Regular Expressions Cheat Sheet: Syntax, Flags, and Common Patterns
Quick Answer
A regex combines literal characters, metacharacters (., \d, \w, \s), quantifiers (*, +, ?, {n,m}), anchors (^, $, \b), and groups ((...), [...]). Flags like g (global), i (case-insensitive), m (multiline) change matching behavior. Test patterns live with our Regex Tester before embedding them in code.
Introduction
Regular expressions (regex) describe text patterns using a compact formal language. They are supported by every modern programming language, editor, and search tool. This cheat sheet is a reference for the syntax defined by ECMAScript (used by JavaScript) plus common patterns you can copy and adapt. Use our Regex Tester to try any pattern against sample text in your browser.
Step by Step
-
Character classes — match a set of characters
[abc] matches a, b, or c. [^abc] matches anything except a, b, c. [a-z] matches any lowercase letter. Predefined classes: \d = [0-9], \D = non-digit, \w = [A-Za-z0-9_], \W = non-word, \s = whitespace, \S = non-whitespace, . = any character except newline (use s flag to include newline).
-
Quantifiers — how many times to repeat
* = 0 or more. + = 1 or more. ? = 0 or 1. {n} = exactly n. {n,} = at least n. {n,m} = between n and m. Add ? for lazy matching (e.g. *? matches as few as possible). Greedy is the default and can cause catastrophic backtracking on nested patterns.
-
Anchors and boundaries — where to match
^ matches the start of the string (or line with m flag). $ matches the end. \b matches a word boundary (between \w and \W). \B matches a non-word-boundary. Anchors are zero-width — they test position without consuming characters.
-
Groups and alternation
(abc) is a capturing group; use $1, $2 in replacements. (?:abc) is a non-capturing group. (?=abc) is a lookahead (asserts what follows). (?!abc) is a negative lookahead. (?<=abc) is a lookbehind (ES2018+). a|b is alternation (a or b).
-
Flags — change matching behavior
g = global (find all matches, not just the first). i = case-insensitive. m = multiline (^ and $ match line boundaries). s = dotAll (. matches newline). u = unicode (treat the pattern as Unicode code points; needed for emoji and astral characters). y = sticky (match at lastIndex only).
Examples
Match an email address (practical, RFC 5322 simplified)
Input: Pattern: /^[^\s@]+@[^\s@]+\.[^\s@]+$/
Output: Matches 'user@example.com' and 'a.b@sub.domain.co' but not 'plainaddress' or '@no-user.com'
Extract all hex color codes from CSS
Input: Pattern: /#[0-9a-fA-F]{3,8}\b/g
Output: In 'color: #fff; background: #1a2b3c4d' finds ['#fff', '#1a2b3c4d']
Validate an ISO 8601 date (YYYY-MM-DD)
Input: Pattern: /^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$/
Output: Matches '2026-08-28' but rejects '2026-13-01' and '2026-02-31'
Replace digits with # using a capturing group
Input: 'Order 42 shipped' replaced by /(\d+)/g → '#$1'
Output: 'Order #42 shipped'
Common Problems
- Greedy quantifiers matching too much: '<.*>' on '<a><b>' matches the whole string '<a><b>' instead of '<a>'. Use '<.*?>' (lazy) to match '<a>' first.
- Catastrophic backtracking: nested quantifiers like (a+)+b on input 'aaaaaaaaaaaaaaaa!' can take exponential time. Rewrite the pattern or use atomic groups / possessive quantifiers where supported.
- Forgetting the u flag for Unicode: /^.$/ matches a single code unit, so emoji like '😀' (two code units) fails without the u flag. Always add u when matching astral characters.
- Confusing \b (word boundary) with \s (whitespace): \b matches between a word and non-word character, so it works at start/end of string too. \s only matches actual whitespace characters.
Tips
- Always test regex against both matching and non-matching samples in our Regex Tester before embedding it in production code — edge cases are easy to miss.
- Prefer character classes [a-z] over alternation (a|b|...|z) for single characters — classes are faster and clearer.
- Use non-capturing groups (?:...) when you do not need the captured value — capturing has a small performance cost and clutters the result array.
- Compile regex once with new RegExp() or a literal at module scope, not inside a hot loop — recompiling the same pattern on every iteration wastes CPU.