Regex Cheat Sheet 2026: Complete Guide with Examples

Regular expressions are one of the most powerful tools in a developer's arsenal, yet they remain one of the most misunderstood. Whether you are validating user input, parsing log files, or performing complex text transformations, a solid understanding of regex patterns saves hours of manual work.

This cheat sheet covers everything from basic syntax to advanced patterns, with real-world examples you can test immediately. Every pattern here has been tested against common edge cases and is production-ready.

1. Basic Syntax Reference

Every regular expression is built from a small set of fundamental building blocks. Once you internalize these, even the most complex patterns become readable. Here is the complete reference table for basic regex metacharacters.

The key concept here is that lowercase shorthand classes (\d, \w, \s) match a category, while their uppercase counterparts (\D, \W, \S) match everything except that category. This inverse pattern is consistent across all regex engines.

2. Quantifiers and Repetition

Quantifiers control how many times a preceding element must appear. Understanding greedy versus lazy matching is critical for writing correct patterns.

Greedy vs. Lazy Matching

By default, quantifiers are greedy -- they match as much text as possible. Adding a ? after a quantifier makes it lazy, matching as little as possible. This distinction is critical when working with HTML or nested structures.

Pattern:  <.+>
Input:    <b>bold</b>
Match:    <b>bold</b>    (the entire string)

Pattern:  <.+?>
Input:    <b>bold</b>
Match 1:  <b>
Match 2:  </b>

3. Groups and Capturing

Groups let you isolate portions of a match for extraction, apply quantifiers to multi-character sequences, and create backreferences for advanced patterns.

Pattern: (?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})
Input:   2026-02-22
Groups:  year=2026, month=02, day=22

Pattern: \b(\w+)\s+\1\b
Input:   "The the quick brown fox fox jumped"
Match 1: "The the"
Match 2: "fox fox"

4. Anchors and Boundaries

Anchors do not match characters -- they match positions in the string. Using anchors correctly ensures your patterns match exactly where intended and prevents partial matches.

The word boundary \b is especially important for search-and-replace operations. Without it, replacing "cat" would also modify "concatenate", "catalog", and "scattered". Always use \b when you want to match whole words only.

5. Character Classes

Character classes (also called character sets) let you define a set of characters that can match at a single position. They are enclosed in square brackets.

Pattern: #[0-9a-fA-F]{6}\b
Input:   "Colors: #FF5733, #00ff00, #123abc, not #xyz"
Match 1: #FF5733
Match 2: #00ff00
Match 3: #123abc

6. Lookahead and Lookbehind

Lookaround assertions check whether a pattern exists ahead of or behind the current position without consuming any characters. They are zero-width -- they match a position, not text.

Pattern: ^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$

Breakdown:
  (?=.*[A-Z])     - Must contain at least one uppercase letter
  (?=.*[a-z])     - Must contain at least one lowercase letter
  (?=.*\d)        - Must contain at least one digit
  (?=.*[@$!%*?&]) - Must contain at least one special character
  {8,}$           - Must be at least 8 characters long

Matches:    "Passw0rd!" "Str0ng@Pass"
No match:   "password" "12345678" "NoSpecial1"

Pattern: (?<=\$)\d+\.?\d*
Input:   "Items cost $19.99, $5, and $149.50"
Match 1: 19.99
Match 2: 5
Match 3: 149.50

7. 20+ Common Regex Patterns

Here are battle-tested patterns for the most common validation and extraction tasks. Each one has been verified against edge cases and is safe for production use.

Email Address

^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$

Matches:    user@example.com, john.doe+tag@company.co.uk
No match:   user@, @domain.com, user@.com

URL (HTTP/HTTPS)

https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)

Matches:    https://example.com, http://www.test.org/path?q=1
No match:   ftp://files.com, example.com (no protocol)

IPv4 Address

^(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)$

Matches:    192.168.1.1, 0.0.0.0, 255.255.255.255
No match:   256.1.1.1, 192.168.1, 1.2.3.4.5

IPv6 Address (simplified)

^([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$

Matches:    2001:0db8:85a3:0000:0000:8a2e:0370:7334
Note:       Does not handle :: shorthand notation

Phone Number (US)

^(\+1[-.\s]?)?(\(?\d{3}\)?[-.\s]?)?\d{3}[-.\s]?\d{4}$

Matches:    (555) 123-4567, 555.123.4567, +1-555-123-4567
No match:   123-456, 1234567890123

Date (YYYY-MM-DD)

^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$

Matches:    2026-02-22, 2025-12-31
No match:   2026-13-01, 2026-02-32, 26-02-22

Time (24-hour HH:MM:SS)

^([01]\d|2[0-3]):([0-5]\d):([0-5]\d)$

Matches:    14:30:00, 00:00:00, 23:59:59
No match:   24:00:00, 12:60:00

Hex Color Code

^#([0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$

Matches:    #FFF, #FF5733, #FF573380 (with alpha)
No match:   #GGG, FF5733 (no hash), #12345

Credit Card Number (major cards)

