Regular Expressions for Beginners: Patterns You'll Actually Use

Video: Learn Regular Expressions In 20 Minutes — Web Dev Simplified. Embedded from YouTube in privacy-enhanced mode; all rights belong to the creator.

Regular expressions (regex) describe patterns in text. With one line you can validate a postcode, pull every order number out of a log file or reformat a thousand dates. The syntax looks cryptic at first, but around a dozen symbols cover 90% of real-world use. Open our regex tester in another tab and try each example as you read.

Literal characters and the special ones

Most characters match themselves: the pattern cat finds “cat”. Twelve characters have special meaning and must be escaped with a backslash to match literally: . ^ $ * + ? ( ) [ ] { } | \. So to match “3.14” you write 3\.14.

Character classes

Quantifiers: how many?

* means zero or more, + one or more, ? zero or one, and {2,4} between two and four. Quantifiers are greedy by default — they grab as much as possible. Add ? to make them lazy: in <b>bold</b>, the pattern <.+> matches the whole string while <.+?> matches just <b>.

Anchors and boundaries

^ anchors to the start and $ to the end (of the string, or of each line with the m flag). \b marks a word boundary, so \bcat\b matches “cat” but not “category”. Anchors are essential for validation — without them, \d{5} happily “validates” abc123456xyz.

Groups, alternation and backreferences

Parentheses group parts of a pattern and capture what they match: (\d{4})-(\d{2})-(\d{2}) captures year, month and day. Reference them in replacements as $1, $2… — so replacing with $3/$2/$1 converts ISO dates to day/month/year. Name groups for readability: (?<year>\d{4}). The pipe | means “or”: (jpg|png|webp)$.

Lookarounds

Lookaheads (?=...) and lookbehinds (?<=...) assert that something comes next (or before) without consuming it. The classic use is password rules: ^(?=.*\d)(?=.*[A-Z]).{12,}$ requires a digit, an uppercase letter and 12+ characters.

Ten patterns worth bookmarking

Email (pragmatic):   ^[^\s@]+@[^\s@]+\.[^\s@]+$
URL:                 https?://[^\s/$.?#].[^\s]*
IPv4:                \b(?:\d{1,3}\.){3}\d{1,3}\b
ISO date:            \d{4}-\d{2}-\d{2}
Time 24h:            ^([01]\d|2[0-3]):[0-5]\d$
Hex colour:          #(?:[0-9a-fA-F]{3}){1,2}\b
UUID:                [0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
Duplicate words:     \b(\w+)\s+\1\b
Trailing spaces:     [ \t]+$
US ZIP:              ^\d{5}(-\d{4})?$

Pitfalls

• Catastrophic backtracking. Nested quantifiers like (a+)+$ can take exponential time on certain inputs — a real denial-of-service risk on servers.
• Over-validating emails. The full email grammar is enormous; a simple pattern plus a confirmation email is better than a 6,000-character regex.
• Parsing HTML. Regex can't reliably parse nested markup — use a DOM parser.

Try the tools