Regex Cheat Sheet: The Only Guide You'll Ever Need

Regular expressions are one of those tools that feel like dark magic until you learn the patterns. This cheat sheet covers everything you need for day-to-day development.

The Basics

Quantifiers

Greedy vs Lazy: By default, quantifiers are greedy (match as much as possible). Add ? to make them lazy:

// Greedy: matches the longest possible string
"<div>hello</div>".match(/<.*>/);  // "<div>hello</div>"

// Lazy: matches the shortest possible string
"<div>hello</div>".match(/<.*?>/); // "<div>"

Anchors

/^\d+$/.test("12345");  // true — entire string is digits
/^\d+$/.test("123ab");  // false

Character Classes

[abc]     // a, b, or c
[a-z]     // any lowercase letter
[A-Z0-9]  // uppercase letter or digit
[^abc]    // NOT a, b, or c (negation)

Groups and Capturing

// Capturing group
const match = "2026-05-12".match(/(\d{4})-(\d{2})-(\d{2})/);
// match[1] = "2026", match[2] = "05", match[3] = "12"

// Named group
const match2 = "2026-05-12".match(/(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})/);
// match2.groups.year = "2026"

// Non-capturing group (just for grouping, no capture)
/(?:https?):\/\//

Real-World Patterns

Email validation (simple)

/[\w.-]+@[\w.-]+\.[a-zA-Z]{2,}/

URL extraction

/https?:\/\/[\w.-]+(?:\/[\w./-]*)?/g

Phone number

/\+?\d[\d\s-]{7,}\d/

Hex color

/#[0-9a-fA-F]{3,8}/

IP address

/\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/

Password strength (8+ chars, upper, lower, digit)

/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$/

Lookaheads and Lookbehinds

// Positive lookahead: match "foo" only if followed by "bar"
/foo(?=bar)/

// Negative lookahead: match "foo" only if NOT followed by "bar"
/foo(?!bar)/

// Positive lookbehind: match "bar" only if preceded by "foo"
/(?<=foo)bar/

// Negative lookbehind: match "bar" only if NOT preceded by "foo"
/(?<!foo)bar/

JavaScript Regex Methods

// Test if pattern matches
/\d+/.test("hello123");  // true

// Find first match
"hello123".match(/\d+/);  // ["123"]

// Find all matches
"a1b2c3".matchAll(/\d/g);  // iterator of ["1"], ["2"], ["3"]

// Replace
"hello world".replace(/world/, "JS");  // "hello JS"

// Split
"a,b,,c".split(/,+/);  // ["a", "b", "c"]

Common Mistakes

1. Not escaping special characters: . matches ANY character. Use \. for a literal dot.
2. Forgetting the g flag: Without it, only the first match is returned.
3. Catastrophic backtracking: Nested quantifiers like (a+)+ can cause exponential processing time.
4. Over-engineering email validation: Use a simple pattern + send a verification email instead.

Practice

Test all these patterns live on our Regex Tester. It highlights matches in real-time and shows capture groups — perfect for learning and debugging.