^(?:4\d{12}(?:\d{3})?|5[1-5]\d{14}|3[47]\d{13}|6(?:011|5\d{2})\d{12})$

Matches:    4111111111111111 (Visa), 5500000000000004 (MC)
Validates:  Visa, Mastercard, Amex, Discover prefixes

Social Security Number (US)

^\d{3}-\d{2}-\d{4}$

Matches:    123-45-6789
No match:   123456789, 123-456-789

Username (alphanumeric, 3-16 characters)

^[a-zA-Z0-9_-]{3,16}$

Matches:    john_doe, user-123, Admin
No match:   ab, this_username_is_too_long, user@name

Strong Password

^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$

Requires:   lowercase, uppercase, digit, special, 8+ chars
Matches:    MyP@ss1word, Str0ng!Pass
No match:   password, PASSWORD1, Pass1234

Slug (URL-friendly string)

^[a-z0-9]+(?:-[a-z0-9]+)*$

Matches:    hello-world, my-blog-post-2026, regex
No match:   Hello-World, --double-dash, trailing-

HTML Tag

<([a-z][a-z0-9]*)\b[^>]*>(.*?)<\/\1>

Matches:    <div>content</div>, <span class="x">text</span>
Captures:   Group 1 = tag name, Group 2 = inner content

CSS Property

([a-z-]+)\s*:\s*([^;]+);

Matches:    "color: red;", "background-color: #fff;"
Captures:   Group 1 = property, Group 2 = value

Import Statement (JavaScript)

import\s+(?:{[^}]+}|\w+|\*\s+as\s+\w+)\s+from\s+['"]([^'"]+)['"]

Matches:    import { useState } from 'react'
Captures:   Group 1 = module name

UUID v4

^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

Matches:    550e8400-e29b-41d4-a716-446655440000
No match:   not-a-valid-uuid, 550e8400e29b41d4a716446655440000

Semantic Version

^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([\da-zA-Z-]+(?:\.[\da-zA-Z-]+)*))?(?:\+([\da-zA-Z-]+(?:\.[\da-zA-Z-]+)*))?$

Matches:    1.0.0, 2.1.3-beta.1, 1.0.0+build.123
No match:   1.0, v1.0.0, 01.0.0

Markdown Link

\[([^\]]+)\]\(([^)]+)\)

Matches:    [Forge Tools](https://example.com)
Captures:   Group 1 = link text, Group 2 = URL

Log Timestamp

\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?

Matches:    2026-02-22T14:30:00.000Z, 2026-02-22 14:30:00+05:30

Whitespace Trimming

^\s+|\s+$

Use with replace to trim leading/trailing whitespace
Input:   "   hello world   "
Replace: "" (empty string)
Result:  "hello world"

Duplicate Lines

^(.+)$\n(?=.*^\1$)

Use with multiline flag to find duplicate lines in text
Handy for deduplicating log files or CSV data

8. Regex Flags Explained

Flags modify how the regex engine processes your pattern. They appear after the closing delimiter (e.g., /pattern/gi) in most languages.

In JavaScript, you can combine flags: /pattern/gim. In Python, use re.IGNORECASE | re.MULTILINE or inline flags like (?im) at the start of the pattern.

9. Performance Tips

Regex performance matters when processing large files, running patterns in tight loops, or validating user input on every keystroke. Here are the most impactful optimizations.

Avoid Catastrophic Backtracking

Nested quantifiers like (a+)+ or (a*)* can cause exponential backtracking on non-matching input. This can freeze your application. Always test patterns against strings that almost match but do not, as those trigger the worst-case behavior.

BAD:   ^(a+)+$        - exponential on "aaaaaaaaaaab"
GOOD:  ^a+$           - linear time, same result

BAD:   ^(\d+\.?\d*)+$ - catastrophic on "1.2.3.4.5.6.7.8.9.x"
GOOD:  ^\d+\.?\d*$    - safe and correct

Use Atomic Groups or Possessive Quantifiers

When supported by your regex engine (Java, .NET, PCRE), possessive quantifiers (++, *+) and atomic groups ((?>...)) prevent backtracking entirely. They are the most effective performance optimization available.

Anchor Your Patterns

Always use ^ and $ for full-string validation. Without anchors, the engine will attempt the match at every position in the string, wasting time on strings that will never match.

Be Specific

Replace .* with more specific patterns when possible. [^"]* is far faster than .*? for matching content within quotes, because it cannot overshoot the closing delimiter.

10. Testing Your Regex

Never deploy a regex without testing it. Here are the categories of test cases every pattern should pass.

• Positive matches: Standard inputs that should match.
• Negative matches: Inputs that should not match.
• Edge cases: Empty strings, very long strings, special characters, Unicode.
• Boundary cases: Minimum and maximum valid lengths.
• Performance cases: Inputs that almost match but fail at the end (to test for backtracking).

You can test all of these interactively in Regex Lab, which provides real-time match highlighting, capture group extraction, and a built-in cheat sheet sidebar.