Regex Cheat Sheet: Patterns Every Developer Should Know

Regular expressions are one of the most powerful tools in a developer's toolkit. They let you search, match, extract, and replace text using compact pattern descriptions. Whether you are validating user input, parsing log files, or refactoring code, regex saves hours of manual work. This guide covers every major regex concept with practical examples you can use immediately.

The Anatomy of a Regex

A regular expression consists of two parts: a pattern and optional flags. In JavaScript, a regex literal is written between forward slashes:

/pattern/flags

For example, /hello/i matches the word "hello" in a case-insensitive manner. You can also create a regex using the RegExp constructor:

const re = new RegExp('hello', 'i');

JavaScript provides three primary methods for working with regex patterns:

• .test() — returns true or false depending on whether the pattern matches the string. Ideal for validation.
• .match() — returns an array of matches, or null if no match is found. Use with the g flag to find all matches.
• .replace() — replaces matched substrings with a replacement string or function.

// .test() — boolean check
/^\d{5}$/.test('90210');        // true

// .match() — extract matches
'2026-03-30'.match(/\d+/g);    // ['2026', '03', '30']

// .replace() — transform text
'hello world'.replace(/world/, 'regex');  // 'hello regex'

Understanding when to use each method is essential. Use .test() for simple yes/no validation, .match() when you need to extract data, and .replace() when you need to transform strings.

Anchors and Boundaries

Anchors do not match characters — they match positions within a string. They are essential for ensuring your pattern matches at the right location.

• ^ — matches the start of the string (or start of a line in multiline mode).
• $ — matches the end of the string (or end of a line in multiline mode).
• \b — matches a word boundary, the position between a word character (\w) and a non-word character.
• \B — matches a non-word boundary, the position between two word characters or two non-word characters.

// ^ and $ — full-string validation
/^\d{4}-\d{2}-\d{2}$/.test('2026-03-30');  // true
/^\d{4}-\d{2}-\d{2}$/.test('Date: 2026-03-30');  // false

// \b — whole-word matching
/\bcat\b/.test('the cat sat');     // true
/\bcat\b/.test('concatenate');     // false

// \B — non-boundary matching
/\Bcat\B/.test('concatenate');     // true
/\Bcat\B/.test('the cat sat');     // false

A common mistake is forgetting anchors when validating input. Without ^ and $, the pattern /\d{5}/ would match "12345" inside "abc123456xyz", which is rarely what you want for validation.

Character Classes

Character classes let you match any one character from a defined set. They are the building blocks of most regex patterns.

• \d — any digit (0-9). Equivalent to [0-9].
• \w — any word character (a-z, A-Z, 0-9, _). Equivalent to [a-zA-Z0-9_].
• \s — any whitespace character (space, tab, newline, carriage return).
• . — any character except newline (unless the s flag is set).

Each shorthand has a negated counterpart in uppercase:

• \D — any character that is not a digit.
• \W — any character that is not a word character.
• \S — any character that is not whitespace.

You can also define custom character classes using square brackets:

// Custom ranges
/[a-z]/        // any lowercase letter
/[A-Z]/        // any uppercase letter
/[a-zA-Z]/     // any letter
/[0-9a-fA-F]/  // any hexadecimal digit

// Negated classes
/[^aeiou]/     // any character except lowercase vowels
/[^0-9]/       // any non-digit (same as \D)

// Special characters inside classes
/[.\-+]/       // literal dot, hyphen, plus sign

Inside square brackets, most special characters lose their meaning and are treated as literals. The exceptions are ], \, ^ (at the start), and - (between characters), which must be escaped or placed strategically.

Quantifiers

Quantifiers control how many times a character or group can repeat. They are appended directly after the element they quantify.

• * — zero or more times.
• + — one or more times.
• ? — zero or one time (makes the element optional).
• {n} — exactly n times.
• {n,} — n or more times.
• {n,m} — between n and m times (inclusive).

