Regex Cheat Sheet: Examples Tested in JavaScript, Python, Go

This regex cheat sheet lists every symbol you will use day to day, with an example for each, and 17 copy-paste patterns. Every example was run on September 28, 2026 in JavaScript, Python, Java, PCRE2 (the engine behind PHP) and Go. Where those engines disagree, and they do on named groups, lookbehind and Unicode, the tables say so.

Regular expressions, regex for short, are patterns for finding and replacing text. The cheat sheets that rank for this search are each written for one engine: Go, SQL Server, Python, .NET or JavaScript. That matters, because the same pattern can mean something different in each, or fail to compile. This sheet shows the differences instead of hiding them.

Regex cheat sheet: the quick version

These sixteen cover most patterns anyone writes. The example column is real output, copied from the test run.

The rest of the sheet goes symbol by symbol, then covers the parts that trip people up: how the engines differ, replacements, and patterns that take seconds to fail.

Characters and escapes

In a JavaScript regex literal such as /a\/b/, the forward slash needs escaping too, because it ends the literal. Written as a string passed to new RegExp(), it doesn't.

Character classes

The \w row is the one that bites. A JavaScript username check written as ^\w+$ rejects "José", while the same pattern in Python accepts it. If you mean ASCII, write [A-Za-z0-9_]. If you mean any letter, use [\p{L}\p{N}_] with the u flag in JavaScript.

Anchors and word boundaries

JavaScript has no \A. Without the u flag it reads \A as a plain letter A, so \Aabc\z silently matched nothing instead of raising an error. Use ^ and $ without the m flag. Python only gained \z in 3.14: in the test, Python 3.12 rejected it with "bad escape \z", as the Python documentation explains.

Python's re documentation on September 28, 2026: \z was added in Python 3.14, and \Z stays for older versions.

Quantifiers: greedy, lazy and possessive

Quantifiers are greedy by default. <.+> run on "<b>bold</b> text" returned the whole of <b>bold</b>, because .+ ran to the last ">" it could find. Adding ? made it stop at the first, giving two tags. All five engines agreed on that.

Possessive quantifiers never hand characters back. \d+5 matched "12345", because \d+ gave back the 5. \d++5 found nothing in Python, PCRE2 and Java, and JavaScript and Go refused to compile it. One more trap: a{,3} means "zero to three a's" in Python and PCRE2, JavaScript and Go treat it as the literal text "a{,3}", and Java rejects it as an "Illegal repetition". Write a{0,3}, which every engine reads as zero to three.

Groups, alternation and backreferences

If a pattern has to run in both JavaScript and Python, named groups are the catch. Neither accepts the other's spelling, and Java sides with JavaScript. PCRE2 and Go accept both.

Lookahead and lookbehind assertions

Lookarounds are assertions, like ^ and \b: they check what comes before or after a position without including it in the match.

Go supports none of the four; every one failed to compile. Lookbehind also differs in how long the look back may be. JavaScript accepts any pattern inside a lookbehind, so (?<=\$\s*)\d+ worked, and Java 25 ran it too. PCRE2 needs a known maximum length: it accepted (?<=\$|USD ) but rejected the open-ended \s*. Python needs a fixed width and rejected both with "look-behind requires fixed-width pattern".

RE2's syntax reference on GitHub, September 28, 2026. RE2 is the engine family behind Go, Google Sheets and SQL Server 2025, and it lists all four lookarounds as not supported.

Flags

JavaScript rejected (?i)hello as an "Invalid group". It does accept the scoped form (?i:hello) world, which lowers case for "hello" only. That form reached every major browser in 2025, according to MDN's page on modifiers, and it worked in all five engines here.

Does regex work the same in every language?

No. The basics are shared, but every engine adds, drops or reinterprets some syntax, usually without warning. This table is the result of running the same 51 cases through each of five engines. A ✗ means the engine refused to compile the pattern or matched something different.

The quietest failures were in JavaScript without the u flag. \p{Lu} returned no matches and no error, and ^.$ didn't match a single emoji, because JavaScript counts it as two UTF-16 code units. Both work once the flag is added:

console.log(/^.$/.test("😀"), /^.$/u.test("😀"));
console.log("naïve café".match(/\w+/g));
console.log("naïve café".match(/[\p{L}\p{N}_]+/gu));

false true
[ 'na', 've', 'caf' ]
[ 'naïve', 'café' ]

Which regex engine does my tool use?

