Regex Reference:
Patterns, Syntax & Testing

Regular Expressions: The Tool Every Developer Uses but Nobody Enjoys Writing

Regex is simultaneously the most powerful and most frustrating pattern-matching tool in programming. A single regex pattern can validate an email address, extract all URLs from a document, or reformat a thousand phone numbers into a consistent format — tasks that would take dozens of lines of imperative code. But regex syntax is notoriously opaque. \b(?:\d{1,3}\.){3}\d{1,3}\b matches an IP address, but reading it from scratch, you'd be forgiven for thinking it's line noise. This is why cheat sheets exist — because no developer, no matter how experienced, writes regex from memory for anything beyond the simplest patterns.

Our regex cheat sheet puts the most commonly used syntax in one place, with a built-in tester to verify patterns immediately. Find the syntax you need, copy it, test it, and move on. The cheat sheet covers character classes, quantifiers, anchors, groups, lookarounds, flags, and common patterns for email, URL, phone, and IP matching.

Character Classes: Matching What You Mean

Literal characters match themselves: /cat/ matches "cat" in "catalog". Character classes match any character from a set: /[aeiou]/ matches any vowel. Predefined classes handle common cases: \d matches any digit (0-9), \w matches any word character (letters, digits, underscore), \s matches any whitespace. Their uppercase counterparts negate: \D matches non-digits, \W matches non-word characters. The dot (.) matches any character except newline — deceptively simple, but it's the most used and most abused character class. /.*/ matches everything, which is rarely what you actually want.

Custom character classes with square brackets: /[aeiou]/ vowels, /[0-9a-f]/ hex digits, /[^a-z]/ anything NOT a lowercase letter. Ranges work on ASCII order, not natural language order — /[A-z]/ includes the six characters between uppercase Z (90) and lowercase a (97): [\]^_ and backtick. This catches people off guard when they try to match "any letter" with [A-z] instead of [A-Za-z].

Quantifiers: How Many Times

Quantifiers control repetition. Greedy quantifiers match as many characters as possible while still allowing the overall pattern to match. Lazy quantifiers (with ?) match as few as possible. The distinction matters: on the string "hello world", the pattern /h.*o/ (greedy) matches "hello wo" — it grabbed everything up to the last 'o'. The pattern /h.*?o/ (lazy) matches "hello" — it stopped at the first 'o'. Greedy matching is the default in every regex engine. If your regex is matching more text than you expected, you probably need lazy quantifiers.

Exact counts: \d{3} matches exactly 3 digits. \d{3,} matches 3 or more. \d{3,5} matches 3 to 5. The ? quantifier means zero or one — making the preceding token optional. The + means one or more. The * means zero or more. Combined with character classes: /\d{4}-\d{2}-\d{2}/ validates a YYYY-MM-DD date format (though it doesn't validate that the month is 01-12 or the day is valid for that month — regex validates format, not semantics).

Groups and Capture

Parentheses create capturing groups. /(\d{4})-(\d{2})-(\d{2})/ captures the year, month, and day separately. In replacement strings, $1, $2, $3 reference these groups. To reformat a date from YYYY-MM-DD to MM/DD/YYYY: replace /(\d{4})-(\d{2})-(\d{2})/ with $2/$3/$1. Non-capturing groups (?:...) group without capturing — useful when you need grouping for alternation or quantification but don't need the result. Named groups (?<name>...) assign names to captures, making complex patterns more readable: /(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})/ lets you reference $<year> in the replacement.

Lookarounds: Matching Without Consuming

Lookaheads and lookbehinds are zero-width assertions — they check if something exists (or doesn't exist) at a position without including it in the match. /\d+(?= dollars)/ matches "100" in "100 dollars" but doesn't include " dollars" in the match. /(?<=\$)\d+/ matches "100" in "$100" but doesn't include the dollar sign. Negative versions: /\d+(?! dollars)/ matches digits NOT followed by "dollars".

Lookarounds are what separate "I know regex" from "I understand regex." They solve problems that would otherwise require convoluted workarounds. Want to find all instances of "Java" that aren't followed by "Script"? /Java(?!Script)/. Want to match a password that must contain at least one digit but also at least one letter? That requires lookaheads: /^(?=.*[a-zA-Z])(?=.*\d).+$/. The two lookaheads each check the entire string for a letter and a digit respectively, without consuming characters. Then .+ matches the actual password. This pattern — multiple lookaheads each checking a different condition — is the standard regex approach to "must contain at least one of each character type."

For building patterns from scratch, use Regex Generator to produce tested patterns for common tasks, then refine them in the cheat sheet's built-in tester.