joined by hyphens.
Caveat: Shape only — this accepts 2026-13-40; range-check the month/day in code.
HTTP(S) URL
^https?://[^\s/$.?#].[^\s]*$
An http:// or https:// URL with a non-empty host and no whitespace.
Caveat: Matches http(s) URLs loosely; use the URL constructor for real validation.
Phone (E.164)
^\+[1-9]\d{7,14}$A leading +, a non-zero country-code digit, then 7–14 more digits (max 15 total).
Caveat: E.164 international format (no spaces); local formats vary widely.
URL slug (kebab-case)
^[a-z0-9]+(?:-[a-z0-9]+)*$
Lowercase letters/digits in hyphen-separated groups — no leading, trailing or doubled hyphens.
Caveat: Lowercase kebab-case.
Hex color
^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$A # followed by exactly 3 or 6 hexadecimal digits.
Caveat: 3 or 6 hex digits; add {8} for alpha.
IPv4 address
^(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)$Four dot-separated octets, each range-checked to 0–255.
Caveat: Validates 0-255 octets.
Strong password
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$Lookahead-enforced: at least one lowercase, one uppercase and one digit, minimum 8 characters.
Caveat: ≥8 chars with upper+lower+digit; consider a passphrase policy + a breach check instead.
Per-engine differences
| Feature | JavaScript | PCRE | Python (re) | Go (RE2) | .NET |
|---|---|---|---|---|---|
| \d matches | ASCII 0–9 only (even with u — use \p{Nd}) | ASCII unless UCP is set | Unicode by default (ASCII with re.ASCII) | ASCII 0–9 | Unicode unless ECMAScript option |
| Named group | (?<name>…) | (?<name>…) or (?P<name>…) | (?P<name>…) | (?P<name>…) | (?<name>…) |
| Lookbehind | Yes (ES2018+) | Yes | Yes (fixed-width) | No (RE2) | Yes (variable-width) |
| Backreferences | Yes | Yes | Yes | No (RE2) | Yes |
\d is not the same everywhere
Go's RE2 drops backreferences and lookbehind
Avoid catastrophic backtracking (ReDoS)
Greedy vs lazy
How to read a regular expression
A regex is a small language built from four kinds of token: what to match (character classes like \d or [a-z]), how many times (quantifiers like + or {2,4}), where (anchors like ^ and $), and grouping (parentheses, alternation and lookaround).
Character classes
What to match
- \d \w \s — digit, word char, whitespace
- [abc] [^abc] — set / negated set
- . — any char (except newline)
Quantifiers
How many times
- * + ? — 0+, 1+, optional
- {n} {n,} {n,m} — exact / range
- *? — lazy (fewest)
Anchors & groups
Where & grouping
- ^ $ \b — start, end, boundary
- (…) (?:…) — capture / non-capture
- (?=…) (?<=…) — lookaround
Matching an email, a date and a URL
The three most-searched patterns are also the three most misused. Each is a shape check, not a truth check — regex tells you the text looks right, not that it is valid.
^[^\s@]+@[^\s@]+\.[^\s@]+$
Pragmatic shape. A perfect RFC-5322 regex isn't worth it — confirm with a verification email.
ISO date
^\d{4}-\d{2}-\d{2}$
Shape only — it accepts 2026-13-40. Range-check in code.
HTTP URL
^https?://[^\s/$.?#].[^\s]*$
Loose match. For real validation, use the URL constructor.
Regex validates shape, not meaning
Why the same regex differs per language
Regex is a family of dialects, not one standard. A pattern copied from a Python answer can silently behave differently — or fail to compile — in JavaScript or Go.
