What is the difference between greedy and lazy quantifiers?

Greedy quantifiers (*, +, {n,m}) take as much text as they can and give some back only if the rest of the pattern fails; lazy ones (*?, +?, {n,m}?) take as little as possible. On , matches the whole string and matches just .

Which regex flavor does this cheat sheet use?

JavaScript (ECMAScript 2025), as in browsers and Node.js. The tokens, quantifiers and lookarounds are the same in PCRE, Java and .NET; Python writes named groups as (?P ...), and Go does not support lookarounds or back-references.

Is there a regex that validates every email address?

Not a practical one. The full RFC 5322 grammar allows quoted strings and comments that no sign-up form wants to accept. Use a simple check like the one on the sheet and confirm the address by sending a message to it.

What does the g flag change?

Without g, match() and replace() stop at the first match. With g, replace() replaces every match and match() returns all of them; test() and exec() then remember lastIndex between calls, which surprises people who reuse the same regex object.

Regex cheat sheet

This regex cheat sheet fits JavaScript regular expression syntax on one printable page: character classes, anchors, quantifiers, groups, lookarounds and all eight flags, plus 15 practical patterns, each printed with strings it matches and strings it rejects.

A4Letter

Fits one page: A4, Letter.

Regex

JavaScript regular expressions: syntax, flags and 15 tested patterns

JavaScript / ECMAScript 2025Reviewed 2026-09-27

Characters and classes

.Any character except line breaks (all of them with s)
\d \DDigit 0-9 / anything else
\w \WWord character [A-Za-z0-9_] / anything else
\s \SWhitespace, tabs and line breaks / anything else
[abc]One of a, b or c
[^abc]Any character except a, b and c
[a-z0-9]Ranges: a to z, or 0 to 9
\. \* \\Escaped: a literal dot, asterisk, backslash
\t \n \rTab, line feed, carriage return
\p{L}Any Unicode letter, with u or v (\p{N} numbers)
\u00e9Character by code (\u{1F600} with u)

Anchors

^Start of the input (of each line with m)
$End of the input (of each line with m)
\bWord boundary: between \w and \W
\BNot a word boundary

Quantifiers

*0 or more
+1 or more
?0 or 1: optional
{3}Exactly 3
{3,}3 or more
{3,5}3 to 5
*? +? ??Lazy: as few as possible
{3,5}?Lazy range

Groups and references

(abc)Capture group, $1 in a replacement
(?:abc)Group without capturing
(?<y>\d{4})Named group, $<y> in a replacement
\1Back-reference: same text as group 1
\k<y>Back-reference to a named group
a|ba or b (lowest precedence)
$&Replacement: the whole match ($$ is a literal $)

Lookarounds

x(?=y)x if followed by y
x(?!y)x if not followed by y
(?<=y)xx if preceded by y
(?<!y)xx if not preceded by y

Flags

gGlobal: every match, not just the first
iIgnore case
mMultiline: ^ and $ match at each line
sdotAll: . also matches line breaks
uUnicode: code points, \p{…}, strict syntax
vunicodeSets: u plus class set operations
ySticky: match only at lastIndex
dIndices: start and end of each group

