Regex can be either a superpower or a maintenance nightmare. The difference is not intelligence—it is pattern discipline.

This cheatsheet focuses on practical, reusable patterns developers use in APIs, forms, logs, and search tooling.

Core Regex Building Blocks

• ^ start of string
• $ end of string
• . any character
• * zero or more
• + one or more
• ? optional
• [] character class
• () capture group
• (?:) non-capturing group
• \d digit, \w word, \s whitespace

30 Useful Patterns

1. Email (basic): ^[^\s@]+@[^\s@]+\.[^\s@]+$
2. URL (basic): ^https?:\/\/.+
3. Hex color: ^#(?:[0-9a-fA-F]{3}){1,2}$
4. UUID v4 (strict): ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
5. Strong password (example policy): ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{12,}$
6. ISO date: ^\d{4}-\d{2}-\d{2}$
7. Time 24h: ^(?:[01]\d|2[0-3]):[0-5]\d$
8. Integer: ^-?\d+$
9. Decimal number: ^-?\d+(?:\.\d+)?$
10. HTML tag (rough): <[^>]+>
11. Multiple spaces: \s{2,}
12. Leading/trailing spaces: ^\s+|\s+$
13. Repeated word: \b(\w+)\s+\1\b
14. Slug-safe text: ^[a-z0-9]+(?:-[a-z0-9]+)*$
15. Username (3-20): ^[a-zA-Z0-9_]{3,20}$
16. IPv4 (basic): ^(?:\d{1,3}\.){3}\d{1,3}$
17. JWT token shape: ^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+$
18. Base64 (simple): ^[A-Za-z0-9+/]+={0,2}$
19. Markdown heading: ^#{1,6}\s.+$
20. CSV value in quotes: "(?:[^"]|"")*"
21. US ZIP: ^\d{5}(?:-\d{4})?$
22. Phone (generic): ^\+?[0-9\s()-]{7,20}$
23. Credit card shape (not validation): ^\d{13,19}$
24. Remove non-alphanumerics: [^a-zA-Z0-9]
25. Find TODO comments: \bTODO\b.*
26. JS import lines: ^import\s.+from\s['"].+['"];?$
27. Trailing comma before brace: ,\s*([}\]])
28. Duplicate blank lines: \n{3,}
29. File extension: \.([a-zA-Z0-9]+)$
30. Non-ASCII characters: [^\x00-\x7F]

Performance Tips (Very Important)

• Avoid catastrophic backtracking ((a+)+ style patterns)
• Prefer explicit classes over greedy .* when possible
• Anchor patterns when validating full strings (^...$)
• Benchmark heavy regex in production-critical paths

Regex Debugging Workflow

1. Build pattern iteratively in Regex Tester
2. Generate starter expressions in Regex Generator
3. Validate payload wrappers using JSON Formatter

Maintainability Rules for Teams

• Keep regex in named constants, not inline one-liners everywhere
• Add test cases for valid/invalid samples
• Comment the business rule in plain language
• Prefer readability over “clever” minimization

FAQ

Is regex enough for email validation?

Good for basic syntax checks. Use confirmation workflows for true validation.

Why do regexes break across languages?

Engines differ in features and flags. Always test in your target runtime.

Should I use regex to parse HTML?

For full parsing, use an HTML parser. Regex is okay for narrow extraction tasks.

What is catastrophic backtracking?

A performance failure mode where certain inputs cause exponential matching time.

Final Take

Regex becomes a force multiplier when you standardize patterns, test them, and keep them readable. Start with proven patterns and adapt intentionally.

Use the Regex Tester for safe, iterative validation before shipping patterns into production logic.