The \d trap
Go's RE2 has no backreferences or lookbehind
Greedy vs lazy, and catastrophic backtracking
Greedy vs lazy
How much to consume
- <.+> on <a><b> → the whole string
- <.+?> → just <a>
- Add ? to any quantifier to make it lazy
Avoid ReDoS
Don't hang the thread
- Avoid nested quantifiers: (a+)+, (.*)*
- Bound repetition with explicit {n,m}
- Use RE2 for untrusted input
Catastrophic backtracking is a denial-of-service risk
Frequently asked questions
A pragmatic pattern is ^[^\s@]+@[^\s@]+\.[^\s@]+$ — one or more non-space, non-@ characters, an @, a domain, a dot, and a TLD, all with no spaces. This deliberately does not try to be RFC 5322 compliant: a fully correct email regex is thousands of characters long, still rejects some valid addresses, and accepts some invalid ones. The industry practice is to use a loose shape check like this one and then confirm the address really exists by sending a verification email. Do not treat a regex pass as proof the mailbox is real.
Use ^\d{4}-\d{2}-\d{2}$ for the ISO 8601 shape: four digits, a hyphen, two digits, a hyphen, two digits. Be aware this validates shape only — it happily matches 2026-13-40, because regex cannot easily range-check that the month is 1–12 and the day is valid for that month. After the pattern passes, parse the value with a real date library (or Date) and confirm it is a legal calendar date. Regex is the wrong tool for semantic validation of numbers.
By default *, + and {n,m} are greedy: they consume as many characters as possible and then backtrack only if the rest of the pattern fails. Adding a ? makes them lazy (non-greedy): they consume as few as possible and expand only when needed. The classic example is matching <a><b>: the greedy <.+> matches the entire string <a><b>, whereas the lazy <.+?> stops at the first > and matches just <a>. Reach for lazy quantifiers when you want the shortest match between two delimiters.
Regex engines implement different flavours. The biggest trap is \d: in JavaScript it matches only ASCII 0–9, and the u flag does not change that (use \p{Nd} for Unicode digits), whereas Python 3 treats \d as Unicode by default unless you pass re.ASCII. Go uses the RE2 engine, which guarantees linear-time matching by dropping backreferences and lookbehind entirely, so patterns using \1 or (?<=…) simply will not compile there. Named groups also differ: (?<name>…) in JS/.NET/PCRE versus (?P<name>…) in Python and Go. Always test a pattern in the engine you will actually run it in.
ReDoS (regular-expression denial of service) happens when a backtracking engine hits a pattern with nested or overlapping quantifiers — classics like (a+)+, (a|aa)+ or (.*)* — on an input crafted to make it explore an exponential number of paths. The match can hang a thread for seconds or minutes, taking a service down. Avoid it by not nesting quantifiers over overlapping alternatives, preferring specific character classes over .*, bounding repetition with explicit {n,m} limits, and using a linear-time engine (such as RE2) for any pattern that runs against untrusted input.
Lookarounds are zero-width assertions: they check that something does or does not appear next to the current position without consuming characters. (?=…) is positive lookahead (the following text must match), (?!…) is negative lookahead (must not match), and (?<=…) / (?<!…) are the positive and negative lookbehind equivalents for the preceding text. A common use is a password rule like ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$, where each lookahead independently asserts that a lowercase letter, an uppercase letter and a digit each appear somewhere, while .{8,} enforces the length.
Method, standards & references
Method: every pattern in the common-patterns library is a JavaScript RegExp checked in continuous integration — each must match all of its example strings and reject all of its counter-examples, so the shapes shown here are verified. The live tester runs entirely in your browser via the native RegExp constructor, guards invalid patterns in a try/catch, and caps the test input to limit ReDoS exposure. Nothing is sent to a server.
How we calculate this
Reviewed by Reckonist Editorial · Last reviewed 4 July 2026. Figures follow the methods and sources set out in our editorial standards.
This reference and tester are for building and debugging regular expressions in the browser. Regex validates the shape of text, not its meaning — always pair a pattern with semantic validation (a real date parse, a URL constructor, a verification email) before trusting user input.
Keep going
Same-category tools follow this colour; a cross-category link keeps its own.