Regex Cheat Sheet

Matches the very start of the string. With the m flag, matches the start of every line instead.

Matches the very end of the string. With the m flag, matches the end of every line instead.

Matches a word boundary — the position between a word character (\w) and a non-word character, or the start/end of the string. Doesn't consume any character itself.

The inverse of \b — matches everywhere a word boundary doesn't. Rarely reached for directly, but useful for matching inside a word without touching its edges.

Matches any single character except line terminators — unless the s flag is set, in which case it matches those too.

Matches any digit, equivalent to [0-9]. \D is the negation — any non-digit.

Matches any 'word' character: letters, digits, and underscore — equivalent to [A-Za-z0-9_]. \W is the negation.

Matches any whitespace character — spaces, tabs, newlines. \S is the negation, any non-whitespace character.

A custom character class — matches any single character that appears inside the brackets. [abc] matches exactly one of 'a', 'b', or 'c', not the sequence 'abc'.

A negated character class — matches any single character that is not one of the listed ones. The ^ only means 'negate' as the very first character inside the brackets.

A range inside a character class. Ranges can be combined and mixed with literal characters: [a-zA-Z0-9_-] matches letters, digits, underscore, or hyphen.

Matches the preceding token 0 or more times, greedily — as many times as possible before backtracking.

Matches the preceding token 1 or more times, greedily. The most common quantifier in practice.

Matches the preceding token 0 or 1 times — makes it optional. (Also reused as part of non-capturing groups, lookaround, and lazy quantifiers — context decides which meaning applies.)

Exact repetition counts: {n} exactly n times, {n,} n or more times, {n,m} between n and m times inclusive.

Adding ? after a quantifier makes it lazy instead of greedy — it matches as few characters as possible instead of as many.

A capturing group. Groups a subpattern (so a quantifier or alternation applies to the whole thing) and saves what it matched, accessible as match[1] or, in a replacement string, $1.

A non-capturing group — groups without saving the match. Use this whenever you need the grouping behavior but don't care about extracting that piece; it keeps your numbered groups predictable as you add more.

A named capturing group. Access it as match.groups.name instead of a numbered index — considerably more readable once a pattern has more than one or two groups.

\1 backreferences group 1 later in the same pattern (e.g. matching a repeated word). $1 backreferences group 1 inside a replacement string passed to .replace().

Matches a or b. The alternation extends as far left and right as the surrounding group or pattern boundary allows, which surprises people the first time.

Wrapping alternatives in a group scopes the | to just what's inside it. Without the group, cat|dog anywhere inside a longer pattern applies to everything on either side of the pipe, not just the word.

Positive lookahead — asserts that what follows matches the pattern, without consuming those characters as part of the overall match.

Negative lookahead — asserts that what follows does NOT match the pattern.

Positive lookbehind — asserts that what precedes the current position matches the pattern, again without consuming those characters.

Negative lookbehind — asserts that what precedes does NOT match the pattern.

A password-strength check built entirely from lookahead: each (?=...) checks a condition — has a lowercase letter, has an uppercase letter, has a digit — without moving the match position forward, so all three can 'start' checking from the same spot before .{8,} finally consumes the string.

Global — finds every match instead of stopping after the first. Required for .replace() and .match() to affect/return more than one occurrence.

Case-insensitive — 'Cat' and 'cat' both match /cat/i.

Multiline — ^ and $ match the start/end of each line in the string instead of just the very start/end of the whole string.

dotAll — makes . also match newline characters, which it excludes by default.

Unicode mode — treats the pattern as Unicode code points rather than UTF-16 code units, and enables \u{...} escapes. Matters for patterns dealing with emoji or characters outside the Basic Multilingual Plane.

Sticky — matches only starting exactly at lastIndex, without scanning ahead for the next possible match. Used for building tokenizers that consume a string piece by piece.

A loose email match — good enough for 'does this look roughly like an email' form feedback. Not RFC 5322 complete, and no regex truly is.

Matches http:// or https:// URLs. The [^\s/$.?#] after the scheme rejects an empty or malformed host instead of matching an empty string.

A US-style phone number, tolerant of (555) 123-4567, 555-123-4567, and 555.123.4567 formatting.

An ISO 8601 date (YYYY-MM-DD). Checks the shape, not that the date is real — 2026-02-31 still passes.

A loose IPv4 address match. Checks the four-dotted-numbers shape, not that each number is actually 0-255 — 999.999.999.999 would still match.

A hex color code, accepting both the 3-digit shorthand (#fff) and full 6-digit form (#ffffff).

A kebab-case slug — lowercase letters and digits, hyphen-separated, no leading/trailing/double hyphens.