Regular expressions (regex) are pattern-matching sequences used to search, validate, and manipulate text. They are built into virtually every programming language, text editor, and command-line tool. This cheat sheet covers the essential syntax, compares regex flavors, lists the 20 most useful patterns, and explains common performance pitfalls.
Core Syntax Reference
Character Classes
| Pattern | Matches | Example |
|---|
. | Any character except newline | a.c matches "abc", "a1c" |
\d | Any digit (0-9) | \d{3} matches "123" |
\D | Any non-digit | \D+ matches "abc" |
\w | Word character (a-z, A-Z, 0-9, _) | \w+ matches "hello_42" |
\W | Non-word character | \W matches "@", " " |
\s | Whitespace (space, tab, newline) | \s+ matches " \t" |
\S | Non-whitespace | \S+ matches "hello" |
[abc] | Any of a, b, or c | [aeiou] matches vowels |
[^abc] | Any character except a, b, c | [^0-9] matches non-digits |
[a-z] | Range: a through z | [A-Za-z] matches letters |
Quantifiers
| Pattern | Meaning | Example |
|---|
* | 0 or more (greedy) | ab*c matches "ac", "abc", "abbc" |
+ | 1 or more (greedy) | ab+c matches "abc", "abbc" but not "ac" |
? | 0 or 1 (optional) | colou?r matches "color", "colour" |
{n} | Exactly n times | \d{4} matches "2026" |
{n,} | n or more times | \d{2,} matches "42", "123" |
{n,m} | Between n and m times | \d{1,3} matches "1" to "999" |
*? | 0 or more (lazy) | <.*?> matches first tag only |
+? | 1 or more (lazy) | ".+?" matches first quoted string |
Anchors and Boundaries
| Pattern | Matches |
|---|
^ | Start of string (or line with m flag) |
$ | End of string (or line with m flag) |
\b | Word boundary |
\B | Non-word boundary |
Groups and Lookarounds
| Pattern | Meaning |
|---|
(abc) | Capturing group |
(?:abc) | Non-capturing group |
(?<name>abc) | Named capturing group |
\1 | Backreference to group 1 |
(?=abc) | Positive lookahead |
(?!abc) | Negative lookahead |
(?<=abc) | Positive lookbehind |
(?<!abc) | Negative lookbehind |
a|b | Alternation (a or b) |
Flags
| Flag | Name | Effect |
|---|
g | Global | Find all matches, not just the first |
i | Case-insensitive | Ignore upper/lowercase distinction |
m | Multiline | ^ and $ match line start/end |
s | Dotall | . matches newline characters |
u | Unicode | Enable Unicode matching |
Regex Flavor Comparison
| Feature | JavaScript | Python | PCRE (PHP, Perl) | POSIX |
|---|
| Lookbehind | Fixed-length (ES2018+) | Variable-length | Fixed-length | Not supported |
| Named groups | (?<name>) | (?P<name>) | (?<name>) or (?P<name>) | Not supported |
| Atomic groups | Not supported | Not supported | (?>...) | Not supported |
| Unicode properties | \p{L} with u flag | Limited | \p{L} | Not supported |
| Recursion | Not supported | Not supported | (?R) | Not supported |
| String anchors | ^ / $ | \A / \Z | \A / \Z | ^ / $ |
20 Most Useful Regex Patterns
| Use Case | Pattern | Notes |
|---|
| Email (basic) | [\w.-]+@[\w.-]+\.\w{2,} | Covers most valid emails |
| URL | https?://[\w.-]+(?:/[\w./?%&=-]*)? | HTTP and HTTPS |
| IPv4 address | \b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b | Does not validate ranges |
| Phone (US) | \(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4} | (555) 123-4567 or 555-123-4567 |
| Date (YYYY-MM-DD) | \d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01]) | ISO 8601 date |
| Time (HH:MM) | (?:[01]\d|2[0-3]):[0-5]\d | 24-hour format |
| Hex color | #(?:[0-9a-fA-F]{3}){1,2}\b | #fff or #ff5733 |
| HTML tag | <([a-z]+)[^>]*>.*?</\1> | Simple matching only |
| Positive integer | \b[1-9]\d*\b | No leading zeros |
| Decimal number | -?\d+\.?\d* | Optional negative, optional decimal |
| Username | [a-zA-Z][a-zA-Z0-9_]{2,15} | 3-16 chars, starts with letter |
| Strong password | (?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,} | 8+ chars, mixed case + digit |
| Trailing whitespace | \s+$ | With m flag for per-line |
| Duplicate words | \b(\w+)\s+\1\b | "the the" detection |
| File extension | \.(jpg|jpeg|png|gif|webp)$ | Case-insensitive with i |
| ZIP code (US) | \b\d{5}(-\d{4})?\b | 12345 or 12345-6789 |
| CSS property | [a-z-]+\s*:\s*[^;]+; | Matches property: value; |
| JSON key | "([^"]+)"\s*: | Captures key name |
| Markdown link | \[([^\]]+)\]\(([^)]+)\) | Captures text and URL |
| Empty lines | ^\s*$ | With m flag |
Performance: Catastrophic Backtracking
Regex engines use backtracking to try all possible matches. Certain patterns can cause catastrophic backtracking where the engine explores an exponential number of paths:
- Nested quantifiers:
(a+)+ — the inner and outer + create overlapping possibilities
- Overlapping alternatives:
(a|a)+ — both branches match the same input
- Long strings with no match: The engine tries every combination before concluding "no match"
This can freeze applications and create ReDoS (Regular Expression Denial of Service) vulnerabilities. Protect yourself by:
- Avoiding nested quantifiers on overlapping patterns
- Using possessive quantifiers (
a++) or atomic groups ((?>a+)) where available
- Setting timeout limits on regex execution
- Testing patterns against long, non-matching input before deploying
Test your regex patterns interactively with the WizlyTools Regex Tester — real-time match highlighting with JavaScript regex support.
