Developer Reference & Syntax • 9 min read
Regular Expressions (RegEx) Cheat Sheet
Master regex with our handy cheat sheet. Covers character classes, lookarounds, capture groups, and practical expression patterns for web devs.
1. Basic Character Classes & Metacharacters
Character classes allow you to match specific types of characters within text sequences with mathematical precision:
. (Dot): Matches any single character except newline characters (\n). In dotAll mode (/s flag in JavaScript/PCRE), it matches newlines as well.
\d / \D: \d matches any standard digit from 0 through 9. \D matches any non-digit character.
\w / \W: \w matches any word character (alphanumeric a-z, A-Z, 0-9, and underscore _). \W matches any non-word character such as punctuation or spaces.
\s / \S: \s matches whitespace characters (spaces, tabs, carriage returns, form feeds, newlines). \S matches any non-whitespace character.
2. Quantifiers & Greedy vs. Lazy Matching
Quantifiers specify how many times a character, class, or subpattern must appear to constitute a valid match:
* (Zero or more): Matches 0 or more occurrences greedily.
+ (One or more): Matches 1 or more occurrences greedily.
? (Optional): Matches 0 or 1 occurrence of the preceding token.
{n,m}: Matches between n and m occurrences (e.g., \d{4,8} matches between 4 and 8 digits).
Greedy vs. Lazy: Standard quantifiers match as many characters as possible before backtracking. Appending a question mark (? after * or +) transforms the quantifier into a lazy operator that stops at the earliest possible match, preventing over-consumption of target strings.
3. Advanced Lookarounds (Zero-Width Assertions)
Lookarounds verify conditions ahead or behind the match position without consuming characters into the resulting match capture:
Positive Lookahead (?=...): Asserts that the specified subpattern occurs immediately following the current position.
Negative Lookahead (?!...): Asserts that the specified subpattern does NOT occur immediately following the current position (essential for password complexity rules).
Positive Lookbehind (?<=...): Asserts that the specified subpattern occurs immediately preceding the current position.
Negative Lookbehind (? Asserts that the specified subpattern does NOT occur immediately preceding the current position.
4. Preventing Catastrophic Backtracking (ReDoS)
Regular Expression Denial of Service (ReDoS) occurs when a non-deterministic finite automaton (NFA) engine attempts an exponential number of permutations against an input that fails to match. Patterns containing nested, ambiguous quantifiers like (a+)+$ or ([a-zA-Z0-9]+)* can lock up browser tabs or server CPUs indefinitely.
To safeguard production environments: eliminate overlapping nested quantifiers, enforce strict input character length boundaries before executing regex evaluation, and employ atomic grouping or possessive quantifiers where supported by the runtime engine.
5. Unicode Property Escapes & Word Boundaries
Modern internationalized applications require matching scripts across global alphabets. Standard \w only recognizes ASCII characters, ignoring accented letters, Cyrillic, Arabic, or Chinese glyphs.
By enabling the Unicode flag (/u or /v in modern ECMAScript), you can utilize Unicode Property Escapes like \p{Letter} or \p{L} to match letters in any human language, and \p{Number} to match digits universally. Word boundaries (\b) assert positions between word characters and non-word characters, preventing partial-word false positives.
6. Production RegEx Recipes for Modern Applications
RFC 5322 Simplified Email: ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$
Clean URL Slug / Permalink: ^[a-z0-9]+(?:-[a-z0-9]+)*$
UUID Version 4: ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
Strict Hex Color Code: ^#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$
E.164 International Phone Number: ^\+[1-9]\d{1,14}$
Key Takeaways & Best Practices
Client-side computing, cryptographic standards, and modern web APIs provide immense power to perform high-fidelity calculations, document manipulation, and media transformations locally on your hardware. By understanding the underlying data structures—whether RFC 7519 JWT segments, IEEE 754 precision constraints, discrete cosine quantization matrices, or Myers diff algorithms—you can architect safer systems, safeguard confidential data, and maximize web application performance.
Explore the interactive tools linked below to test these concepts in real-time. Every utility in the ToolVerve ecosystem executes entirely in your browser memory without transmitting your files or inputs across the network to external servers.