Regex cheat sheet 2026: copy-paste examples for developers

There is a running joke that when you solve a problem with regex, you now have two problems -- nobody, including the original author three months later, fully understands what it does. That joke exists for a reason. Regex is genuinely powerful. It is also genuinely easy to write in a way that looks correct but is not, that passes your test cases but fails in production, or that works on your machine and causes catastrophic backtracking on a user's input.

This guide exists to make regex legible. You will find 25 copy-paste patterns for the most common validation tasks, syntax tables for when you need to build something custom, and explanations of the mistakes that trip up developers at every level. Whether you are validating an email address, extracting timestamps from log files, or writing a URL router, the patterns here cover the practical ground.

Regex is not a programming language -- it is a pattern specification language. Understanding its building blocks means you can read and write any pattern, not just copy the ones you already recognize.

What is regex?

A regular expression (regex) is a formal pattern that describes a set of strings. When you write \d{4}-\d{2}-\d{2}, you are describing every string that looks like a date in YYYY-MM-DD format. The regex engine reads your pattern and checks whether an input string belongs to that set.

Regex is not a programming language in the traditional sense. It has no variables, no control flow, and no side effects. It is a pattern specification language -- a compact notation for describing text shapes.

Where regex is built in or natively supported:

• •Programming languages: JavaScript, Python, Java, Go, PHP, Ruby, C#, Swift, Kotlin
• •Text editors: VS Code, Vim, Neovim, Sublime Text, JetBrains IDEs
• •Command-line tools: grep, sed, awk, ripgrep
• •Databases: PostgreSQL (POSIX regex), MySQL (REGEXP), SQLite (REGEXP with a user function)
• •Web frameworks: URL routing in Express, Django, Rails, Laravel
• •Log analysis: Logstash, Splunk, Datadog grok patterns

The same core syntax works across all of them with minor variations. Learning regex once makes you more productive everywhere text is involved.

How regex syntax works

Regex syntax is built from a small set of symbols. Most characters match themselves literally -- the letter a matches the letter a. A handful of characters have special meaning: dot, asterisk, plus, question mark, caret, dollar, backslash, parentheses, square brackets, curly braces, and pipe. Escaping any of these with a backslash makes them match literally.

The 25 most useful regex patterns

These 25 patterns cover the most common validation and matching tasks. Copy them as-is or adjust the character sets and quantifiers to fit your specific requirements. All patterns use standard PCRE-compatible syntax that works in JavaScript, Python, Java, PHP, and most other languages.

Email validation regex: pattern breakdown

Email validation is the most requested regex pattern in every programming community, and it is also where developers most often go wrong. The RFC 5321 specification for email syntax is notoriously complex -- technically valid email addresses can contain quotes, comments, and IP addresses in brackets. In practice, almost no real email service accepts the exotic forms.

Pattern:

Password validation regex: pattern breakdown

Password validation uses lookaheads to impose multiple conditions on the same string without actually consuming characters. The four lookaheads in the pattern below each check for a different required character type, then the final character class does the actual matching.

Pattern:

URL validation regex: pattern breakdown

URL validation with regex covers most practical cases but is inherently approximate -- the full URL specification (RFC 3986) allows edge cases that are extremely difficult to match correctly with a pattern. For strict validation, use your language's built-in URL parser instead.

Pattern:

Regex character classes explained

Character classes match any one character from a set. Built-in shorthand classes like \d and \w cover the most common sets. Custom classes use square brackets: [aeiou] matches any vowel.

Important: \w matches only ASCII letters, digits, and underscore by default. It does not match Unicode letters (like accented characters or Chinese text) unless your engine supports Unicode property escapes: \p{L} in JavaScript with the /u flag.

Regex quantifiers explained

Quantifiers control how many times the preceding element is matched. By default, all quantifiers are greedy -- they match as many characters as possible while still allowing the overall pattern to succeed. Adding ? after a quantifier makes it lazy -- it matches as few characters as possible.

The difference between greedy and lazy becomes critical with HTML-like content. The pattern <.+> applied to <b>bold</b> matches the entire string because greedy + consumes as far as possible. The lazy version <.+?> matches only <b>.

Regex anchors explained

Anchors do not match characters -- they match positions in the string. They are zero-width assertions: they check context without consuming any characters from the input. Forgetting anchors is the single most common cause of patterns that “work in testing but fail in production” because the pattern matches a substring of invalid input.

Common regex mistakes

Regex performance problems

Most regex patterns run in microseconds. Two patterns can make them run for seconds or minutes: catastrophic backtracking and excessive quantifier nesting.

