Regex Cheat Sheet for JavaScript

Q: What is the difference between greedy and lazy quantifiers?

Greedy quantifiers (*, +, {n,}) match as much as they can, then give back characters if the rest of the pattern fails. Lazy ones (*?, +?, {n,}?) match as little as possible. On " a b ", matches the whole string, while matches just " ".

Regular expressions describe patterns in text. The essentials fit on one page: character classes such as \d and [a-z], anchors such as ^ and , quantifiers such as + and {2,4}, groups and lookarounds, and flags such as g and i. Everything here works in JavaScript, Node.js and TypeScript.

By Sumair Roudani · Published November 4, 2026

Characters and classes

Pattern	Matches
`.`	Any character except line breaks
`\d` / `\D`	A digit 0–9 / anything else
`\w` / `\W`	A letter, digit or underscore / anything else
`\s` / `\S`	Whitespace (space, tab, newline) / anything else
`[aeiou]`	One of the listed characters
`[^aeiou]`	Any character not listed
`[a-zA-Z0-9]`	One character from the ranges
`\p{L}`	Any letter in any language (needs the `u` flag)
`\. \* \\`	A literal dot, star, backslash

Anchors

Pattern	Matches
`^` / `$`	Start / end of the string (of each line with `m`)
`\b` / `\B`	A word boundary / not a word boundary

Quantifiers

Pattern	Matches
`a*`	Zero or more
`a+`	One or more
`a?`	Zero or one
`a{3}` / `a{2,}` / `a{2,4}`	Exactly 3 / 2 or more / 2 to 4
`a*?` `a+?`	Lazy: as few as possible

Groups and lookarounds

Pattern	Meaning
`(abc)`	Capture group, referred to as `$1` in replacements and `\1` in the pattern
`(?:abc)`	Group without capturing
`(?<year>\d{4})`	Named group, `$<year>` and `match.groups.year`
`a\|b`	a or b
`x(?=y)`	x only if followed by y
`x(?!y)`	x only if not followed by y
`(?<=y)x`	x only if preceded by y
`(?<!y)x`	x only if not preceded by y

Flags

Flag	Effect
`g`	Find all matches, not just the first
`i`	Ignore case
`m`	`^` and `$` match at each line
`s`	`.` also matches line breaks
`u`	Unicode mode: full code points and `\p{…}`
`y`	Sticky: match only at `lastIndex`
`d`	Record start and end indices of groups

Patterns you will reuse

^\d{4}-\d{2}-\d{2}$                 ISO date, e.g. 2026-11-04
^#?([0-9a-f]{3}|[0-9a-f]{6})$          hex colour (with i)
^[^\s@]+@[^\s@]+\.[^\s@]+$         loose email check
\b\d{1,3}(\.\d{1,3}){3}\b           IPv4-shaped address
^[a-z0-9]+(?:-[a-z0-9]+)*$         URL slug
(?<=\$)\d+(\.\d{2})?                 a price after a $ sign

Using regex in JavaScript

/\d+/.test('abc123');                       // true
'a1b22c333'.match(/\d+/g);                  // ['1', '22', '333']
[...'k=v; x=y'.matchAll(/(\w)=(\w)/g)];     // full matches with groups
'2026-11-04'.replace(/(\d+)-(\d+)-(\d+)/, '$3/$2/$1'); // '04/11/2026'
'a, b,c'.split(/\s*,\s*/);                  // ['a', 'b', 'c']

Try any of these live in the regex tester.

Frequently asked questions

What is the difference between greedy and lazy quantifiers?

Greedy quantifiers (*, +, {n,}) match as much as they can, then give back characters if the rest of the pattern fails. Lazy ones (*?, +?, {n,}?) match as little as possible. On "ab", <.+> matches the whole string, while <.+?> matches just "".

Should I validate email addresses with a regex?

Only loosely. A simple check such as ^[^\s@]+@[^\s@]+\.[^\s@]+$ catches typos. The full email grammar is far too complex for a practical regex, and the only real test is sending a confirmation email.

What is catastrophic backtracking?

Patterns with nested quantifiers, such as (a+)+$, can take exponential time on inputs that almost match, freezing a browser or a server thread. Avoid nesting quantifiers over the same characters, and test untrusted input with a time limit.