Regex Cheat Sheet: Common Patterns Every Developer Needs
A practical regex reference with ready-to-use patterns for email, phone, URL, and more. Each pattern is explained piece by piece so you understand how it works.
8 min read
··Updated: 24 May 2026·By Helperzy Team
Regular expressions are one of the most powerful tools in a developer's kit, yet their dense syntax makes them easy to forget between uses. This cheat sheet collects the patterns you reach for most often — matching emails, phone numbers, URLs, dates, and more — and explains each one piece by piece rather than just dumping cryptic strings. Understanding why a pattern works lets you adapt it to your needs instead of copying blindly. Every pattern here is meant to be tested and tweaked in a regex tester before you ship it, since real-world data is always messier than examples suggest.
Regex Building Blocks You Must Know
Before the patterns, master the core symbols that everything builds on.
Character classes: \d matches any digit, \w matches any word character (letters, digits, underscore), \s matches whitespace. Their uppercase versions \D, \W, and \S match the opposite. Square brackets define custom classes, so [aeiou] matches any vowel and [a-z] matches any lowercase letter.
Quantifiers: * means zero or more, + means one or more, ? means zero or one. Curly braces give exact counts — {3} means exactly three, {2,4} means between two and four, and {2,} means two or more.
Anchors: ^ marks the start, $ marks the end. Use both to match an entire string.
Groups and alternation: parentheses ( ) create capture groups, and the pipe | means OR. So (cat|dog) matches either word. The dot . matches any single character except newline. These pieces combine to express nearly any text pattern, and recognizing them in a complex regex makes it readable.
Matching Email Addresses
A practical email pattern is: ^[\w.+-]+@[\w-]+\.[\w.-]+$
Reading it left to right: the ^ anchors the start. The class [\w.+-]+ matches one or more characters that are letters, digits, underscore, dot, plus, or hyphen — covering the local part before the @, including addresses like alice+news@example.com. Then @ matches the literal at sign. The class [\w-]+ matches the domain name. The \. matches a literal dot (escaped, because an unescaped dot means any character). Finally [\w.-]+ matches the top-level domain and any subdomains, and $ anchors the end.
This pattern accepts the vast majority of real addresses while rejecting obvious garbage. It deliberately does not attempt full specification compliance, because a truly complete email regex is impractically long and still imperfect. For real validation, use this for a quick format sanity check, then verify deliverability by sending a confirmation email. That two-step approach catches typos without rejecting unusual but valid addresses.
Advertisement
Matching Phone Numbers and URLs
Phone numbers vary wildly by country, so flexibility matters. A pattern that handles common US-style formats is: ^\+?\d{0,3}[\s.-]?\(?\d{3}\)?[\s.-]?\d{3}[\s.-]?\d{4}$
Here \+? optionally matches a leading plus for country codes, \d{0,3} allows an optional country code, and [\s.-]? permits a space, dot, or hyphen as a separator. The \(?\d{3}\)? matches a three-digit area code with optional parentheses, and the remaining groups match the rest. This accepts formats like +1 (555) 123-4567 and 555.123.4567.
For URLs, a workable pattern is: ^https?:\/\/[\w.-]+\.[a-z]{2,}(\/\S*)?$
The https? matches http or https (the s is optional). The :\/\/ matches the literal ://, with slashes escaped. Then [\w.-]+\.[a-z]{2,} matches the domain and a top-level domain of at least two letters. The final (\/\S*)? optionally matches a path. Always test these against your real inputs, since international numbers and complex URLs may need adjustment.
Dates, Numbers, and Whitespace Cleanup
These everyday patterns solve common formatting tasks.
ISO date (YYYY-MM-DD): ^\d{4}-\d{2}-\d{2}$ matches four digits, a hyphen, two digits, a hyphen, and two digits. It checks format, not validity — it would accept 2026-13-45, so validate the actual date range separately.
Decimal number: ^-?\d+(\.\d+)?$ matches an optional minus sign, one or more digits, then an optional decimal portion. This catches integers and decimals like 42 and -3.14.
Hex color: ^#[0-9a-fA-F]{6}$ matches a hash followed by exactly six hexadecimal characters, validating colors like #1a2b3c.
Collapsing whitespace: search for \s+ and replace with a single space to clean up text with irregular spacing. Trimming leading and trailing space uses ^\s+|\s+$ as the search pattern with an empty replacement. These find-and-replace patterns are enormously useful when cleaning up pasted or scraped text, turning messy input into consistent, predictable strings in a single operation.
Capture Groups and Find-Replace Tricks
Capture groups do more than match — they let you reorganize text. Each pair of parentheses creates a numbered group you can reference in a replacement using $1, $2, and so on (some tools use \1).
For example, to convert dates from MM/DD/YYYY to YYYY-MM-DD, search for (\d{2})\/(\d{2})\/(\d{4}) and replace with $3-$1-$2. The three groups capture month, day, and year, and the replacement reorders them. This single operation reformats every date in a document.
Named groups make complex patterns clearer. Writing (?<year>\d{4}) lets you reference the group by name instead of number, which helps when a pattern has many groups.
Non-capturing groups, written (?:...), let you group for alternation or quantifiers without creating a numbered capture, which keeps your group numbers clean. Combined with find-and-replace, capture groups turn regex from a search tool into a powerful text transformation engine. Test replacements on a copy first, because a slightly wrong pattern can mangle data quickly across an entire file.
Regex rewards understanding over memorization. Once you internalize the building blocks — character classes, quantifiers, anchors, and groups — the common patterns for emails, phones, URLs, and dates become easy to read and adapt. Keep this cheat sheet handy, but always validate your patterns against real data in a regex tester before deploying, since edge cases hide everywhere. And remember that for some tasks, like full email validation, regex is only the first step rather than the complete solution.
Advertisement
Advertisement
Frequently Asked Questions
What is the difference between greedy and lazy matching in regex?
Greedy matching (the default) grabs as much text as possible while still allowing the overall pattern to match. Lazy matching, written by adding a ? after a quantifier like *? or +?, grabs as little as possible. For example, matching <.+> against <a><b> greedily captures the whole string, while <.+?> lazily captures just <a>. Use lazy matching when you want the shortest possible match, such as parsing individual HTML tags.
Should I use regex to validate email addresses?
Use simple regex for basic format checking, but do not try to fully validate emails with regex. The official email specification is so complex that a complete regex is hundreds of characters long and still imperfect. A practical approach is a simple pattern that checks for an @ symbol with text on both sides and a dot in the domain, then confirm the address actually works by sending a verification email. Over-strict regex rejects valid addresses.
What do the anchors ^ and $ mean in regex?
The caret ^ anchors a match to the start of a string or line, and the dollar sign $ anchors it to the end. Wrapping a pattern in ^ and $ forces it to match the entire string rather than just a part of it. For example, ^\d+$ matches a string that is entirely digits, while \d+ alone would match any string that merely contains digits somewhere.
Why does my regex behave differently in JavaScript and Python?
Regex engines differ between languages in subtle ways. Features like lookbehind, named groups, and Unicode handling vary in syntax and support. JavaScript only added lookbehind support relatively recently, and flag syntax differs across languages. Special characters and escape rules can also vary. Always test your pattern in the actual language you are deploying to, and consult that language's regex documentation rather than assuming patterns are universal.
How do I match special characters literally in regex?
Characters with special meaning in regex — such as . * + ? ( ) [ ] { } ^ $ | and backslash — must be escaped with a backslash to match them literally. For example, to match a literal dot you write \. instead of just a dot, which otherwise matches any character. To match a literal backslash you write two backslashes. A regex tester is the fastest way to confirm your escaping is correct.