Catastrophic backtracking

When nested quantifiers like (a+)+ are used, the regex engine tries every possible way to split the matched characters between the outer and inner quantifiers before concluding a non-match. For a string of 20 characters that nearly-but-not-quite matches, this can mean millions of steps.

# Dangerous -- catastrophic backtracking risk on long input
(a+)+b

# Safer rewrite -- no backtracking for the same purpose
a+b

# Catastrophic in practice: matching "aaaaaaaaaaaaaaaaab" is fast,
# but "aaaaaaaaaaaaaaaaaX" (non-matching) causes millions of steps

Using verbose mode to document complex patterns

Python's re.VERBOSE flag (also written re.X) allows whitespace and comments inside a pattern. Use it for any pattern longer than 40 characters:

# Python: use re.VERBOSE (re.X) to document complex patterns
pattern = re.compile(r"""
    ^                       # Start of string
    [a-zA-Z0-9._%+\-]+    # Local part (before @)
    @                       # @ sign
    [a-zA-Z0-9.\-]+       # Domain name
    \.                     # Literal dot
    [a-zA-Z]{2,}           # TLD (com, io, org, etc.)
    $                       # End of string
""", re.VERBOSE)

Regex tester example

A regex tester lets you enter a pattern and test it against real input in your browser before deploying it. Use it to check multiple inputs at once: valid values, edge cases (empty string, single character, very long string), and intentionally invalid values that should not match.

For each pattern you write, test at minimum:

• •A valid value you expect to match
• •A value with all optional parts present
• •A value with all optional parts absent
• •An empty string
• •A value that is too long or too short
• •A value with a character that should not match
• •A value that is a substring of a valid value (tests whether anchors are correct)

Example: testing the email pattern

# Pattern: ^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$

# VALID -- should match:
user@example.com          # match
john.doe+tag@company.io   # match
test123@sub.domain.co.uk  # match

# INVALID -- should NOT match:
@missing-local.com        # no match (no local part before @)
user@.com                 # no match (dot immediately before TLD)
user@com                  # no match (no dot before TLD)
user @example.com         # no match (space in local part)
(empty string)            # no match (empty input)

Vortenza's free regex tester runs entirely in your browser with no signup required. Test patterns against multiple inputs simultaneously and see match highlighting in real time.

When to use regex vs simpler alternatives

Regex is the right tool for the job in many situations, but it is not always the right tool. The decision framework below reduces the “should I use regex for this?” question to a few concrete checks.

Regex vs string functions

Here are the most common tasks where developers debate between regex and built-in string methods, with a recommendation for each:

Regex engine differences cheat sheet

The same regex pattern does not always behave the same way across languages. The table below highlights the most important differences that affect real code.

Go uses the RE2 engine, which guarantees linear-time matching but does not support backreferences or lookahead. If you are porting a pattern from Python or JavaScript to Go, any pattern using \1, (?=...), or (?<=...) will need to be rewritten.

Regex in Python and JavaScript

Python and JavaScript handle regex differently at the API level even though the core pattern syntax is nearly identical. Here are the key differences that affect everyday usage.

import re

# search() scans entire string; match() only checks start
m = re.search(r'\d+', 'User 42')
m.group()              # '42'

# fullmatch() requires whole string to match
email = re.compile(
    r'^[a-zA-Z0-9._%+\-]+@'
    r'[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$'
)
email.fullmatch('u@ex.com')  # match

# Named groups (Python syntax: ?P<name>)
d = re.search(r'(?P<yr>\d{4})-(?P<mo>\d{2})', '2026-06')
d.group('yr')          # '2026'

// Regex literal avoids string-escaping backslashes
const email = /^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$/;
email.test('u@ex.com');       // true

// g flag returns all matches
'a1 b2 c3'.match(/\d/g);    // ['1', '2', '3']

// Named groups (ES2018+, syntax: ?<name>)
const { yr, mo } = '2026-06'
  .match(/(?<yr>\d{4})-(?<mo>\d{2})/).groups;

• •Python: re.match() only checks the start; re.search() scans the whole string; re.fullmatch() requires a complete match
• •Python: prefix pattern strings with r (raw string) to avoid double-escaping -- r'\\d+' is cleaner than '\\\\d+'
• •JavaScript: regex literals (/pattern/flags) avoid string-escaping entirely and are the idiomatic choice
• •JavaScript: String.prototype.matchAll() (ES2020) returns an iterator of all matches including capture groups
• •Named groups: Python uses (?P<name>...) and match.group('name'); JavaScript uses (?<name>...) and match.groups.name

Regex best practices

One-minute regex audit

Run through this checklist before shipping any regex pattern to production:

Quick regex answers

Frequently asked questions

Tools used in this guide

Related guides