A well-written regular expression can replace 20 lines of string manipulation code. A poorly written one can bring a server to its knees through catastrophic backtracking. This guide covers the patterns developers reach for most often. Test every example in the Regex Tester with live match highlighting.
Character Classes
.any character except newline\ddigit [0-9]\Dnon-digit\wword character [a-zA-Z0-9_]\Wnon-word character\swhitespace (space, tab, newline)\Snon-whitespace[abc]one of a, b, or c[^abc]anything except a, b, or c[a-z]character range
Quantifiers
*zero or more (greedy)+one or more (greedy)?zero or one{n}exactly n times{n,m}between n and m times*?/+?lazy (non-greedy) versions
Anchors and Boundaries
^start of string (or line in multiline mode)$end of string (or line in multiline mode)\bword boundary\Bnon-word boundary
Groups and References
(abc)capturing group(?:abc)non-capturing group(?P<name>abc)named groupbackreference to group 1(?=abc)positive lookahead(?!abc)negative lookahead
Commonly Used Patterns
Useful ready-to-use patterns for validation:
- Email (simplified):
^[\w.+-]+@[\w-]+\.[a-zA-Z]{2,}$ - URL:
^https?://[^\s/$.?#].[^\s]*$ - IPv4 address:
^(\d{1,3}\.){3}\d{1,3}$ - Hex colour:
^#([a-fA-F0-9]{6}|[a-fA-F0-9]{3})$ - Date (YYYY-MM-DD):
^\d{4}-\d{2}-\d{2}$ - Strong password:
^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*\W).{12,}$
Frequently Asked Questions
What is catastrophic backtracking?
When a regex engine tries exponentially many combinations before determining no match exists. A pattern like (a+)+b applied to a long string of as with no trailing b can take seconds or crash a server. Use possessive quantifiers or atomic groups when available, and test with adversarial inputs. The MDN Regular Expressions guide covers ReDoS (Regular Expression Denial of Service).
Are regex patterns the same across all languages?
Core syntax is similar but not identical. PCRE (used in PHP, Perl, Python) supports features like named groups, lookaheads, and possessive quantifiers. JavaScript's regex engine is ECMA-262 compliant and lacks some PCRE features (e.g., lookbehind was added in ES2018). Java uses its own dialect. Always test in the language you are targeting use the Regex Tester for JavaScript patterns.
Should I use regex to validate email addresses?
A simple regex can catch obvious formatting errors, but the full RFC 5321 email specification is too complex for a single regex to handle correctly. The safest approach: use a simple pattern to catch obvious errors, then confirm validity by sending a verification email to the address.