• JavaScript: browsers, Node.js and anything built on them.

• Python: the built-in re module.

• Java: java.util.regex, with extras of its own such as class intersection: [a-c&&[b-c]]+ matched "bc" in "abc".

• PCRE2: PHP's preg_ functions, which use a bundled copy of the PCRE2 library, grep -P, and Excel's REGEXTEST, REGEXEXTRACT and REGEXREPLACE.

• RE2: Go's regexp package, which accepts the syntax accepted by RE2, Google Sheets, and the REGEXP functions in SQL Server 2025.

• R: POSIX-style extended regex by default. R's documentation says perl = TRUE in grepl, sub and the rest "switches to the PCRE library", so use it for lookarounds. R was not run for this article.

• POSIX: grep -E and sed -E. No \d (write [0-9]), no lazy quantifiers and no lookaround. GNU grep's manual adds \w, \s, \b and backreferences on top.

Copy-paste regex patterns, tested

Each pattern below was checked against its strings in all five engines: 107 strings, 535 checks. Every one gave the expected answer, with the exceptions noted underneath.

The semantic version pattern is the one semver.org publishes in its FAQ, unchanged:

^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$

What the test turned up about these patterns:

• The HTML pattern has a false positive. It matched inside "2 < 3 and 5 > 4 is false", in all five engines, because it has no idea what a tag is. For real HTML, use a parser such as the browser's DOMParser.

• The date pattern checks shape, not the calendar. It accepted 2026-02-31. Parse the result as a date afterwards if the day has to exist.

• The email pattern checks shape, not ownership. Whether an address can receive mail, or is already registered, is a job for a confirmation email and for your database, which is the only thing that knows if a value is taken.

• Go refused two of them. The password pattern needs lookahead and the doubled-word pattern needs a backreference, and Go supports neither. The other four ran both. The Go version of the password check is ordinary code:

var (
	lower = regexp.MustCompile(`[a-z]`)
	upper = regexp.MustCompile(`[A-Z]`)
	digit = regexp.MustCompile(`\d`)
)

// Go has no lookahead, so each rule is its own check.
func strong(p string) bool {
	return utf8.RuneCountInString(p) >= 12 &&
		lower.MatchString(p) && upper.MatchString(p) && digit.MatchString(p)
}

fmt.Println(strong("Correct9HorseBattery"), strong("alllowercase123"))

true false

How do you use regex in JavaScript, Python, Java and Go?

The same three jobs in each language: find every date in a string, read a named group, and rewrite the dates. The outputs are pasted from the run.

JavaScript

const text = "Invoices 2026-09-28 and 2026-10-05";

console.log(text.match(/\d{4}-\d{2}-\d{2}/g));

const m = text.match(/(?<year>\d{4})-(?<month>\d{2})/);
console.log(m.groups.year, m.groups.month);

console.log(text.replace(/(\d{4})-(\d{2})-(\d{2})/g, "$3/$2/$1"));

[ '2026-09-28', '2026-10-05' ]
2026 09
Invoices 28/09/2026 and 05/10/2026

Python regex cheat sheet: re.search, re.match, re.sub

import re

text = "Invoices 2026-09-28 and 2026-10-05"

print(re.findall(r"\d{4}-\d{2}-\d{2}", text))

m = re.search(r"(?P<year>\d{4})-(?P<month>\d{2})", text)
print(m["year"], m["month"])

print(re.sub(r"(\d{4})-(\d{2})-(\d{2})", r"\3/\2/\1", text))

['2026-09-28', '2026-10-05']
2026 09
Invoices 28/09/2026 and 05/10/2026

Write Python patterns as raw strings, r"…", so that \d reaches the regex engine instead of being read as a string escape. Then pick the function for the job:

The flags are re.I (ignore case), re.M (multiline), re.S (dot matches newline), re.X (verbose) and re.A. That last one makes \w and \d ASCII-only, like every other engine here: re.findall(r"\w+", "naïve café") returned ['naïve', 'café'], and with re.A it returned ['na', 've', 'caf'].

