Home / Tools / Regex Cheat Sheet
Free tool · runs in your browser

Regex Cheat Sheet

Every regex token, quantifier, group and flag in one place, with the differences between languages called out and the mistakes that cause most bugs explained rather than just listed.

Reference

This page is a reference rather than an interactive tool. To try a pattern against your own text, use the regex tester.

How it works

Characters and classes

TokenMatchesExample
.Any character except a newlinea.c matches abc, a c
\d / \DA digit / not a digit\d{4} matches 2026
\w / \WWord character [A-Za-z0-9_] / not\w+ matches user_1
\s / \SWhitespace / not whitespace\s+ matches a run of spaces
[abc]Any one of a, b or c[aeiou] matches one vowel
[^abc]Any character except a, b or c[^0-9] matches a non-digit
[a-z]A range[a-fA-F0-9] matches a hex digit
\bA word boundary (zero width)\bcat\b does not match concat
^ / $Start / end of string, or line with m^https?://
\Escapes a metacharacter\. matches a literal dot

Quantifiers

QuantifierRepeatsNote
*0 or moreGreedy
+1 or moreGreedy
?0 or 1Also makes a quantifier lazy
{n}Exactly n\d{3}
{n,}n or more\d{2,}
{n,m}Between n and m\d{2,4}
*? +? {n,m}?The same, but lazyMatches as little as possible

Quantifiers are greedy by default: they match as much as possible, then give characters back until the rest of the pattern fits. Adding ? makes them lazy, matching as little as possible. This is the difference between <.+> matching an entire line of HTML and <.+?> matching one tag.

Groups, alternation and lookarounds

SyntaxMeaning
(abc)Capturing group, numbered from 1
(?:abc)Non-capturing group — groups without capturing
(?<name>abc)Named capturing group
a|bAlternation: a or b
(?=abc)Positive lookahead — followed by, not consumed
(?!abc)Negative lookahead — not followed by
(?<=abc)Positive lookbehind — preceded by
(?<!abc)Negative lookbehind — not preceded by
\1Backreference to group 1

Lookarounds are zero width: they assert that something is or is not there without consuming it. \d+(?= kg) matches the number in 45 kg but leaves kg out of the match.

Flags

FlagEffect
gGlobal — find every match, not just the first
iCase-insensitive
mMultiline — ^ and $ match at each line break
sDotall — . also matches a newline
uUnicode mode, needed for \p{...} property escapes
xExtended — ignore whitespace and allow comments (not in JavaScript)

Differences between languages

Regex is not one language. The differences that cause real bugs:

  • JavaScript has no x (extended) flag, no atomic groups and no recursion. \d is ASCII-only by default.
  • Python uses re, where \d is Unicode-aware by default — it matches Arabic-Indic digits too. Pass re.ASCII to restrict it.
  • PCRE (PHP, and many tools) adds atomic groups (?>...), possessive quantifiers ++ and recursion.
  • Go uses RE2, which guarantees linear time and therefore has no backreferences and no lookarounds at all.
  • grep needs -E for extended syntax, or you must escape +, ? and {}.

The mistakes that cause most bugs

Catastrophic backtracking. Nested quantifiers over overlapping classes, such as (a+)+$, take exponential time on input that nearly matches. Against user input this is a denial-of-service vector. Avoid nesting quantifiers; prefer specific character classes to .*.

Unescaped dots. . means any character, so example.com also matches exampleXcom. Escape it: example\.com.

Forgetting anchors. Without ^ and $, a validation pattern matches anywhere in the string, so a check for a 4-digit year happily accepts abc2026xyz.

Parsing HTML. HTML is not a regular language; nesting cannot be matched reliably by a regular expression. Use a parser.

Over-strict email patterns. The real RFC 5322 grammar is enormous and most hand-written patterns reject valid addresses. Check for an @ with something either side, then send a confirmation email — which is the only real validation anyway.

What people use it for

  • Writing a validation pattern and needing the right anchors and classes.
  • Reading someone else’s regex in a code review.
  • Porting a pattern between languages where the dialects differ.
  • Debugging a pattern that matches too much — usually a greedy quantifier.
  • Extracting fields from logs with capture groups.

Nothing is uploaded. This tool runs entirely in JavaScript in your browser. Your input is never sent to a server, never logged and never stored, and no account is required. Once the page has loaded you can go offline and it still works — open your browser's network tab and watch if you'd like to confirm it.

Frequently asked questions

What is the difference between greedy and lazy quantifiers?

Greedy quantifiers match as much as possible then backtrack until the rest of the pattern fits; lazy ones, written with a trailing question mark, match as little as possible. It is the difference between <.+> matching a whole line of HTML and <.+?> matching a single tag.

Why does my pattern work in Python but not JavaScript?

The dialects differ. JavaScript has no extended flag, no atomic groups and no recursion, and its \d is ASCII-only, while Python's is Unicode-aware by default. Go's RE2 engine has no backreferences or lookarounds at all.

What is catastrophic backtracking?

A pattern that takes exponential time on input that nearly matches, typically from nesting quantifiers over overlapping character classes such as (a+)+$. Against user-supplied input it is a denial-of-service vector.

Can I use a regex to parse HTML?

No, not reliably. HTML is not a regular language and arbitrary nesting cannot be matched by a regular expression. Use an HTML parser.

What is the correct regex for an email address?

There is no practical one. The RFC 5322 grammar is enormous and most hand-written patterns reject valid addresses. Check for an @ with something either side, then verify by sending a confirmation email.

Tools that run where your code is

This page does its work in your browser because sending your data to a server to process it is a bad default. Catalase applies the same idea to AI coding: a free, open-source code editor that runs language models on your own machine through Ollama, with no account and no telemetry. Cloud models are there when you choose one, not by default.

Download Catalase freeWhat is Catalase?

Related tools

All 30 free developer tools →