Regex Cheat Sheet

Character classes, anchors, quantifiers, groups, lookarounds and flags on one page, with copy-ready recipes and the differences between JavaScript, PCRE, Python and Go.

Reviewed 2026-09-16

Regular expression syntax as implemented by JavaScript (ECMAScript), which is also what the Regex Tester uses. Nearly all of it is shared with PCRE, Python, Java, .NET and Ruby; the differences that matter are listed at the end.

Characters and escapes

SyntaxMatches
.Any character except line terminators (\n, \r, \u2028, \u2029). With the s flag, any character at all.
\dASCII digit [0-9]. Unicode digits need \p{Nd} with the u flag.
\wWord character [A-Za-z0-9_]. ASCII only, even with u.
\sWhitespace: space, tab, line breaks, form feed and Unicode spaces such as U+00A0.
\D \W \SThe negations: not a digit, not a word character, not whitespace.
\t \n \r \f \v \0Tab, line feed, carriage return, form feed, vertical tab, NUL.
\xHH \uHHHH \u{H…}Character by hex code. The brace form needs the u flag.
\p{…} \P{…}Unicode property, e.g. \p{L} letter, \p{Lu} uppercase, \p{Script=Greek}, \p{Emoji}. Requires u or v.
\Escape a metacharacter: \. \* \? \( \[ \{ \\ \/ \| \^ \$.

Character classes

SyntaxMatches
[abc]One of a, b or c.
[^abc]Any character except a, b, c.
[a-z]Range. [a-zA-Z0-9_] equals \w.
[\w.-]Class with an escape and literal dot and hyphen. A hyphen is literal when first, last, or escaped.
[\]\\]A literal ] or backslash inside a class must be escaped.
[\p{L}&&[^\p{Lu}]]Set operations (intersection &&, subtraction --) with the v flag: letters that are not uppercase.

Anchors and boundaries

SyntaxMatches
^Start of input, or start of a line with the m flag.
$End of input, or end of a line with m. Does not match before a trailing newline the way Perl’s does.
\bWord boundary: between a \w and a \W (or the edge). \bcat\b matches “cat” but not “concatenate”.
\BNot a word boundary.
(?<=^|\s)There is no \A, \Z or \G in JavaScript; use anchors, boundaries or lookarounds instead.

Quantifiers

SyntaxMatches
*Zero or more.
+One or more.
?Zero or one.
{3}Exactly three.
{2,5}Two to five.
{2,}Two or more.
*? +? ?? {2,5}?Lazy versions: match as little as possible. <.+?> stops at the first >.

Quantifiers are greedy by default: they take as much as possible and give back only if the rest of the pattern cannot match. Lazy quantifiers take as little as possible. JavaScript has no possessive quantifiers (*+) or atomic groups ((?>…)); rewrite with a negated character class to avoid backtracking.

Groups, alternation and backreferences

SyntaxMatches
(abc)Capturing group. Referenced as $1 in replacements and m[1] in match results.
(?<name>abc)Named capturing group. $<name> in replacements, m.groups.name in results.
(?:abc)Non-capturing group: grouping without a capture slot. Prefer it when you do not need the text.
a|bAlternation, lowest precedence. ^(cat|dog)$ not ^cat|dog$.
\1 \k<name>Backreference to what a group captured. (["'])(.*?)\1 matches a quoted string with matching quotes.
(?i:abc)Inline modifier group (ES2025): case-insensitive inside the group only. Supported in current Chrome, Firefox and Safari; check older targets.

Lookahead and lookbehind

SyntaxMatches
x(?=y)Positive lookahead: x only if followed by y. y is not consumed.
x(?!y)Negative lookahead: x only if not followed by y.
(?<=y)xPositive lookbehind: x only if preceded by y.
(?<!y)xNegative lookbehind: x only if not preceded by y.

Lookarounds are zero-width: they test without moving the position. JavaScript lookbehind may contain variable-length patterns, unlike PCRE and Python, which require fixed length.

\d+(?=%)          // "50" in "50%"
(?<=\$)\d+(\.\d\d)?  // "12.50" in "$12.50"
^(?=.*[A-Z])(?=.*\d).{8,}$   // at least 8 chars with an uppercase letter and a digit

Flags

FlagEffect
gGlobal: find all matches; enables matchAll and repeated exec.
iCase-insensitive.
mMultiline: ^ and $ match at line breaks.
sdotAll: . matches line breaks.
uUnicode: correct surrogate pair handling, \p{…}, \u{…}. Also makes invalid escapes an error.
vUnicode sets (ES2024): everything u does plus set operations and string properties like \p{RGI_Emoji}.
ySticky: match only at lastIndex.
dIndices: m.indices gives [start, end] for each group.

Recipes

PatternPurpose
^[\w.+-]+@[\w-]+\.[\w.-]+$Pragmatic email check. Full RFC 5322 validation is impractical in a regex; verify by sending mail.
^https?:\/\/[^\s/$.?#][^\s]*$URL with http or https scheme.
^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$ISO date YYYY-MM-DD with plausible month and day (does not check month length).
^(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)$IPv4 address with each octet 0–255.
^#(?:[0-9a-f]{3}){1,2}$Hex colour, 3 or 6 digits (add i).
^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$UUID (add i).
[ \t]+$Trailing whitespace (use gm).
(\r?\n){3,}Three or more consecutive line breaks; replace with \n\n to collapse blank lines.
<[^>]+>HTML tag (rough). Do not parse HTML with regex beyond quick cleanups.
\B(?=(\d{3})+(?!\d))Positions for thousands separators: "1234567".replace(re, ",") → 1,234,567.

Differences between engines

FeatureJavaScriptPCRE / PHPPython reGo RE2
Named groups(?<n>…)(?<n>…) or (?P<n>…)(?P<n>…)(?P<n>…)
LookbehindYes, variable lengthFixed lengthFixed lengthNo
Possessive / atomicNoYes3.11+No
Inline flags (?i)Group form only, recent enginesYesYesYes
Unicode classes\p{L} with u\p{L} with uVia regex module\p{L}
BackreferencesYesYesYesNo (linear-time guarantee)
\A \Z \zNoYes\A \Z\A \z

The full ECMAScript grammar is in the ECMA-262 specification; MDN’s regular expression guide is the practical reference.

navigateEnter openEsc close