Regex Cheat Sheet: 20 Patterns Every Developer Needs

Regex Syntax Quick Reference

Before the patterns, a brief reminder of the most important metacharacters:

. — any character except newline
^ — start of string (or line in multiline mode)
$ — end of string
* — 0 or more of preceding
+ — 1 or more of preceding
? — 0 or 1 of preceding (also makes quantifiers lazy)
{n,m} — between n and m repetitions
[abc] — character class (a, b, or c)
[^abc] — negated character class
(a|b) — alternation (a or b)
d — digit, w — word char, s — whitespace

20 Essential Regex Patterns

1. Email Address (Practical)

/^[^s@]+@[^s@]+.[^s@]+$/

Intentionally permissive — the only reliable email validation is sending a verification email. This pattern blocks obvious garbage while accepting valid edge cases.

2. URL

/https?://(www.)?[-a-zA-Z0-9@:%._+~#=]{1,256}.[a-zA-Z0-9()]{1,6}([-a-zA-Z0-9()@:%_+.~#?&//=]*)/

3. IPv4 Address

/^((25[0-5]|2[0-4]d|[01]?dd?).){3}(25[0-5]|2[0-4]d|[01]?dd?)$/

4. Hex Color Code

/^#([0-9A-Fa-f]{3}|[0-9A-Fa-f]{6})$/

5. ISO Date (YYYY-MM-DD)

/^d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]d|3[01])$/

6. Time (HH:MM or HH:MM:SS)

/^([01]d|2[0-3]):([0-5]d)(:([0-5]d))?$/

7. Phone Number (International)

/^+?[1-9]d{1,14}$/

Based on E.164 format. For country-specific formats, you'll need more specific patterns.

8. Credit Card (Generic)

/^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12})$/

9. Strong Password

/^(?=.*[a-z])(?=.*[A-Z])(?=.*d)(?=.*[!@#$%^&*]).{8,}$/

Requires lowercase, uppercase, digit, special character, and minimum 8 characters.

10. UUID v4

/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i

11. Semver Version

/^(0|[1-9]d*).(0|[1-9]d*).(0|[1-9]d*)(?:-((?:0|[1-9]d*|d*[a-zA-Z-][0-9a-zA-Z-]*)(?:.(?:0|[1-9]d*|d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:+([0-9a-zA-Z-]+(?:.[0-9a-zA-Z-]+)*))?$/

12. Slug

/^[a-z0-9]+(?:-[a-z0-9]+)*$/

13. HTML Tag

/<([a-z][a-z0-9]*)[^>]*>(.*?)<\/\1>/gis

14. JWT Token

/^[A-Za-z0-9_-]+.[A-Za-z0-9_-]+.[A-Za-z0-9_-]+$/

15. SQL Injection Detection (Basic)

/((SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER))|(--|;|/*)/gi

16. Markdown Code Block

/```[sS]*?```/g

17. Duplicate Words

/(w+)s+\1/gi

18. Blank Lines

/^s*[
]/gm

19. Leading/Trailing Whitespace

/^s+|s+$/g

20. CSS Class Names

/.[a-zA-Z][a-zA-Z0-9_-]*/g

JavaScript Regex Flags

g — global (find all matches)
i — case-insensitive
m — multiline (^ and $ match line boundaries)
s — dotAll (. matches newlines)
u — Unicode mode

Lookaheads and Lookbehinds

// Positive lookahead: "q" followed by "u"
/q(?=u)/

// Negative lookahead: "q" NOT followed by "u"
/q(?!u)/

// Positive lookbehind: price preceded by "$"
/(?<=$)d+(.d{2})?/

// Negative lookbehind
/(?<!$)d+/

Test Your Patterns

Use ToolsVito's Regex Tester to test patterns with live match highlighting, group capture display, and flag toggles — all in your browser.