Regular expressions have a reputation for being cryptic. But in practice, most of what you need comes down to 10–15 patterns that you reuse across every project. Here are the ones worth memorizing — plus the reasoning behind each, so you can adapt them.
Use our free Regex Tester to try any of these patterns against your own data in real-time.
1. Email Address
^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$
What it matches: alice@example.com, user.name+tag@domain.co.uk
What it doesn't: @nodomain.com, noatsign.com, two@@signs.com
Note: Email validation is famously hard. The RFC 5322 official regex is over 6,000 characters. This pattern catches 99% of real-world cases without the complexity. For anything critical, send a confirmation email instead of relying solely on regex.
2. URL (HTTP/HTTPS)
https?:\/\/(www\.)?[-a-zA-Z0-9@:%._+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_+.~#?&\/=]*)
What it matches: https://example.com, http://sub.domain.co.uk/path?q=1
Simpler alternative when you only need to check if a URL starts correctly:
^https?:\/\/.+
3. Phone Number (Flexible)
^[+]?[(]?[0-9]{3}[)]?[-\s.]?[0-9]{3}[-\s.]?[0-9]{4,6}$
What it matches: (555) 555-1234, +1-555-555-1234, 5555551234
Phone number formats vary wildly by country. For international numbers, consider a library like libphonenumber-js instead of regex.
4. Strong Password
^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$
Requires: at least 8 characters, one lowercase, one uppercase, one digit, one special character.
How it works: Each (?=...) is a lookahead assertion — it checks that the string contains the pattern without consuming characters. You can combine as many lookaheads as you need.
5. IPv4 Address
^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
What it matches: 192.168.1.1, 0.0.0.0, 255.255.255.255
What it rejects: 256.0.0.1, 192.168.1 (incomplete), 192.168.1.1.1 (too many octets)
6. Date (YYYY-MM-DD)
^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$
What it matches: 2026-01-31, 2024-12-01
Note: This validates the format but not calendar correctness (e.g., 2026-02-30 would pass). For real date validation, parse with a date library after the regex check.
7. Hex Color Code
^#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$
What it matches: #0066cc, #FFF, #1d1d1f
The {6}|{3} alternative handles both full 6-digit and shorthand 3-digit hex codes.
8. Credit Card Number (Luhn-ready)
^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6011[0-9]{12}|(?:2131|1800|35\d{3})\d{11})$
Covers: Visa (starts with 4), Mastercard (51–55), Amex (34/37), Discover (6011), JCB.
Important: After matching, always run a Luhn algorithm check for real validation. Regex confirms the format; Luhn confirms the number could be real.
9. Slug (URL-safe string)
^[a-z0-9]+(?:-[a-z0-9]+)*$
What it matches: my-article-title, json-formatter, 2026-update
What it rejects: Title With Spaces, has_underscore, -leading-dash
This is the pattern that generates the URL slugs for articles on this very site.
10. Whitespace Normalization
\s+
Replace all matches with a single space to normalize whitespace:
const cleaned = input.replace(/\s+/g, ' ').trim()
Useful for cleaning user input before storing it — collapses multiple spaces, tabs, and newlines into one.
Bonus: Extract JSON from a String
\{(?:[^{}]|(?:\{[^{}]*\}))*\}
Pulls the first JSON object out of a larger string. Useful when parsing API responses that mix JSON with other text.
Regex Quick Reference
| Token | Meaning |
|-------|---------|
| . | Any character except newline |
| \d | Digit (0–9) |
| \w | Word character (a–z, A–Z, 0–9, _) |
| \s | Whitespace |
| ^ | Start of string |
| $ | End of string |
| + | One or more |
| * | Zero or more |
| ? | Zero or one (also makes quantifiers lazy) |
| {n,m} | Between n and m times |
| (?=...) | Lookahead — must match but doesn't consume |
| (?!...) | Negative lookahead |
| [abc] | Character class — a, b, or c |
| [^abc] | Negated class — anything except a, b, or c |
| (a\|b) | Alternation — a or b |
Testing Your Patterns
Before putting regex into production:
- Test with valid inputs that should match
- Test with invalid inputs that should not match
- Test with edge cases: empty strings, very long strings, unicode characters
- Check performance with long strings — catastrophic backtracking is a real attack vector
Our Regex Tester runs entirely in your browser and shows matches highlighted in real-time as you type. No data is sent to a server.
When Not to Use Regex
Regex is powerful but not always the right tool:
- HTML parsing — use a proper DOM parser (
DOMParser,cheerio,beautifulsoup) - JSON parsing — use
JSON.parse() - SQL parsing — use a dedicated SQL parser
- Complex date math — use
date-fns,dayjs, orTemporal
Regex shines at pattern matching in strings. For structured data with its own grammar, use a parser built for that grammar.