DevToolkit Pro

The hardest part of writing regex isn't the logic. It's remembering the syntax. You end up searching the same Stack Overflow thread five times a week, and the clock keeps ticking. This cheat sheet pulls together the patterns that actually show up in real codebases, grouped by category, each one with a match example and a non-match example. Bookmark this page and you'll cover roughly 90% of everyday regex use. To try any pattern live, paste it into an online regex tester.

Character Classes

Character classes match a category of characters. They're the first thing to reach for.

| Regex | Meaning | Matches | Does Not Match | |-------|---------|---------|----------------| | \d | Any digit | 7 | a | | \D | Any non-digit | a | 7 | | \w | Letter, digit, or underscore | a_1 | @ | | \W | Non-word character | @! | a | | \s | Whitespace (space, tab, newline) | | a | | \S | Non-whitespace | a | | | . | Any character except newline | a 1 ! | newline |

Custom character classes are equally common:

• [aeiou] matches any vowel
• [a-z] matches any lowercase letter
• [A-Z0-9] matches uppercase letter or digit
• [^0-9] matches non-digit (the ^ inside brackets means negation)

Anchors

Anchors match positions, not characters. They constrain the boundaries of your pattern.

| Regex | Meaning | Matches | Does Not Match | |-------|---------|---------|----------------| | ^abc | Starts with abc | abcdef | xabcdef | | abc$ | Ends with abc | xyzabc | abcd | | \babc\b | Standalone word abc | abc (isolated) | xabcy (embedded) | | \Babc | Non-word boundary | xabcy | abc |

By default, ^ and $ match the start and end of the whole string. To match the start and end of each line, add the m flag.

Quantifiers

Quantifiers control how many times the preceding element repeats.

| Regex | Meaning | Matches | Does Not Match | |-------|---------|---------|----------------| | a* | Zero or more | aaa, empty | b | | a+ | One or more | aaa | empty, b | | a? | Zero or one | a, empty | aa | | a{3} | Exactly 3 | aaa | aa | | a{2,4} | 2 to 4 | aaa | a | | a{2,} | 2 or more | aaaa | a |

Default behavior is greedy, which means matching as much as possible. Add ? to make it lazy, so a+? matches the fewest characters. When parsing HTML tags, lazy matching is almost mandatory — a regex explainer can break down exactly why.

Groups and Lookaround

Groups and lookaround build complex patterns. Groups bundle elements together, lookaround matches a position without consuming characters.

| Regex | Meaning | Matches | Does Not Match | |-------|---------|---------|----------------| | (ab)+ | ab repeated once or more | abab | aba | | (?:ab) | Non-capturing group | ab | ba | | a\|b | a or b | a, b | c | | (?=abc) | Followed by abc | position before abc in xyzabc | other positions | | (?!abc) | Not followed by abc | position not before abc | position before abc | | (?<=abc) | Preceded by abc | position after abc in abcdef | other positions | | (?<!abc) | Not preceded by abc | other positions | position after abc |

Captured groups can be referenced with \1, \2. For example, (\w+)\s\1 matches a repeated word like hello hello.

Common Patterns Library

These are the patterns that show up most often in real projects. Copy and adapt.

Email

^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$

Matches user@example.com. Does not match user@example.

URL

https?:\/\/[^\s]+

Matches https://example.com/path. Does not match ftp://example.com.

US Phone Number

^\+?1?[-.\s]?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}$

Matches +1 (555) 123-4567. Does not match 12345.

IPv4 Address

^(?:25[0-5]|2[0-4]\d|[01]?\d\d?)(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)){3}$

Matches 192.168.1.1. Does not match 256.0.0.1.

Date (YYYY-MM-DD)

^\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$

Matches 2026-07-28. Does not match 2026-13-01.

Password Strength (8+ chars, upper, lower, digit)

^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$

Matches Abc12345. Does not match abc12345 (missing uppercase).

Hex Color

^#?(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$

Matches #fff, #1A2B3C. Does not match #1234.

Slug (URL-friendly)

^[a-z0-9]+(?:-[a-z0-9]+)*$

Matches hello-world-123. Does not match Hello World.

UUID v4

^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$

Matches 550e8400-e29b-41d4-a716-446655440000. Does not match abc.

Time (HH:MM 24-hour)

^(?:[01]\d|2[0-3]):[0-5]\d$

Matches 14:30. Does not match 25:00.

Practical Example: Extract Emails with JavaScript

Here's how to pull every email address out of a text block:

const text = "Contact alice@example.com or bob@test.org for details";
const emailRegex = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
const emails = text.match(emailRegex);
console.log(emails);
// ["alice@example.com", "bob@test.org"]

Note the g flag at the end. Without it, match returns only the first result.

Debugging Best Practices

Regex is easy to get wrong. A few habits will save you hours.

First, test incrementally. Don't write a 50-character pattern and then test it. Build it piece by piece, verifying each segment with an online tool. Second, prefer character classes over the dot. [^>]+ is safer than .* because it can't blow past the boundary you intend. Third, watch for catastrophic backtracking. Nested quantifiers like (a+)+ can make the engine explore exponential paths on certain inputs. When a regex hangs, suspect this pattern first. Fourth, use non-capturing groups when you don't need the capture. (?:...) runs faster than (...) and doesn't pollute your group numbers. Fifth, test edge cases. Empty strings, single characters, very long inputs, and Unicode characters should all be in your test set. Running them through a regex tester catches failures before they hit production.

Test Regex Online with DevToolkit Pro

Knowing the syntax is half the battle. Writing regex means constant trial and error. These two browser-based tools let you iterate without leaving your tab:

• Regex Tester: real-time matching, syntax highlighting, and capture group display. All data stays in your browser, nothing is uploaded.
• Regex Explainer: translates a complex regex into plain English so you can read patterns written by someone else.

Use them together. The tester verifies. The explainer decodes. Since everything runs locally, you can paste sensitive logs or production data without worry.

Summary

This cheat sheet covers the five core syntax categories (character classes, anchors, quantifiers, groups, lookaround) plus ten high-frequency real-world patterns including email, URL, phone, IP, date, and password validation. Save it to your bookmarks. The next time you blank on whether it's \w or \S, you'll be glad you did.

This post is brought to you by DevToolkit Pro. For more developer tools, visit the homepage.