Regex Cheat Sheet: Syntax Tables and Ready-Made Patterns

Metacharacters

These are the characters that do not stand for themselves. To match one literally, put a backslash in front of it: \. matches an actual full stop, while an unescaped . matches any character. That is the single most common mistake in patterns written for domain names and filenames, where an unescaped dot quietly matches far more than intended.

Quantifiers

Quantifiers are greedy by default: they take as much as possible and then give characters back until the rest of the pattern fits. Adding ? makes them lazy. Against the input <a><b>, the pattern <.+> matches the whole string while <.+?> matches only <a>. This single distinction is behind most "why did my regex eat the whole line" questions.

Character classes

In JavaScript \w and \d are ASCII-only, so ^\w+$ rejects any word containing an accent or a non-Latin letter. For text in languages other than English, use \p{L} with the u flag instead. Python behaves the opposite way: \w and \d already include Unicode in str patterns unless you pass re.ASCII.

Anchors and boundaries

Anchors match a position, not a character, so they consume nothing. \bcat\b finds the word cat in "cat concat" exactly once, because the cat inside concat has a word character to its left.

Groups, alternation and backreferences

/(?<year>\d{4})-(?<month>\d{2})/    named groups: .groups.year gives "2026"
/(?:ab)+(c)/                       group 1 is "c" — (?: ...) does not capture
/\b(\w+)\s+\1\b/                   finds repeated words: "the the cat"

Use non-capturing groups whenever you only need the grouping. Capture numbering is positional, so inserting one ordinary group near the start of a pattern silently renumbers every group after it and breaks whatever code reads match[3]. Named groups avoid that problem entirely.

Lookaround

/\d+(?= USD)/     matches 45 in "45 USD" but not in "45 EUR"
/(?<=\$)\d+/      matches 99 in "$99", excluding the dollar sign
/^(?=.*\d)(?=.*[a-z]).{8,}$/   at least one digit and one letter, 8+ characters

Flags

The m flag is narrower than its name suggests: it changes only what ^ and $ mean, and has no effect on the dot. To make . cross line breaks you need s. The two are independent and frequently both required when matching across multi-line input.

Ready-made patterns

A word about the email pattern: it is deliberately loose, and that is the honest choice. RFC 5322 permits quoted local parts, comments and nested constructs that no readable regex captures, while the addresses people actually mistype are rejected by no regex at all. The WHATWG HTML standard sidesteps this by defining its own intentionally narrower pattern for input type="email" — which, notably, accepts a@b with no dot in the domain. Use a regex to catch typos, then confirm the address by sending mail to it. That is the only real validation.

Test these patterns

A table cannot tell you why a pattern fails on your particular input. The Regex Tester on this site highlights matches live as you type, lists each capture group with its contents, and lets you toggle flags to see the effect immediately — which is the fastest way to understand greedy versus lazy matching. It runs entirely in your browser, so patterns and test text never leave your device.