15 practical patterns

Email address (practical check)/^[^\s@]+@[^\s@]+\.[^\s@]+$/Match: ana@example.com · first.last+tag@mail.example.co.ukNo match: ana@example · ana @example.com
http or https URL/^https?:\/\/[^\s/$.?#][^\s]*$/iMatch: https://example.com/a?b=1 · http://localhost:3000No match: ftp://example.com · https://
IPv4 address/^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/Match: 192.168.0.1 · 255.255.255.255No match: 256.1.1.1 · 192.168.1
ISO 8601 date (YYYY-MM-DD) (Format only: 2026-02-31 passes)/^\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$/Match: 2026-09-27 · 2024-02-29No match: 2026-13-01 · 2026-9-27
24-hour time (HH:MM)/^(?:[01]\d|2[0-3]):[0-5]\d$/Match: 09:30 · 23:59No match: 24:00 · 9:30
CSS hex color/^#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/iMatch: #fff · #1E90FFNo match: #fffff · #ggg
URL slug/^[a-z0-9]+(?:-[a-z0-9]+)*$/Match: my-post-2026 · regexNo match: My-Post · -post
Semantic version/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[\da-z-]+(?:\.[\da-z-]+)*)?(?:\+[\da-z-]+(?:\.[\da-z-]+)*)?$/iMatch: 1.2.3 · 2.0.0-rc.1No match: 1.2 · 01.2.3
UUID (RFC 9562)/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iMatch: 550e8400-e29b-41d4-a716-446655440000 · 01890a5d-ac96-774b-bcce-b302099a8057No match: 550e8400e29b41d4a716446655440000 · 550e8400-e29b-41d4-c716-446655440000
Password: 12+ chars, lower, upper, digit/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{12,}$/Match: Correct9horse · battery-Staple-42No match: correct9horse · Short1A
Phone number in E.164/^\+[1-9]\d{1,14}$/Match: +5542999998888 · +14155552671No match: 5542999998888 · +0123456
US ZIP code (ZIP+4 optional)/^\d{5}(?:-\d{4})?$/Match: 94105 · 94105-1420No match: 9410 · 94105-14
Brazilian CEP (postal code)/^\d{5}-?\d{3}$/Match: 84010-000 · 84010000No match: 84010-00 · 8401-0000
Repeated word ("the the")/\b(\w+)\s+\1\b/iMatch: see the the cat · It is is hereNo match: see the cat · the theme
Add thousands separators.replace(/\B(?=(\d{3})+(?!\d))/g, ',')1234567 → 1,234,567

What is on the sheet

The syntax is JavaScript as of ECMAScript 2025, which is what browsers, Node.js, Deno and Bun run. Most of it carries over to PCRE, Java, .NET and Python; the exceptions worth knowing are named groups in Python, written (?P<name>...), and Go, whose RE2 engine has no lookarounds or back-references.

The 15 patterns are deliberately practical rather than perfect: the email check rejects obvious typos instead of implementing RFC 5322, and the date pattern checks the format, not whether February has 31 days. Each one was compiled with the flags shown and tested against the printed examples plus extra cases.

How to print it on one page

Pick the paper above the sheet and press Print / Save as PDF. The page measures the sheet at that paper width and scales it to fill one page, never below 7pt, then hides the site header, footer, ads and buttons. It always prints black on white, whatever theme you are reading in.

In the print dialog keep Scale on Default (100%) and Margins on Default. To get a PDF, choose Save as PDF as the destination. Safari ignores the paper size a page asks for, so select the same paper in its dialog.

Embed or link to this cheat sheet

Linking to this page from your docs, wiki or README is the best way to share it: readers always get the current version and the print button. Copy one of these:

HTML

<a href="https://www.arielton.com/cheatsheets/regex">Regex cheat sheet (printable)</a> by <a href="https://www.arielton.com/">Arielton Oberek</a>

Markdown

[Regex cheat sheet (printable)](https://www.arielton.com/cheatsheets/regex) by [Arielton Oberek](https://www.arielton.com/)

If your team wants the same treatment for an internal API, a CLI or a style guide, write to contact@arielton.com.

Frequently asked questions

What is the difference between greedy and lazy quantifiers?: Greedy quantifiers (*, +, {n,m}) take as much text as they can and give some back only if the rest of the pattern fails; lazy ones (*?, +?, {n,m}?) take as little as possible. On <a><b>, <.+> matches the whole string and <.+?> matches just <a>.
Which regex flavor does this cheat sheet use?: JavaScript (ECMAScript 2025), as in browsers and Node.js. The tokens, quantifiers and lookarounds are the same in PCRE, Java and .NET; Python writes named groups as (?P<name>...), and Go does not support lookarounds or back-references.
Is there a regex that validates every email address?: Not a practical one. The full RFC 5322 grammar allows quoted strings and comments that no sign-up form wants to accept. Use a simple check like the one on the sheet and confirm the address by sending a message to it.
What does the g flag change?: Without g, match() and replace() stop at the first match. With g, replace() replaces every match and match() returns all of them; test() and exec() then remember lastIndex between calls, which surprises people who reuse the same regex object.

Last reviewed September 27, 2026 by Arielton Oberek.