Regex Cheat Sheet for Beginners: Patterns You Actually Use

A regular expression is a pattern that describes a set of strings. You use it to find, validate or replace text: \d{3}-\d{4} matches a phone number like 555-1234, and ^\S+@\S+\.\S+$ is a rough email check. This page covers the dozen constructs that handle almost every everyday job, with examples you can paste straight into a tester.

Literal characters and the dot

Most characters match themselves: cat matches cat inside concatenate. The dot . matches any single character except a newline, so c.t matches cat, cot and c3t. To match a literal dot, escape it: \.. The characters that need escaping are . ^ $ * + ? ( ) [ ] { } | \ and, in some flavors, /.

Character classes

• [abc] one of a, b or c
• [a-z] any lowercase letter; [A-Za-z0-9] any ASCII letter or digit
• [^0-9] anything except a digit (the caret negates inside brackets)
• \d digit, same as [0-9]; \D non-digit
• \w word character, [A-Za-z0-9_]; \W non-word
• \s whitespace (space, tab, newline); \S non-whitespace

Inside brackets most metacharacters lose their meaning, so [.] is a literal dot and [+*] matches a plus or a star.

Quantifiers

• * zero or more: ab* matches a, ab, abbb
• + one or more: ab+ matches ab, abbb, not a
• ? zero or one: colou?r matches color and colour
• {3} exactly three; {2,4} two to four; {2,} two or more

Quantifiers are greedy by default: on <b>bold</b>, the pattern <.+> matches the whole string, not just <b>. Add ? to make it lazy: <.+?> stops at the first >. Better still, avoid the dot and say what you mean: <[^>]+>.

Anchors and boundaries

• ^ start of string (or line, with the m flag)
• $ end of string (or line, with m)
• \b word boundary: \bcat\b matches cat but not concatenate

Without anchors a validation regex is nearly useless. \d{4} matches inside 12345; ^\d{4}$ only matches exactly four digits.

Groups and alternation

Parentheses group and capture. (\d{4})-(\d{2})-(\d{2}) on 2026-10-11 captures 2026, 10 and 11 as groups 1, 2 and 3. Name them with (?<year>\d{4}) and read match.groups.year. Use (?:...) when you want grouping without capture, which keeps group numbers tidy.

The pipe is alternation: jpe?g|png|gif matches any of the three. Group it when it sits inside a larger pattern: \.(jpe?g|png|gif)$.

Flags

• g global: find all matches, not just the first
• i ignore case: /hello/i matches HELLO
• m multiline: ^ and $ match at every line break
• s dotall: . also matches newlines

The Regex Tester supports all four, highlights matches live and lists each capture group so you can see exactly what $1 would contain in a replacement.

Patterns you will actually use

• Trim whitespace: replace ^\s+|\s+$ with nothing
• Collapse multiple spaces: replace \s{2,} with a single space
• Extract numbers: -?\d+(\.\d+)? with g
• ISO date: ^\d{4}-\d{2}-\d{2}$
• 24-hour time: ^([01]\d|2[0-3]):[0-5]\d$
• Hex color: ^#(?:[0-9a-fA-F]{3}){1,2}$
• Simple email: ^[^\s@]+@[^\s@]+\.[^\s@]+$ (good enough for a form; the real RFC grammar is far larger)
• US ZIP: ^\d{5}(-\d{4})?$
• Slug: ^[a-z0-9]+(?:-[a-z0-9]+)*$
• Strip HTML tags: replace <[^>]*> with nothing (for quick cleanup only, never for security)
• Swap first and last name: find ^(\w+)\s+(\w+)$, replace with $2, $1

Do not parse HTML, JSON or nested parentheses with regex. Those grammars nest arbitrarily deep, and regular expressions cannot count. Use a real parser, and keep regex for flat tokens and lines.

Escaping inside strings

A regex written inside a JavaScript or Python string gets escaped twice. The pattern \d+ becomes "\\d+" in a normal string literal, r"\d+" in a Python raw string, or /\d+/ as a JavaScript literal. Forgetting this turns \b into a backspace character and the pattern silently stops matching. When you need to match user input literally, escape it first; the String Escape tool has a regex mode that adds the backslashes for you.

Debugging a pattern that almost works

Shrink the input. Paste the one line that fails, then delete pieces of the pattern until it matches, and add them back one at a time. When a regex-based replacement produces unexpected output across a large file, run the before and after through the Diff Checker to see every changed line; a greedy quantifier eating too much usually shows up as one giant deletion.

Remember that flavors differ. JavaScript, PCRE (PHP and many editors), Python's re, Go's RE2 and POSIX grep share the basics on this page but diverge on lookbehind, possessive quantifiers and Unicode classes. Test in the engine you will ship with.

More text-processing and validation tools are in the developer category.

Try it

Open the Regex Tester, paste a sample of the text you are working with, and build the pattern piece by piece while watching the highlights update.