Regex cheat sheet

A regular expression, or regex, is a small pattern language for finding and checking text: does this input look like a date, where is every URL in this page, which lines of the log are errors. The reference below is grouped by what you are trying to do, and the filter box searches all of it at once. Type lookbehind, or ES2025 to see what the newest edition added.

Regex comes in flavours that mostly agree and occasionally do not. This sheet documents the JavaScript flavour, as defined by ECMAScript 2025, and every pattern was run on Node.js 24 against text that should match and text that should not. How Python and PCRE differ covers Python's re module and PCRE2, the engine behind PHP's preg_ functions and grep -P. For the string methods the patterns plug into, see the JavaScript cheat sheet. For the pattern attribute on form fields, see the HTML cheat sheet, and for re.sub and friends, the Python cheat sheet.

Named groups and matchAll, start to finish

Most of the tables in one place: named groups, the g and m flags, matchAll, a lookbehind and a replacer function, used to pull a log apart.

const log = `2026-09-27 14:02:11 ERROR [payments] Card declined for order 1042
2026-09-27 14:02:15 INFO [search] 12 results for "cat beds"
2026-09-27 14:03:40 WARN [payments] Retry 2 of 3 for order 1042
2026-09-27 14:05:02 ERROR [auth] Token expired for user 77`;
 
const line =
  /^(?<date>\d{4}-\d{2}-\d{2}) (?<time>\d{2}:\d{2}:\d{2}) (?<level>ERROR|WARN|INFO) \[(?<service>[\w-]+)\] (?<message>.*)$/gm;
 
const entries = [...log.matchAll(line)].map((m) => ({ ...m.groups }));
console.log(entries.length); // 4
console.log(entries[1].message); // 12 results for "cat beds"
 
const errors = entries
  .filter((e) => e.level === "ERROR")
  .map((e) => `${e.time} ${e.service}`);
console.log(errors); // [ '14:02:11 payments', '14:05:02 auth' ]
 
const orders = new Set(log.match(/(?<=order )\d+/g));
console.log([...orders]); // [ '1042' ]
 
const redacted = log.replace(/(?<=user )\d+/g, (id) => "*".repeat(id.length));
console.log(redacted.split("\n").at(-1)); // 2026-09-27 14:05:02 ERROR [auth] Token expired for user **

The m flag is what lets ^ and $ match at each line of the log rather than only at its very start and end, and matchAll needs the g. .* in the message group cannot run on to the next line, because a dot does not match a line break. The lookbehind in (?<=order )\d+ checks for the word without including it, so the match is just the number. Copying m.groups into a plain object with { ...m.groups } is optional, but it prints more tidily: the original has no prototype.

The HTML pattern attribute, start to finish

A form field can check its value against a regex with no JavaScript at all.

<label for="ref">Order reference</label>
<input id="ref" name="ref" required
       pattern="[A-Z]{3}-\d{4}"
       title="Three capital letters, a dash and four digits, like CAT-2026">

The browser wraps the attribute in ^(?: and )$ and compiles it with the v flag, so this is what it runs:

const pattern = String.raw`[A-Z]{3}-\d{4}`;
const re = new RegExp(`^(?:${pattern})$`, "v");
 
console.log(re.test("CAT-2026")); // true
console.log(re.test("CAT-2026x")); // false: the whole value has to match
console.log(re.test("cat-2026")); // false: case-sensitive, and there is no i flag
 
try {
  new RegExp(String.raw`^(?:[\w-]+)$`, "v");
} catch (err) {
  console.log(err.name); // SyntaxError, so a browser ignores pattern="[\w-]+"
}

Three things follow. You never need ^ and $ in a pattern, since the whole value always has to match. There is no way to add a flag, so allow both cases with [A-Za-z]. And because of the v flag, a pattern with an unescaped - in a class is invalid, and the browser skips the check without a word. The HTML cheat sheet has the rest of the form attributes, and the server still has to check the value again.

Email, URL and date patterns: what they miss

The common patterns table checks the shape of text. For email, URLs and dates, this is how far a pattern can go, and what to use once it runs out.

// The pattern browsers use for <input type="email">, from the HTML standard
const htmlEmail =
  /^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
 
console.log(htmlEmail.test("ada@example.com")); // true
console.log(htmlEmail.test("ada@localhost")); // true: no dot needed after the @
console.log(htmlEmail.test("josé@example.com")); // false: é is not on the list
console.log(htmlEmail.test('"ada lovelace"@example.com')); // false, though email allows it
 
// URLs: parse them rather than pattern-match them
function isWebUrl(text) {
  if (!URL.canParse(text)) return false;
  const { protocol } = new URL(text);
  return protocol === "https:" || protocol === "http:";
}
 
console.log(isWebUrl("https://example.com/a?b=1")); // true
console.log(isWebUrl("javascript:alert(1)")); // false: a valid URL, but not a web one
console.log(isWebUrl("example.com")); // false: no scheme
 
// Dates: the regex checks the shape, a round trip checks the day exists
function isRealIsoDate(text) {
  const m = /^(?<y>\d{4})-(?<mo>\d{2})-(?<d>\d{2})$/.exec(text);
  if (!m) return false;
  const [y, mo, d] = [m.groups.y, m.groups.mo, m.groups.d].map(Number);
  const date = new Date(Date.UTC(y, mo - 1, d));
  return date.getUTCFullYear() === y && date.getUTCMonth() === mo - 1 && date.getUTCDate() === d;
}
 
console.log(isRealIsoDate("2026-09-27")); // true
console.log(isRealIsoDate("2026-02-31")); // false: Date rolls it over to 3 March
console.log(isRealIsoDate("2028-02-29")); // true: 2028 is a leap year

Even the standard's own email pattern is a deliberate compromise: it rejects addresses the email standard allows, and accepts ones no mail server will deliver to. Use it, or the rough check from the table, to catch typos, then send a confirmation email. For URLs, URL.canParse does the parsing and the protocol check rules out javascript: links, which a loose pattern would let through. For dates, building a Date from the parts and reading them back is what catches 31 February, because Date quietly rolls an impossible day over into the next month.

How Python and PCRE differ

The core is shared: classes, anchors, quantifiers, groups, | and lookahead read the same everywhere. These are the differences that break a pattern when you copy it from one language to another. Python is the re module in Python 3.14. PCRE is PCRE2, which PHP's preg_ functions and grep -P use.

Two Python habits trip people up the other way round. re.match only looks at the start of the string, so re.match(r"\d+", "ab12") is None: use re.search to look anywhere. And re.findall returns the groups rather than the whole match when the pattern has any, so re.findall(r"(\w+)@\w+", s) gives just the names before the @.

Gotchas

The regex mistakes almost everyone makes, most of them more than once.

Common questions