Regex Cheat Sheet: Common Patterns and How to Test Them

Regular expressions look like keyboard noise until they click — and then they become one of the most useful skills you can have. A regex (short for regular expression) is a pattern that describes a set of strings, letting you search, validate, and extract text with surgical precision. This cheat sheet covers the building blocks, the patterns you will reach for most often, and how to test them safely before you ship.

The Building Blocks

Almost every pattern is assembled from a small set of pieces. Learn these and you can read most expressions on sight:

• . — any single character (except a newline).
• \d — any digit, 0–9. \D is the opposite (a non-digit).
• \w — a word character (letters, digits, underscore). \W is the opposite.
• \s — any whitespace (space, tab, newline). \S is the opposite.
• [abc] — a character set: matches a, b, or c. Ranges work too, like [a-z] or [0-9].
• [^abc] — a negated set: any character that is not a, b, or c.
• * — zero or more of the previous item. + is one or more. ? is zero or one (optional).
• {2,5} — a specific count: between 2 and 5 of the previous item. {3} means exactly 3.
• ^ and $ — anchors for the start and end of the string.
• ( ) — a group, used for capturing or applying a quantifier to several characters at once. | means "or".
• \b — a word boundary, so \bcat\b matches "cat" but not "category".

Patterns You Will Actually Use

• Email (simple): [\w.%+-]+@[\w.-]+\.[A-Za-z]{2,} — good enough for form validation. Note that "perfectly" validating email by regex is famously impossible; aim for practical, not exhaustive.
• URL: https?://[^\s]+ — matches http or https followed by non-whitespace.
• US phone number: \d{3}-\d{3}-\d{4} — three digits, a dash, three more, a dash, four more.
• Hex color: #[0-9a-fA-F]{6} — a hash followed by six hexadecimal characters.
• ISO date (YYYY-MM-DD): \d{4}-\d{2}-\d{2} — matches the shape of a date, though not whether it is a real calendar date.
• Whole-string number: ^\d+$ — the anchors ensure the entire input is digits, with nothing else.
• Trim-able whitespace: ^\s+|\s+$ — matches leading or trailing whitespace so you can strip it.

Flags That Change Everything

Flags modify how a pattern is applied. The three you will meet most often:

• g (global) — find all matches, not just the first.
• i (case-insensitive) — treat upper and lower case as equal.
• m (multiline) — make ^ and $ match the start and end of each line, not just the whole string.

Common Mistakes to Avoid

• Forgetting to escape special characters. A literal dot, question mark, or parenthesis must be escaped with a backslash — \. matches a real period, while . matches anything.
• Greedy matching. By default .* grabs as much as possible. Add a ? to make it lazy (.*?) when you want the shortest match.
• Anchoring when you meant to search. ^ and $ restrict the match to the whole string — leave them off if you are searching within larger text.
• Over-engineering. A readable pattern that handles 99% of real inputs beats a monstrous one-liner that nobody can maintain.

Test Before You Trust

The single best habit with regex is to test against real examples — both strings that should match and strings that should not. The Toolism Regex Tester runs entirely in your browser, highlighting matches live as you type so you can refine a pattern in seconds. Paste in some sample text, build your expression, and watch exactly what it captures before you put it into production code.

Regex rewards a little practice enormously. Keep this cheat sheet handy, test as you go, and what once looked like noise will start to read like plain instructions.