The Complete Regex Cheat Sheet for Web Developers

Flags

10 Real-World Regex Patterns

1. Email Validation

// Practical email validation (not RFC 5322 complete, but covers 99% of cases)
const emailRegex = /^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$/;

emailRegex.test('user@example.com');     // true
emailRegex.test('user+tag@sub.co.uk');   // true
emailRegex.test('not-an-email');         // false

2. URL Matching

const urlRegex = /https?:\/\/(www\.)?[-a-zA-Z0-9@:%._+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_+.~#?&/=]*)/;

urlRegex.test('https://example.com/path?q=1');  // true
urlRegex.test('http://sub.domain.co.uk');        // true

3. IPv4 Address

const ipv4Regex = /^((25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(25[0-5]|2[0-4]\d|[01]?\d\d?)$/;

ipv4Regex.test('192.168.1.1');   // true
ipv4Regex.test('256.0.0.1');     // false

4. ISO 8601 Date

const isoDateRegex = /^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])(T([01]\d|2[0-3]):[0-5]\d:[0-5]\d(\.\d+)?(Z|[+-][01]\d:[0-5]\d))?$/;

isoDateRegex.test('2026-04-12');              // true
isoDateRegex.test('2026-04-12T14:30:00Z');    // true

5. Hex Color

const hexColorRegex = /^#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$/;

hexColorRegex.test('#FF5733');  // true
hexColorRegex.test('#f57');     // true
hexColorRegex.test('#GGGGGG'); // false

6. Semantic Version

const semverRegex = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;

semverRegex.test('1.2.3');           // true
semverRegex.test('2.0.0-alpha.1');   // true
semverRegex.test('1.0');             // false

7. Credit Card Masking

// Mask middle digits of a credit card number
'4111111111111111'.replace(/(\d{4})\d{8}(\d{4})/, '$1 **** **** $2');
// "4111 **** **** 1111"

8. URL Slug Validation

const slugRegex = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;

slugRegex.test('my-blog-post');    // true
slugRegex.test('My Blog Post');    // false
slugRegex.test('-starts-with-dash'); // false

9. HTML Tag Stripping

// Warning: not safe for sanitization—use a proper HTML sanitizer for security
function stripTags(html) {
  return html.replace(/<[^>]*>/g, '');
}

stripTags('
Hello world
'); // "Hello world"

10. Password Strength Check

function checkPasswordStrength(password) {
  const hasLength = password.length >= 12;
  const hasUpper = /[A-Z]/.test(password);
  const hasLower = /[a-z]/.test(password);
  const hasDigit = /\d/.test(password);
  const hasSpecial = /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(password);

  const score = [hasLength, hasUpper, hasLower, hasDigit, hasSpecial]
    .filter(Boolean).length;

  return { score, hasLength, hasUpper, hasLower, hasDigit, hasSpecial };
}

ReDoS: Catastrophic Backtracking

ReDoS (Regular Expression Denial of Service) occurs when a regex takes exponential time to match (or fail to match) certain inputs. The classic example:

// DANGEROUS: Exponential backtracking
const dangerous = /^(a+)+$/;

// With input "aaaaaaaaaaaaaaab" (15 a's followed by 'b')
// The regex engine tries 2^15 = 32,768 combinations before failing
dangerous.test('aaaaaaaaaaaaaaab'); // Hangs the process

The risk patterns are nested quantifiers ((a+)+), alternation inside quantifiers ((a|aa)+), and overlapping character classes in quantified groups. Tools like ReDoS checker can detect vulnerable patterns. Alternatively, use Node.js's --experimental-vm-modules with a timeout, or the re2 npm package which uses Google's RE2 engine (linear time guaranteed).

Engine Differences: JavaScript vs Python vs PHP

Not all regex engines are equal:

• JavaScript: ECMA flavor, uses NFA engine, supports named captures ((?<name>)), lookbehind added in ES2018. No possessive quantifiers. No \p{} Unicode properties without the u flag.
• Python: Uses the re module (NFA based). Named groups use (?P<name>) syntax. The newer regex module adds possessive quantifiers and atomic groups.
• PHP: Uses PCRE2 (Perl Compatible Regular Expressions). Supports possessive quantifiers (++, *+), atomic groups (?>...), and Unicode properties. Most powerful of the three for advanced patterns.

Use our Text Diff tool to compare regex output across different test cases, and the Regex Tester to build and debug patterns interactively.