DEVELOPER REFERENCE
Regex Cheat Sheet: Patterns, Flags, and Safer Testing
This quick reference targets JavaScript regex syntax. A pattern match does not prove that input is real or trustworthy; email, identity, URL, and security checks still need domain rules and server-side validation.
Test in the live tool →01
Core building blocks
| Syntax | Meaning | Example |
|---|---|---|
. | Any single character except a line break | a.c |
\d / \D | Digit / non-digit | \d{4} |
\w / \W | ASCII word character / inverse | \w+ |
[a-z] / [^a-z] | Range / negated character class | [A-F0-9] |
^ / $ | Start / end of input or line | ^OK$ |
02
Repetition and grouping
| Syntax | Meaning | Example |
|---|---|---|
* / + / ? | Zero-or-more / one-or-more / optional | https? |
{n} / {n,m} | Exact or ranged repetition | \d{2,4} |
(abc) / (?:abc) | Capturing / non-capturing group | (?:png|webp) |
(?<name>...) | Named capture group | (?<year>\d{4}) |
(?=...) / (?!...) | Positive / negative lookahead | \d+(?=px) |
03
JavaScript flags
| Syntax | Meaning | Example |
|---|---|---|
g | Find all matches rather than stopping at the first | — |
i | Case-insensitive matching | — |
m | Make ^ and $ operate per line | — |
s | Allow . to match line breaks | — |
u / v | Unicode modes; check engine support | — |
Common questions
Can regex validate an email address?+
Regex checks only a format candidate. Deliverability and ownership require a verification email.
What is ReDoS risk?+
Poorly designed nested quantifiers can cause extreme backtracking. Bound input, test patterns, and isolate untrusted expressions.