What the Regex Cheatsheet Is
The Regex Cheatsheet is a printed reference for ECMAScript regex syntax, grouped into four tables: characters, quantifiers, groups, and character classes. It takes no input. Running it produces a fixed, aligned text block you can copy into a scratch file, a code comment header, a team wiki, or the notes app you keep open while writing a parser.
Its value is that it is a complete, printable subset rather than an exhaustive index. Every entry is a construct you will actually reach for in JavaScript: the six character escapes, the three bounded quantifier forms, the capture and non-capture group forms, lookaheads, and the basic class syntax. Nothing here requires a lookup elsewhere to use.
It is also a deliberately bounded reference. It does not cover possessive quantifiers or atomic groups, because ECMAScript does not have them. It does not list \A or \Z, because they do not exist in this dialect. What remains is a sheet you can trust to be valid JavaScript — which is a genuinely useful property, since most cheat sheets in circulation are written against PCRE or Perl and quietly contain constructs that throw here.
How the Four Sections Work
Characters covers the shorthand escapes and the two anchors. . is any character except a newline — unless the s flag is set, in which case it does cross line breaks. \d and \D are digit and non-digit, \w and \W are word and non-word, \s and \S are whitespace and non-whitespace. \b and \B are the boundary assertions, and ^ and $ are the string anchors that become line anchors under the m flag.
Quantifiers is where most correctness bugs live. a? is zero or one, a* is zero or more, a+ is one or more, a{3} is exactly three, a{2,4} is between two and four, and a{2,} is two or more. All of them are greedy by default: they consume as much as they can and then give back only as much as the rest of the pattern forces them to. Appending ? makes one lazy, so a+? takes as little as possible. The a{} forms are worth preferring over stacked wildcards precisely because they bound the amount of text a pattern can swallow.
Groups lists the four forms you need in practice. (...) is a capturing group and its contents appear in the match result. (?:...) groups without capturing, which is what you want when you are only applying a quantifier to a sequence. (?<name>...) is a named capture, read back through the groups property. (?=...) is a lookahead that asserts what follows without consuming it, and (?!...) is its negation. Lookbehind — (?<=...) and (?<!...) — is supported in current browsers but is the newest of these constructs, so it is the one worth checking against your oldest supported engine.
Classes covers the bracket syntax. [abc] matches any one of the listed characters, [^abc] matches any character not listed, and [a-z] matches a range. Inside a class, most metacharacters lose their meaning and become literal — which is why [.] matches a full stop rather than any character, and why a hyphen must go first or last (or be escaped) unless it is meant as a range.
Using the Regex Cheatsheet
- Step 1 — Open the tool and trigger the output. There is no input area, because there is nothing to input. This tool generates rather than transforms, so it is not live — you press Transform to produce the sheet.
- Step 2 — Read or copy the result. The output is plain text with the four section headings
## Characters, ## Quantifiers, ## Groups and ## Classes, each followed by aligned token and description columns. The alignment comes from padding, so it survives being pasted into a monospaced editor or a code comment. - Step 3 — Keep it where you write patterns. Because it contains no constructs that JavaScript rejects, the sheet is safe to paste into a repository as a comment block above a dense pattern, or into a wiki page your team consults during review.
- Step 4 — Verify anything not on the sheet. If you reach for a construct that is absent —
\p{...} Unicode property escapes, lookbehind, backreferences — treat the absence as a prompt to confirm two things: that the construct exists in ECMAScript at all, and that it is supported in the browsers you target. The Regex Tester will tell you immediately whether the engine accepts it.
Common Use Cases
Code review reference. When reviewing a dense pattern you did not write, having the syntax table open next to it removes a lot of context-switching. It is particularly useful for confirming the difference between greedy and lazy quantifiers, which changes a pattern's meaning without changing its shape.
Documenting a non-obvious pattern. Pasting the relevant section above a complex expression gives the next reader the vocabulary to decode it. Explaining why a group is non-capturing, or why a class excludes a hyphen, is a one-line comment once the reference is in the file.
Learning the dialect you actually ship. If your regex exposure came from Python, PHP, grep or a general-purpose online tester, the sheet is a compact correction of the constructs that do not carry over. The absence of possessive quantifiers and atomic groups is as informative as the entries present.
