Regex Cheat Sheet: Every Token You Actually Use
Regular expressions have hundreds of features, but day-to-day work uses perhaps thirty tokens. This page is those thirty: what each one means, what it matches, and where it bites. Everything here uses JavaScript syntax, which is close enough to Python, Go and PCRE that the differences rarely matter. You can test any of these live in the Regex Tester — paste a pattern, paste some text, and watch the matches highlight as you type.
Character classes
A character class matches exactly one character from a set. The uppercase variants are the negations of their lowercase twins.
| Token | Meaning | Example match |
|---|---|---|
\d | a digit 0–9 | 7 in v7 |
\D | anything but a digit | v in v7 |
\w | word character: letter, digit or _ | a, 9, _ |
\W | anything but a word character | -, a space |
\s | whitespace: space, tab, newline | the gap in a b |
\S | anything but whitespace | x |
. | any character except newline | a, ?, 7 |
[a-f0-9] | one character from a custom range | c, 4 |
[^a-z] | negation: anything not in the set | Q, 3 |
Inside [...] most special characters lose their powers — [.+?] matches a literal dot, plus or question mark. The exceptions are ], \, ^ at the start and - between characters.
Quantifiers
| Token | Meaning | Example match |
|---|---|---|
* | zero or more | a* matches "", aaa |
+ | one or more | \d+ matches 2026 |
? | zero or one | colou?r matches both spellings |
{3} | exactly n | \d{3} matches 404 |
{2,4} | between n and m | a{2,4} matches aa to aaaa |
{2,} | n or more | x{2,} matches xxxxx |
Quantifiers are greedy by default: they grab as much as possible. Against <b>hi</b>, the pattern <.+> matches the entire string, because .+ runs to the last > it can find. Appending ? makes a quantifier lazy — <.+?> stops at the first > and matches just <b>. Nine out of ten “my regex matches too much” bugs are a greedy quantifier that needed to be lazy.
Anchors and boundaries
Anchors match positions, not characters. ^ is the start of the string and $ the end (with the m flag, the start and end of each line). \b is a word boundary — the seam between a \w character and a non-word character — so \bcat\b matches cat but not concatenate. Forgetting anchors is the classic validation bug: \d+ happily “validates” abc123def, while ^\d+$ does not.
Groups and alternation
| Token | Meaning | Example |
|---|---|---|
(...) | capturing group, referenced by number | (\d+)px captures 16 |
(?:...) | non-capturing group — grouping only | (?:ab)+ |
(?<name>...) | named group | (?<year>\d{4}) |
\1 | backreference: match group 1’s text again | ("|')\1 matches paired quotes |
a|b | alternation: a or b | cat|dog |
Alternation has the lowest precedence of anything, so ^cat|dog$ means “starts with cat, or ends with dog” — almost never what you meant. Write ^(?:cat|dog)$. Use (?:...) whenever you only need grouping; it keeps capture numbers stable and is marginally faster.
Lookarounds
Lookarounds assert what surrounds a position without consuming it — the matched text stays untouched, which makes them ideal for surgical find-and-replace.
| Token | Meaning | Example |
|---|---|---|
(?=...) | lookahead: followed by | \d+(?=px) matches 16 in 16px |
(?!...) | negative lookahead: not followed by | \d+(?!px) |
(?<=...) | lookbehind: preceded by | (?<=\$)\d+ matches 25 in $25 |
(?<!...) | negative lookbehind: not preceded by | (?<!\$)\d+ |
Flags
| Flag | Effect |
|---|---|
g | global — find all matches, not just the first |
i | case-insensitive |
m | multiline — ^ and $ anchor at every line |
s | dotall — . also matches newlines |
u | Unicode mode — correct handling of emoji and \p{...} classes |
y | sticky — match must start exactly at lastIndex |
Copy-paste recipes
Five patterns that cover a surprising share of real work. Each is deliberately pragmatic — the caveats are part of the recipe.
^[^\s@]+@[^\s@]+\.[^\s@]+$Email, the honest version: something, an @, something, a dot, something. A fully RFC-compliant email regex is a fool’s errand (the “correct” one runs to thousands of characters and still can’t tell you the mailbox exists) — check the shape, then send a confirmation email.
https?:\/\/[^\s"'<>]+Extracts http/https URLs from free text. It finds URLs; it does not validate them, and it will happily include a trailing ) or comma if the surrounding prose supplies one.
^\d{4}-\d{2}-\d{2}$ISO 8601 date shape (2026-07-25). Shape only: 2026-13-99 passes, so parse it with a real date library afterward.
[ \ ]+$Trailing whitespace — run with the gm flags and replace with nothing to clean every line. Handy before comparing files in the Text Diff tool, where invisible trailing spaces otherwise show up as changed lines.
\b(\w+)\s+\1\bDuplicate adjacent words (“the the”) via a backreference — add the gi flags so “The the” is caught too. Note it only sees exact repeats separated by whitespace.
None of these need to be memorized — keep the tables handy, and when a pattern misbehaves, drop it into the Regex Tester with a failing example. Watching the highlight change as you edit is the fastest regex debugger there is.