Updated June 29, 2026
Regex cheat sheet
The common regular expression syntax shared by JavaScript, Python, and most modern engines, grouped by what each piece does. Combine these tokens to build a pattern.
Character classes
| Token | Matches |
|---|---|
. | Any character except a newline. |
\d | A digit (0-9). |
\D | Any non-digit. |
\w | A word character: letter, digit, or underscore. |
\W | Any non-word character. |
\s | Any whitespace: space, tab, or newline. |
\S | Any non-whitespace character. |
[abc] | Any one of a, b, or c. |
[^abc] | Any character except a, b, or c. |
[a-z] | Any character in the range a to z. |
Quantifiers
| Token | Matches |
|---|---|
* | Zero or more of the preceding item. |
+ | One or more of the preceding item. |
? | Zero or one (makes it optional). |
{3} | Exactly three repetitions. |
{2,4} | Between two and four repetitions. |
{2,} | Two or more repetitions. |
*? | Lazy match: as few as possible. |
Anchors and boundaries
| Token | Matches |
|---|---|
^ | Start of the string or line. |
$ | End of the string or line. |
\b | A word boundary. |
\B | A position that is not a word boundary. |
Groups and alternation
| Token | Matches |
|---|---|
(abc) | A capturing group. |
(?:abc) | A non-capturing group. |
(?<name>abc) | A named capturing group. |
a|b | a or b (alternation). |
\1 | A backreference to the first captured group. |
Lookaround
| Token | Matches |
|---|---|
(?=abc) | Positive lookahead: followed by abc. |
(?!abc) | Negative lookahead: not followed by abc. |
(?<=abc) | Positive lookbehind: preceded by abc. |
(?<!abc) | Negative lookbehind: not preceded by abc. |
Common patterns to copy
Practical starting points. Validation patterns like email and phone are intentionally loose; aim to accept real input rather than reject edge cases.
| Pattern | Matches |
|---|---|
^[^\s@]+@[^\s@]+\.[^\s@]+$ | A basic email shape (one @, a dot in the domain). |
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$ | Password: 8+ chars with a lowercase, uppercase, and digit. |
^https?://[^\s/$.?#].[^\s]*$ | An http or https URL. |
^[a-z0-9]+(?:-[a-z0-9]+)*$ | A URL slug: lowercase words joined by hyphens. |
^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$ | A 3- or 6-digit HEX color. |
^(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)$ | An IPv4 address. |
^\d{4}-\d{2}-\d{2}$ | A date in YYYY-MM-DD form. |
^\+?[\d\s().-]{7,}$ | A loose phone number. |
^\d+$ | Digits only (a whole number). |
\s+ | One or more whitespace characters (handy for collapsing spaces). |
EscapingTo match a special character literally, put a backslash before it:
\. matches a dot, \( matches a parenthesis.References
Questions
What is the difference between greedy and lazy quantifiers?
Greedy quantifiers like * and + match as much as possible, then give back if needed. Adding ? makes them lazy, matching as little as possible, such as *? or +?.
Do these tokens work in every language?
The core tokens here are shared across JavaScript, Python, and most engines. Some advanced features, like lookbehind, vary by engine and version.