Regex Cookbook Cheat Sheet
A practical reference of regular expression syntax, character classes, quantifiers, groups, and common validation patterns.
2 PagesIntermediateFeb 12, 2026
Character Classes & Anchors
Building blocks for matching character types and positions.
- .- Matches any character except newline (unless dotall/s flag is set)
- \d \w \s- Digit, word character (`[A-Za-z0-9_]`), whitespace — uppercase negates each
- [abc] / [^abc]- Matches any character in the set / any character NOT in the set
- [a-z0-9]- Character range within a set
- ^ / $- Start of string (or line in multiline mode) / end of string or line
- \b / \B- Word boundary / non-word boundary
Quantifiers & Groups
Repetition and capturing syntax.
- * + ?- Zero or more, one or more, zero or one occurrences
- {n,m}- Between n and m repetitions; `{n}` exact, `{n,}` at least n
- (...)- Capturing group; can be referenced later as \1, $1, etc.
- (?:...)- Non-capturing group; groups without creating a backreference
- (?<name>...)- Named capturing group, referenced as group('name') in most engines
- *? +? ??- Lazy (non-greedy) versions of the quantifiers, matching as little as possible
Common Validation Patterns
Ready-to-use patterns for typical inputs.
regex
^[\w.+-]+@[\w-]+\.[a-zA-Z]{2,}$ # basic email^https?://[\w.-]+(:\d+)?(/\S*)?$ # basic URL^\d{3}-\d{3}-\d{4}$ # US phone (123-456-7890)^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$ # password: upper+lower+digit, 8+ chars^\d{4}-\d{2}-\d{2}$ # ISO date YYYY-MM-DD^#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$ # hex color code
Lookaround & Flags
Zero-width assertions and common engine flags.
regex
foo(?=bar) # lookahead: 'foo' only if followed by 'bar'foo(?!bar) # negative lookahead: 'foo' NOT followed by 'bar'(?<=foo)bar # lookbehind: 'bar' only if preceded by 'foo'(?<!foo)bar # negative lookbehind: 'bar' NOT preceded by 'foo'# Common flags/pattern/i # case-insensitive/pattern/g # global (find all matches)/pattern/m # multiline (^ and $ match per line)/pattern/s # dotall (. matches newline too)
Pro Tip
Avoid nested quantifiers like `(a+)+` on untrusted input — they can cause catastrophic backtracking (ReDoS); prefer possessive quantifiers, atomic groups, or a non-backtracking engine when the pattern must run on user-supplied data.
Was this cheat sheet helpful?
Explore Topics
#RegexCookbook#RegexCookbookCheatSheet#ToolsOthers#Intermediate#CharacterClassesAnchors#QuantifiersGroups#CommonValidationPatterns#LookaroundFlags#OOP#CheatSheet#SkillVeris