// Basic quantifiers
/\d+/          // one or more digits
/\w*/          // zero or more word characters
/https?/       // "http" or "https" (s is optional)

// Exact and range counts
/\d{3}/        // exactly 3 digits
/\d{2,4}/      // 2 to 4 digits
/[a-z]{1,}/    // one or more lowercase letters (same as [a-z]+)

By default, all quantifiers are greedy — they match as many characters as possible. This can cause unexpected behavior:

// Greedy (default) — matches the longest possible string
'<b>hello</b>'.match(/<.*>/);
// Result: '<b>hello</b>' (entire string)

// Lazy — matches the shortest possible string
'<b>hello</b>'.match(/<.*?>/);
// Result: '<b>' (first tag only)

To make any quantifier lazy, append a ? after it: *?, +?, ??, {n,m}?. Lazy matching is especially important when parsing markup, log formats, or any delimited text where greedy matching would overshoot.

Groups and Capturing

Parentheses () serve two purposes in regex: they group sub-expressions and capture the matched text for later use.

Capturing groups store the matched text so you can reference it in replacements or extract it from match results:

// Capturing groups — extract parts of a match
const match = '2026-03-30'.match(/(\d{4})-(\d{2})-(\d{2})/);
// match[0] = '2026-03-30' (full match)
// match[1] = '2026'       (year)
// match[2] = '03'         (month)
// match[3] = '30'         (day)

// Back-references in .replace()
'John Smith'.replace(/(\w+) (\w+)/, '$2, $1');
// Result: 'Smith, John'

Non-capturing groups (?:) group sub-expressions without storing the match. Use them when you need grouping for quantifiers or alternation but do not need the captured value:

// Non-capturing group — grouping without capturing
/(?:https?|ftp):\/\//
// Matches "http://", "https://", or "ftp://" without capturing the protocol

Lookaheads assert that a pattern follows (or does not follow) the current position, without consuming characters:

// Positive lookahead (?=...) — assert what follows
/\d+(?= dollars)/.exec('100 dollars');
// Matches '100' (followed by ' dollars', but ' dollars' is not consumed)

// Negative lookahead (?!...) — assert what does NOT follow
/\d+(?! dollars)/.exec('100 euros');
// Matches '100' (not followed by ' dollars')

Lookaheads are invaluable for password validation. For example, to require at least one uppercase letter, one digit, and a minimum length of 8:

/^(?=.*[A-Z])(?=.*\d).{8,}$/

Each (?=...) checks a condition from the start of the string without advancing the position, so multiple conditions can be stacked.

Real-World Patterns

Below are battle-tested regex patterns for common validation and extraction tasks. Each pattern balances strictness with practicality — they work for the majority of real-world inputs without being overly complex.

A few notes on these patterns. The email regex covers the vast majority of valid addresses but does not attempt to implement the full RFC 5322 specification, which allows quoted local parts and other rarely used syntax. For production email validation, consider combining a regex check with a confirmation email. The URL pattern is intentionally simple — for robust URL parsing, use the built-in URL constructor in JavaScript and catch any errors.

Flags Reference

Flags modify how the regex engine processes the pattern. They are placed after the closing slash in a regex literal or passed as the second argument to new RegExp().

• g (global) — find all matches instead of stopping after the first. Essential when using .match() or .replace() to process every occurrence.
• i (case-insensitive) — makes the pattern match regardless of letter case. /hello/i matches "Hello", "HELLO", and "hElLo".
• m (multiline) — changes the behavior of ^ and $ so they match the start and end of each line rather than the entire string. Useful for processing multi-line text like log files.
• s (dotAll) — makes the . character match newline characters as well. Without this flag, . matches everything except \n.
• u (unicode) — enables full Unicode matching. Required for correctly handling characters outside the Basic Multilingual Plane (emoji, CJK extensions) and for using Unicode property escapes like \p{Letter}.

// g — global: find all matches
'aabbaab'.match(/a+/g);            // ['aa', 'aa']

// i — case-insensitive
/hello/i.test('Hello World');       // true

// m — multiline anchors
'line1\nline2'.match(/^\w+/gm);    // ['line1', 'line2']

// s — dotAll: dot matches newlines
/foo.bar/s.test('foo\nbar');        // true

// u — unicode
/\p{Emoji}/u.test('🎉');            // true

Flags can be combined freely. A common combination is gi for a global, case-insensitive search, or gm for matching line-by-line across a multi-line string.