Regex Cheat Sheet — Syntax Reference

Every regex symbol, quantifier, group & flag explained with copy-ready patterns.

A free, searchable regex syntax cheat sheet covering anchors (^ $ \b), character classes (\d \w \s, [abc], ranges), quantifiers (* + ? {n,m}, greedy vs lazy), groups & alternation, named & numbered backreferences, lookahead & lookbehind, flags (g i m s u y) including Unicode property escapes (\p{L}), and ready-to-use patterns for email, URL, phone number, date, IP address, hex color and password validation — each with a copy-ready pattern and a real worked example. Also warns about catastrophic backtracking (ReDoS) and includes a quick-reference table comparing JavaScript, Python and PCRE syntax differences (named groups, lookbehind length, Unicode support). Complements the site's interactive Regex Tester: this page teaches the syntax, the Tester lets you try it live. Runs fully in your browser, no sign-up, no API.

About Regex Cheat Sheet — Syntax Reference

Regex Cheat Sheet — Syntax Reference features

Best practices

Escape special characters with a backslash

To match a literal special character like . or $ or ( as itself (not as its special meaning), put a backslash in front of it: \. matches an actual period, \$ matches an actual dollar sign.

Greedy quantifiers can over-match — test on real strings

A pattern like <.+> against "<b>bold</b> and <i>italic</i>" greedily matches the ENTIRE string from the first < to the last >, not just one tag. Switch to <.+?> (lazy) to stop at the first >.

Not every flavor supports every feature

Named groups, lookbehind and Unicode property escapes (\p{...}) were all added to JavaScript regex more recently than the core language — always test in your actual target browser or runtime, not just in your head.

A character class doesn't need most characters escaped

Inside [ ], most special characters (like . or *) lose their special meaning and just match themselves — [.] matches a literal period without needing a backslash, though many people escape it anyway out of habit.

Watch out for catastrophic backtracking (ReDoS)

A pattern with nested repeating groups, like (a+)+b, can take exponentially longer to fail as the input grows — against a long string of a's with no trailing b, the engine tries an enormous number of ways to split up the a's before giving up, and can freeze a real server. Avoid nesting two quantifiers around the same characters; if you must, make the inner group non-capturing and specific rather than open-ended.

Frequently asked questions

What is regex used for?

Regex (regular expressions) is used to search, match, validate or extract text based on a pattern instead of an exact string — like checking if text looks like a valid email address, pulling every phone number out of a document, or finding and replacing text that matches a shape rather than one fixed word.

What is the difference between this page and the Regex Tester tool?

This page is a syntax reference — it explains what each symbol (like \d, \b, (?=...) or the g flag) actually means, with a copy-ready pattern and example for each. The Regex Tester is an interactive tool where you paste your own text and pattern and see live, highlighted matches. Use this page to learn the syntax, then the Tester to try it against your real data.

What does \d mean in regex?

\d matches any single digit, 0 through 9. It's shorthand for the character class [0-9]. Add a quantifier like + to match a run of digits: \d+ matches one or more digits in a row.

What is the difference between * and + in regex?

* matches the previous character or group zero or more times (so it's fine if it's not there at all). + matches it one or more times (it must appear at least once). ab* matches "a", "ab" and "abb"; ab+ matches "ab" and "abb" but not "a" alone.

What does \b mean in regex?

\b matches a word boundary — the position between a word character and a non-word character (or the start/end of the string), without consuming any character itself. \bcat\b matches “cat” as a whole word but not the “cat” inside “concatenate”.

What is a capturing group in regex?

A capturing group, written (...), groups part of a pattern together and saves whatever it matched so you can extract or reuse it. (\d{3})-(\d{4}) matched against “555-1234” captures “555” as group 1 and “1234” as group 2.

What is the difference between greedy and lazy quantifiers?

A greedy quantifier (like .+) grabs as much text as possible while still allowing the overall pattern to match. A lazy quantifier (like .+?, with a ? added) grabs as little as possible instead. Against "<b>bold</b>", <.+> greedily matches the whole string, while <.+?> lazily matches just "<b>".

What is lookahead and lookbehind in regex?

Lookahead (?=...) and (?!...) check what comes AFTER the current position without including it in the match. Lookbehind (?<=...) and (?<!...) check what comes BEFORE the current position, also without including it. They're useful for matching something only when it's next to something else, without capturing that neighbor.

What does the g flag do in regex?

The g (global) flag makes the pattern find every match in the string instead of stopping after the first one. Without it, /cat/ against "cat cat cat" finds only the first “cat”; with /cat/g it finds all three.

Is regex the same in every programming language?

Mostly, yes — the core syntax (character classes, quantifiers, groups) is shared across JavaScript, Python, Java, PHP and more. But some features differ between “flavors”: named group syntax ((?<name>...) in JavaScript vs (?P<name>...) in Python), lookbehind (JavaScript allows variable length, Python requires fixed length) and Unicode property support all vary — the comparison table on this page covers the most common differences.

What is catastrophic backtracking (ReDoS)?

It happens when a pattern has two quantifiers nested around the same characters, like (a+)+b. Against a long input that ultimately fails to match, the engine tries an exponentially growing number of ways to split up those characters before giving up — which can freeze a real server for seconds or minutes. Avoid nesting two open-ended quantifiers around the same text, especially in patterns that run on user-supplied input.

What is a named backreference in regex?

\k<name> refers back to whatever a named group (?<name>...) matched earlier in the pattern, the same way \1 refers back to capturing group 1 — just readable by name instead of by position, which matters once a pattern has more than one or two groups.

How do I match text in any language, not just English letters?

Use Unicode property escapes with the u flag: \p{L} matches any letter in any script (Latin, Devanagari, Kanji and more), and \p{N} matches any digit. \w only matches [A-Za-z0-9_], so it cuts off accented or non-Latin characters that \p{L} handles correctly.

How do I match a literal special character like a dot or dollar sign?

Escape it with a backslash. \. matches a literal period instead of “any character”, and \$ matches a literal dollar sign instead of the end-of-string anchor. Do this for any of . * + ? ( ) [ ] { } ^ $ | \ when you want the character itself.

Is this regex cheat sheet free to use?

Yes — it is 100% free with no sign-up, no login and no limits. The whole reference runs in your browser, so you can search, read and bookmark it without creating an account.

Related tools — Guides & Tutorials