A Developer’s First Regex Cheat Sheet: Understanding Patterns, Groups, and Quantifiers Regular expressions (regex) are one of those tools that feel like magic once they click. They help you validate f...
Regular expressions (regex) are one of those tools that feel like magic once they click. They help you validate forms, parse logs, clean data, search and replace text, and more—across almost every programming language.
But the learning curve can be steep: symbols everywhere, patterns that look like noise, tiny mistakes that change everything.
This guide is a step-by-step, code-focused introduction to regex patterns, groups, and quantifiers—essentially, your first regex cheat sheet. We’ll walk through concepts with practical examples in multiple languages, plus a few mental models and visual aids to make things stick.
At a high level, regex is just a pattern language for text. You write a pattern, and the engine scans text and tells you:
A typical workflow looks like this:
flowchart LR
A[Text Input] --> B[Write Regex Pattern]
B --> C[Test Pattern]
C -->|Match Success| D[Use in Code]
C -->|No Match / Wrong Match| E[Refine Pattern]
E --> B
When experimenting and debugging patterns, it’s useful to use an interactive tool. For example, you can paste your text and patterns into the htcUtils Regex Debugger to see matches, groups, and explanations highlighted in real time.
Literal characters match themselves:
cat"cat" in "The cat sat" "cut", "at"Most characters are literals. The special ones are called metacharacters.
| Symbol | Meaning (default) | Example | Matches |
|---|---|---|---|
. |
Any single character (except newline) | c.t |
cat, cot, c_t |
\d |
Digit [0-9] |
\d\d |
09, 42, 10 |
\w |
Word char [A-Za-z0-9_] |
\w+ |
foo, bar_1, hello123 |
\s |
Whitespace (space, tab, newline…) | a\sb |
a b, a\tb |
\D |
Non-digit | \D+ |
abc, --- |
\W |
Non-word | \W |
#, -, space |
\S |
Non-whitespace | \S+ |
hello, 123, abc_def |
^ |
Start of string/line | ^Hello |
"Hello world" (at start) |
$ |
End of string/line | world$ |
"Hello world" (at end) |
\b |
Word boundary | \bcat\b |
"a cat is here" but not "scatter" |
Flags modify regex behavior. Syntax differs per language, but they’re usually:
i – case-insensitiveg – global (find all matches instead of just one)m – multiline (^ and $ match line boundaries)s – dotall (. matches newlines)JavaScript example:
const text = "Hello\nHELLO";
const pattern = /hello/gi; // g = global, i = case-insensitive
console.log(text.match(pattern)); // ["Hello", "HELLO"]
Character classes let you match one character from a set.
[abc] – a OR b OR c[0-9] – any digit[A-Z] – uppercase letters[a-zA-Z] – any letterconst pattern = /gr[ae]y/;
console.log(pattern.test("gray")); // true
console.log(pattern.test("grey")); // true
console.log(pattern.test("groy")); // false
Use ^ inside the brackets to negate:
[^0-9] – any non-digit[^aeiou] – any non-vowelimport re
pattern = r"[^0-9]+" # one or more non-digits
print(re.findall(pattern, "abc123def456")) # ['abc', 'def']
You’ll often choose between shorthand classes (\d, \w, etc.) and custom ranges:
| Need | Shorthand | Equivalent Class |
|---|---|---|
| any digit | \d |
[0-9] |
| any non-digit | \D |
[^0-9] |
| any word character | \w |
[A-Za-z0-9_] |
| any non-word character | \W |
[^A-Za-z0-9_] |
| any whitespace | \s |
space, tab, newline |
| any non-whitespace | \S |
anything but above |
Choose the one that communicates intent clearly to your future self.
Quantifiers specify how many times a pattern can repeat.
| Quantifier | Meaning | Example | Matches |
|---|---|---|---|
? |
0 or 1 (optional) | colou?r |
color, colour |
* |
0 or more | ab* |
a, ab, abbb |
+ |
1 or more | ab+ |
ab, abb, abbb |
{n} |
exactly n | \d{4} |
1234 |
{n,} |
n or more | \d{2,} |
12, 12345 |
{n,m} |
between n and m (inclusive) | \d{2,4} |
12, 123, 1234 |
Example: validating a 5-digit US ZIP code (basic):
const zipPattern = /^\d{5}$/;
console.log(zipPattern.test("12345")); // true
console.log(zipPattern.test("1234")); // false
console.log(zipPattern.test("123456"));// false
Note the ^ and $ anchoring the entire string to exactly 5 digits.
By default, quantifiers are greedy: they match as much as possible. Add ? to make them lazy (match as little as possible).
