This quick reference targets JavaScript regex syntax. A pattern match does not prove that input is real or trustworthy; email, identity, URL, and security checks still need domain rules and server-side validation.
Test in the live tool →Before writing a regex, describe the accepted shape and rejection boundaries in plain sentences. For phone, email, or identity-like fields, character shape is only one layer; length, country or institutional rules, and ownership checks remain separate.
Prepare at least one expected match, one expected rejection, and one long or malformed input. With the global flag, inspect all matches and lastIndex behavior; for multiline text, test the effects of m and s independently.
Run the pattern again in the target runtime and include Unicode characters and unexpected line endings. Bound user-supplied patterns, and never treat a pattern as a security boundary until nested quantifiers have been measured against adversarial long input.
One regex is not a dependable parser for nested JSON, HTML, programming languages, free-form postal addresses, or an entire email standard. Use the relevant parser or domain library first and reserve regex for a narrow, disclosed pre-check.
| Syntax | Meaning | Example |
|---|---|---|
. | Any single character except a line break | a.c |
\d / \D | Digit / non-digit | \d{4} |
\w / \W | ASCII word character / inverse | \w+ |
[a-z] / [^a-z] | Range / negated character class | [A-F0-9] |
^ / $ | Start / end of input or line | ^OK$ |
| Syntax | Meaning | Example |
|---|---|---|
* / + / ? | Zero-or-more / one-or-more / optional | https? |
{n} / {n,m} | Exact or ranged repetition | \d{2,4} |
(abc) / (?:abc) | Capturing / non-capturing group | (?:png|webp) |
(?<name>...) | Named capture group | (?<year>\d{4}) |
(?=...) / (?!...) | Positive / negative lookahead | \d+(?=px) |
| Syntax | Meaning | Example |
|---|---|---|
g | Find all matches rather than stopping at the first | — |
i | Case-insensitive matching | — |
m | Make ^ and $ operate per line | — |
s | Allow . to match line breaks | — |
u / v | Unicode modes; check engine support | — |
Regex checks only a format candidate. Deliverability and ownership require a verification email.
Poorly designed nested quantifiers can cause extreme backtracking. Bound input, test patterns, and isolate untrusted expressions.
