20 Regex Patterns You Will Actually Use (Cheat Sheet)

Regular expressions look like keyboard accidents, but they are one of the most practical skills in computing: a compact way to describe a pattern and find every piece of text that matches it. Here are 20 patterns you will actually use, each explained in plain English.

What a regex actually is

A regular expression, usually shortened to regex, is a search pattern written in a small special language. Instead of searching for one exact word, you describe the shape of what you want: three digits, then a dash, then four digits, for example. The computer then finds every match. Regex appears in text editors, spreadsheets, programming languages, form validation, and log-file searches, so learning it once pays off in many places.

Every pattern is built from a few building blocks. A plain character matches itself, so cat matches the letters c-a-t. A dot matches almost any single character. Square brackets define a set, so [0-9] matches any single digit and [A-Za-z] matches any single letter. Quantifiers say how many times something may repeat: * means zero or more, + means one or more, ? means zero or one, and {3} means exactly three times. Anchors pin a match to the start or end of a string: ^ for the start and $ for the end. With just those pieces, you can read most of the patterns below.

How to read a pattern, piece by piece

Take the classic United States phone pattern ^\d{3}-\d{3}-\d{4}$. Reading left to right: the caret says the match must start here, \d{3} means exactly three digits, the dash is a literal dash, \d{3} is three more digits, another dash, then \d{4} is four digits, and the dollar sign says the match must end here. Without the anchors, the same pattern would happily match the middle of a longer number, which is rarely what you want for validation.

Patterns for validation

Validation patterns check whether input has the right shape before you accept it. They are almost always anchored with ^ and $, because a partial match is not a valid entry.

• Email, simple check: ^[^\s@]+@[^\s@]+\.[^\s@]+$ — some non-space characters, an @ sign, more non-space characters, a dot, and a domain ending. It catches missing @ signs and spaces, which are the most common typos.
• United States phone number: ^\d{3}-\d{3}-\d{4}$ — three digits, dash, three digits, dash, four digits.
• Website URL: ^https?://[^\s/$.?#].[^\s]*$ — http or https, then ://, then a domain and optional path with no spaces.
• Username: ^[A-Za-z0-9_]{3,16}$ — letters, digits, or underscores, between 3 and 16 characters long.
• Strong password shape: ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$ — at least 8 characters, with at least one lowercase letter, one uppercase letter, and one digit. The lookahead groups check conditions without consuming characters.
• ZIP code: ^\d{5}(-\d{4})?$ — five digits, optionally followed by a dash and four more digits.

Patterns for numbers, dates, and times

These patterns pull structured values out of messy text, which is where regex earns its keep in data cleanup.

• Date, year-month-day: ^\d{4}-\d{2}-\d{2}$ — four digits, dash, two digits, dash, two digits, as in 2026-10-28.
• Time, 24-hour clock: ^([01]\d|2[0-3]):[0-5]\d$ — hours from 00 to 23, a colon, then minutes from 00 to 59.
• Whole number, optional sign: ^-?\d+$ — an optional minus sign followed by one or more digits.
• Decimal or currency amount: ^\$?\d+(\.\d{2})?$ — an optional dollar sign, digits, and an optional two-decimal part.
• Percentage: ^\d+(\.\d+)?%$ — digits, an optional decimal part, and a percent sign.

Patterns for finding and cleaning up text

Not every pattern validates a whole field. Many simply find or tidy text, and these are the ones writers, editors, and spreadsheet users reach for most.

• Any word: \b\w+\b — a word boundary, one or more word characters, then a word boundary. Useful for counting or highlighting words.
• Repeated words: \b(\w+)\s+\1\b — a word, some whitespace, then the same word again. It catches the the doubled words that proofreading misses.
• Extra whitespace: \s+ — one or more whitespace characters, which you can replace with a single space to normalize spacing.
• HTML tags: <[^>]+> — an opening angle bracket, anything that is not a closing bracket, then the closing bracket. It strips simple markup from copied text.
• Leading and trailing spaces: ^\s+|\s+$ — whitespace at the start or at the end, for trimming pasted values.
• IPv4 address shape: \b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b — four groups of one to three digits separated by literal dots. Note the escaped dots: an unescaped dot would match any character.
• Hashtag or mention: #\w+ or @\w+ — a hash or @ sign followed by word characters, for scanning social posts.

Worked example: validating a signup form

Imagine a signup form with three fields: username, email, and ZIP code. Without validation, a user can submit a one-character username, an email with no @ sign, and a ZIP code containing letters, and the errors surface later as bounced mail and failed deliveries. With three anchored patterns, each field is checked the moment it is entered: username against ^[A-Za-z0-9_]{3,16}$, email against the simple email pattern above, and ZIP code against ^\d{5}(-\d{4})?$. That is the practical payoff: small patterns, placed early, prevent large cleanup jobs later.

Three mistakes that break most patterns

First, forgetting to escape special characters. A dot, a parenthesis, and a plus sign all have special meanings, so a pattern meant to match a literal price like 9.99 needs the dot escaped as \., or it will also match 9x99. Second, forgetting anchors on validation patterns, which lets a valid substring inside invalid input pass. Third, using a greedy .* where a specific class belongs. When a pattern matches too much, replace the dot with the narrowest class that fits, such as [^<]* for text inside a tag, and the over-matching usually disappears.

Frequently asked questions