.*.*?HTML-ish example (do NOT parse HTML with regex in production, but this shows the idea):
const str = "<p>first</p><p>second</p>";
// Greedy
console.log(str.match(/<p>.*<\/p>/));
// ["<p>first</p><p>second</p>"]
// Lazy
console.log(str.match(/<p>.*?<\/p>/));
// ["<p>first</p>"]
Lazy quantifiers are crucial when you want to avoid “over-matching.”
Groups let you treat multiple characters as a unit, and capturing groups let you extract those parts.
(...)Example: parse "2024-01-15" into year, month, day.
const datePattern = /(\d{4})-(\d{2})-(\d{2})/;
const result = "2024-01-15".match(datePattern);
if (result) {
const [full, year, month, day] = result;
console.log(full); // "2024-01-15"
console.log(year); // "2024"
console.log(month); // "01"
console.log(day); // "15"
}
Here:
(\d{4}) – year(\d{2}) – month(\d{2}) – day(?:...)Sometimes you want grouping without capturing (to avoid cluttering your match results).
Use (?:...):
const pattern = /gr(?:a|e)y/;
console.log("gray".match(pattern)); // ["gray"]
// No extra group indices, just the whole match
Non-capturing groups are great for:
|Alternation is basically “OR” for patterns.
const pattern = /(cat|dog|bird)/;
console.log("I like dogs".match(pattern)[1]); // "dog"
Combine with non-capturing groups when you don’t need to extract which variant:
const pattern = /I (?:love|like|prefer) (coffee|tea)/;
const match = "I prefer tea".match(pattern);
console.log(match[1]); // "tea"
Only the drink is captured; the verb is matched but not captured.
Let’s build a tiny “cheat sheet” of reusable patterns, and show them in code.
A reasonable, pragmatic email regex for many apps:
^[^\s@]+@[^\s@]+\.[^\s@]+$
Explanation:
^ / $ – match the whole string[^\s@]+ – one or more characters that are not whitespace or @@ – literal at symbol\. – literal dot (escaped because . is special)JavaScript example:
function isValidEmail(email) {
const pattern = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
return pattern.test(email);
}
console.log(isValidEmail("[email protected]")); // true
console.log(isValidEmail("invalid@")); // false
Again, not fully RFC-compliant, but useful for many UI validations:
^https?:\/\/[^\s/$.?#].[^\s]*$
https? – http or https:\/\/ – literal ://[^\s/$.?#] – first character of host (not whitespace or some reserved chars).[^\s]* – rest of the URL, no whitespace^\+?1?\s?-?\(?\d{3}\)?\s?-?\d{3}\s?-?\d{4}$
This allows forms like:
555-123-4567(555) 123-4567+1 555 123 4567Python example:
import re
phone_pattern = re.compile(r"^\+?1?\s?-?\(?\d{3}\)?\s?-?\d{3}\s?-?\d{4}$")
tests = [
"555-123-4567",
"(555) 123-4567",
"+1 555 123 4567",
"1234"
]
for t in tests:
print(t, "=>", bool(phone_pattern.match(t)))
For complex patterns like this, running them through a visualizer such as the htcUtils Regex Debugger helps you confirm which parts match which segments of text.
Anchors don’t match characters—they match positions.
^ and $^pattern – pattern at the startpattern$ – pattern at the end^pattern$ – entire string must match patternconst pattern = /^\d+$/; // string of digits only
console.log(pattern.test("123")); // true
console.log(pattern.test("123a")); // false
console.log(pattern.test("a123")); // false
\b and \B\b – boundary between word and non-word characters\B – not a word boundaryconsole.log(/\bcat\b/.test("my cat")); // true
console.log(/\bcat\b/.test("scatter")); // false
console.log(/\bcat/.test("catapult")); // true
console.log(/cat\b/.test("bobcat")); // true
Use \b when you want to match whole words only.
Regex engines treat some characters as special: .^$*+?()[]{}|\.
To match them literally, escape with \:
\. – literal dot\? – literal question mark\[ – literal left bracketExample: match file names ending with .js:
const pattern = /\.js$/;
console.log(pattern.test("app.js")); // true
console.log(pattern.test("style.css")); // false
In many languages, you also need to escape the backslash itself inside string literals. For example, in JavaScript:
// Literal regex (no double escaping)
const regex = /\d+/;
// Regex as string (must escape backslash)
const regexFromString = new RegExp("\\d+");
In Python (raw strings are your friend):
import re
pattern = r"\d+" # raw string, backslashes are literal
print(re.findall(pattern, "abc123def")) # ['123']
Lookarounds are advanced but extremely useful. They let you assert that something comes before or after your match, without including it in the match.
(?=...)“Match X only if it’s followed by Y.”
