CheatSheetHub / Regex Patterns

Regex Patterns Cheat Sheet

Copy-pasteable patterns for the things you validate constantly, plus the syntax reference for when you need to write your own.

Common patterns Character classes Quantifiers Lookarounds Flags

Ready-to-use patterns

Test these against your actual data before shipping — edge cases vary.
^[\w.+-]+@[\w-]+\.[a-zA-Z]{2,}$Basic email format check.
^https?:\/\/[\w.-]+\.[a-z]{2,}(\/\S*)?$Basic URL match, http or https.
^\d{4}-\d{2}-\d{2}$ISO date format: YYYY-MM-DD.
^\+?[\d\s()-]{7,15}$Loose international phone number match.
^#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$Hex color code, 3 or 6 digits.
\s+One or more whitespace characters (spaces, tabs, newlines).
^\s+|\s+$Leading or trailing whitespace, for trimming.
^[A-Za-z0-9_]{3,16}$A username: letters, numbers, underscore, 3-16 characters.
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$A password: 8+ chars with lowercase, uppercase, and a digit.
^\d{5}(-\d{4})?$A US ZIP code, with optional 4-digit extension.
^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$A UUID/GUID.
^\/([a-z0-9-]+\/?)*$A simple lowercase URL slug path.
^\d+(\.\d{1,2})?$A number with up to 2 decimal places, useful for prices.

Character classes

.Any character except a newline.
\dAny digit (0-9).
\DAny non-digit character.
\wAny word character: letters, digits, underscore.
\sAny whitespace character.
[abc]Any one of a, b, or c.
[^abc]Any character except a, b, or c.
[a-z]Any lowercase letter, a through z.
[A-Z]Any uppercase letter, A through Z.
\bA word boundary — the edge between a word character and a non-word character.
\BA non-word-boundary position.
\n \t \rNewline, tab, and carriage return characters.
[ ad space — 336×280 ]

Quantifiers

*Zero or more of the preceding token.
+One or more of the preceding token.
?Zero or one of the preceding token (makes it optional).
{3}Exactly 3 of the preceding token.
{2,5}Between 2 and 5 of the preceding token.
{2,}2 or more of the preceding token, no upper limit.
.*?Lazy match — as few characters as possible instead of greedy default.
(abc)A capturing group — remembers the matched text for later use.
(?:abc)A non-capturing group — groups without remembering the match.
a|bAlternation — matches "a" or "b".
\1Backreference to the first capturing group's match.

Lookarounds

(?=foo)Positive lookahead — matches only if followed by "foo".
(?!foo)Negative lookahead — matches only if NOT followed by "foo".
(?<=foo)Positive lookbehind — matches only if preceded by "foo".
(?<!foo)Negative lookbehind — matches only if NOT preceded by "foo".
(?=.*[A-Z])(?=.*\d)Combined lookaheads: requires both an uppercase letter and a digit, in any order.

Flags

gGlobal — find all matches, not just the first.
iCase-insensitive matching.
mMultiline — ^ and $ match line boundaries, not just string boundaries.
sDot-all — makes . also match newline characters.

Common questions

What's the difference between a lookahead and a lookbehind in regex?

A lookahead, written (?=...), matches a position only if what follows matches the pattern, without consuming those characters. A lookbehind, written (?<=...), does the same but checks what comes before the current position.

Why does my regex match too much text?

Quantifiers like * and + are greedy by default, matching as much as possible. Add a ? after the quantifier (e.g. .*?) to make it lazy, matching as little as possible instead.

Is it safe to validate emails with a single regex pattern?

A simple pattern catches obvious typos but the full email spec is far more permissive than most people expect. For anything beyond basic format checking, pair regex validation with an actual confirmation email.

Copied