Interview and teaching preparation. The four categories map closely to how regex questions are usually structured, making the sheet a reasonable revision outline.
A portable offline reference. Copy the text once and you have the syntax available without a network connection, in any editor, on any machine.
Worked Example: Reading a Pattern Against the Sheet
Take a realistic pattern from a validation routine:
^(?<year>\d{4})-(\d{2})-(\d{2})$
Walking it against the sheet: the leading ^ comes from the Characters section and anchors to the start of the subject. (?<year>...) comes from the Groups section — a named capture, read back as match.groups.year. Inside it, \d{4} combines the \d shorthand with the exact-count quantifier, so it requires precisely four digits. The literal hyphen is not on the sheet because literal characters need no entry. Two unnamed (\d{2}) groups follow, captured positionally as groups one and two. The trailing $ anchors the end.
That read exposes the pattern's assumption. Because \d accepts any digit and the quantifiers are exact counts, 2024-13-45 matches perfectly. The sheet tells you what the tokens do, not whether they express a valid date — that is a range problem, and it is why date validation by regex alone is a common source of permissive validators.
Tips and Common Mistakes
- Remember that
\d is not [0-9] everywhere. In JavaScript without the u flag the two are equivalent, but the shorthand is tied to digit semantics rather than an ASCII range, which matters when you port a pattern between engines. - Do not confuse greedy with lazy.
<.+> against <.+?> matches - Anchor your validators. An unanchored pattern is a search. If you mean to validate a whole field, wrap it in
^ and $, otherwise abc will happily pass xxabcxx. - Prefer non-capturing groups when you only need grouping.
(?:...) keeps the match result clean and avoids shifting the indices of the groups you do care about. - A character class is a set of single characters.
[abc] matches one character, not the string. Sequences belong in a group, not a class. - Escape the hyphen inside a class.
[a-z-0-9] is read as ranges; put the hyphen first or last, or escape it, to make it literal. - Check lookbehind against your oldest target. It is supported in current engines but is the newest construct on this sheet, so it is the likeliest to fail in older Safari or an embedded JS runtime.
Frequently Asked Questions
Why does this cheatsheet not include possessive quantifiers or atomic groups?
Because ECMAScript does not implement them. They exist in PCRE, Java and .NET, and a pattern using a++ or (?>...) will throw here. Excluding them keeps every entry on the sheet valid in the browser engine you are actually shipping to.Is the cheatsheet interactive or searchable?
No. It is a fixed reference that you generate and copy. If you want to search for a recipe rather than a token — an email pattern, a URL pattern, an IPv4 pattern — use
Regex Cheatsheet Search, which filters a library of ready-made patterns by name.
What is the difference between the Characters and Classes sections?
Characters lists the shorthand escapes that each match a whole category of single characters — \d, \w, \s and their negations, plus the anchors. Classes is the explicit bracket syntax for constructing your own set, such as [a-z0-9_]. The two overlap in meaning, and \w is close to [A-Za-z0-9_], but the shorthand is fixed while a class is whatever you define.Can I use these tokens in Python or PHP?
Most of the shorthands, quantifiers and class syntax are shared, but the dialect is not identical. Named groups use different syntax in Python ((?P<name>...)), and the PCRE-only constructs deliberately absent from this sheet are available there. Treat this as a JavaScript reference and check ported patterns in their target engine.Related Tools
To test a pattern built from these tokens, use the
Regex Tester, which reports matches and capture groups. To see which of these constructs a specific pattern contains, the
Regex Explainer scans it and lists the token types it recognises — including the character-class and quantifier forms described above. For complete patterns rather than individual tokens, the
Regex Cheatsheet Search returns recipes for common data shapes, and the
Regex Generator drafts a pattern from sample values when you have examples but no pattern yet.
Privacy & Security
This tool runs entirely in your browser — no data ever leaves your device. There is no server round-trip, no upload, no logging, and no account required. Your input is processed locally using client-side JavaScript and is never stored, transmitted, or accessible to anyone else. When you close the tab, everything disappears.