Example: digits followed by px (CSS-like values):
const pattern = /\d+(?=px)/g;
const str = "10px 1em 20px";
console.log(str.match(pattern)); // ["10", "20"]
Here, px is not part of the match, but it must be present after the digits.
(?!...)“Match X only if it’s NOT followed by Y.”
Example: match cat not followed by fish:
const pattern = /cat(?!fish)/g;
const str = "cat dog, catfish, cat";
console.log(str.match(pattern)); // ["cat", "cat"]
(?<=...)(?<!...)Support varies by language and engine. Modern JavaScript (in most browsers/node) and Python support them, but some older engines don’t.
Python example: extract numbers preceded by $:
import re
pattern = r"(?<=\$)\d+"
text = "Price: $10, discount: $3, total: 13"
print(re.findall(pattern, text)) # ['10', '3']
Lookarounds are great when you want precise matching without having to capture and manually strip surrounding context.
Let’s say you’re parsing log lines in this format:
[2024-01-15 10:23:45] INFO (user=alice) Login successful
[2024-01-15 10:24:10] ERROR (user=bob) Invalid password
You want to extract:
We can build this step by step:
Timestamp: \[([^\]]+)\]
- \[ and \] – literal brackets
- ([^\]]+) – capture everything until the next ]
Whitespace: \s+
Log level (word): (\w+)
Optional spaces: \s+
User in parentheses: \(user=(\w+)\)
Spaces: \s+
Remaining message: (.*) (greedy is fine here since it’s end of line)
Full pattern:
^\[([^\]]+)\]\s+(\w+)\s+\(user=(\w+)\)\s+(.*)$
const logPattern = /^\[([^\]]+)\]\s+(\w+)\s+\(user=(\w+)\)\s+(.*)$/;
const lines = [
"[2024-01-15 10:23:45] INFO (user=alice) Login successful",
"[2024-01-15 10:24:10] ERROR (user=bob) Invalid password"
];
for (const line of lines) {
const match = line.match(logPattern);
if (!match) continue;
const [, timestamp, level, user, message] = match;
console.log({ timestamp, level, user, message });
}
/*
Output:
{ timestamp: '2024-01-15 10:23:45',
level: 'INFO',
user: 'alice',
message: 'Login successful' }
{ timestamp: '2024-01-15 10:24:10',
level: 'ERROR',
user: 'bob',
message: 'Invalid password' }
*/
A pattern like this is complex enough that it’s easy to get wrong on the first try. Tools like the htcUtils Regex Debugger can help you quickly iterate, highlight each group, and confirm that the correct parts of each log line are being captured.
A few habits make regex less painful and more maintainable:
Instead of writing a huge pattern at once:
Some regex engines (like Python’s re.VERBOSE) let you write multi-line, commented patterns:
import re
pattern = re.compile(r"""
^\[
(?P<timestamp>[^\]]+)
\]\s+
(?P<level>\w+)
\s+\(user=
(?P<user>\w+)
\)\s+
(?P<message>.*)
$
""", re.VERBOSE)
line = "[2024-01-15 10:23:45] INFO (user=alice) Login successful"
print(pattern.match(line).groupdict())
Named groups (?P<name>...) also make your code more readable.
If users can influence your pattern (e.g., building a search regex from user input), you must escape special characters to avoid errors and security issues.
In JavaScript:
function escapeRegex(str) {
return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
}
const userInput = "hello.world";
const pattern = new RegExp(escapeRegex(userInput), "g");
console.log("hello.world!".match(pattern)); // ["hello.world"]
You can write a one-line regex that validates every possible email address per RFC 5322. You probably shouldn’t—unless that’s literally your job.
Aim for:
Here’s a condensed reference of what we covered:
a, b, 7.\d, \D\w, \W\s, \S[abc], [0-9][^abc]^, $\b\B?*+{n}{n,}{n,m}*?, +?, ??, {n,m}?(pattern)(?:pattern)pattern1|pattern2(?=pattern), (?!pattern)(?<=pattern), (?<!pattern)Regex is a compact language for working with text: it lets you describe patterns, extract meaningful data, and validate inputs with precision. Once you’re comfortable with:
you can tackle a huge range of parsing and validation tasks across languages.
When building more complex expressions, treat regex like code:
Over time, this cheat sheet will become second nature—and regex will feel less like magic and more like a precise, powerful tool in your everyday developer toolkit.
Building a Production-Ready REST API with Node.js and Express: From Design to Deployment Node.js and Express have become a go-to stack for building REST APIs, but getting from “it works on my machine”...
Read More
From Zero to Production: A Practical CI/CD Pipeline Setup with GitHub Actions and Docker Continuous Integration and Continuous Delivery (CI/CD) used to be something only big teams worried about. Today...
Read More