Java

String text = "Invoices 2026-09-28 and 2026-10-05";
Pattern date = Pattern.compile("(?<year>\\d{4})-(?<month>\\d{2})-(\\d{2})");

Matcher m = date.matcher(text);
while (m.find()) {
    System.out.println(m.group() + " year=" + m.group("year"));
}

System.out.println(text.replaceAll("(\\d{4})-(\\d{2})-(\\d{2})", "$3/$2/$1"));
System.out.println("PIN 4821".matches("PIN \\d{4}"));

2026-09-28 year=2026
2026-10-05 year=2026
Invoices 28/09/2026 and 05/10/2026
true

Every backslash is doubled in a Java string, so \d is written "\\d". String.matches must match the whole string, like Python's fullmatch. Use Matcher.find to search.

Go

date := regexp.MustCompile(`(\d{4})-(\d{2})-(\d{2})`)
text := "Invoices 2026-09-28 and 2026-10-05"

fmt.Println(date.FindAllString(text, -1))
fmt.Println(date.ReplaceAllString(text, "${3}/${2}/${1}"))

[2026-09-28 2026-10-05]
Invoices 28/09/2026 and 05/10/2026

grep and sed

echo "Invoices 2026-09-28 and 2026-10-05" | grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2}'
echo "Invoices 2026-09-28" | sed -E 's/([0-9]{4})-([0-9]{2})-([0-9]{2})/\3\/\2\/\1/'

2026-09-28
2026-10-05
Invoices 28/09/2026

How do you reference a group in a replacement?

In the test, JavaScript, Python, Java, Go, sed -E and PCRE2's own substitution all turned "Due 2026-09-28" into "Due 28/09/2026". Go has one trap. Its documentation says that in a template "$1x is equivalent to ${1x}, not ${1}x", so the letters, digits and underscores after a $ all count as the group name. The template $3_$2_$1 returned "Due 2026", because groups called "3_" and "2_" don't exist. ${3}_${2}_${1} returned "Due 28_09_2026". Always use the braces in Go. PHP's form is from the preg_replace manual.

Why is my regex so slow? Catastrophic backtracking

A regex that looks harmless can take seconds to fail. The classic case is a quantifier inside a quantifier, like ^(a+)+$. On a run of a's followed by "!", a backtracking engine tries every way of splitting the a's between the two plus signs before it gives up, and the number of ways doubles with each extra a. Here is how long one failed match took on an Apple M2, with the pattern warmed up first:

Java 25 was the exception among the backtracking engines. It finished this pattern, and four other textbook cases including ^(a|aa)+$ and (x+x+)+y, in under a millisecond at 28 characters. It still backtracks in general, since it supports backreferences, so cap input length there too.

Two extra characters made JavaScript and Python about four times slower, every time. In a fresh Node.js process, a single call on 28 a's took 17.3 seconds, because V8 interprets a regex the first time and only compiles it to machine code once it is used again. On a server, one request with a crafted string can hold a whole thread for that long. That attack is called ReDoS.

PCRE2 protects itself with a match limit and returns error -47 instead of running on. In PHP that limit is the pcre.backtrack_limit setting, 1,000,000 by default, and hitting it makes preg_match return false rather than 0. Code that only checks for a match reads that as "no match".

Go never backtracks, which is why its column is flat. Its engine cannot express backreferences or lookaround, and that is the price of the guarantee in its documentation:

Go's regexp package documentation on pkg.go.dev, September 28, 2026: RE2 syntax, and matching guaranteed to run in time linear in the size of the input.

How to fix a slow pattern, each checked against the 28-character input in Python 3.14, where the original took 8.5 seconds:

• Remove the nesting. ^(a+)+$ matches exactly what ^a+$ does. The simple version took 0.001 ms.

• Make the inner part possessive or atomic. ^(a++)+$ took 0.001 ms and ^(?>a+)+$ took 0.02 ms. Both forms work in Python 3.11+, PCRE2 and Java.

• Keep alternatives from overlapping. In ^(\w|\d)+$, a digit matches both branches. On 28 digits and a "!", JavaScript took 2.8 seconds to fail. Python (0.2 ms) and Java (under 1 ms) got through it, most likely by merging the two branches, but that is a courtesy to be grateful for, not to rely on. ^\w+$ means the same thing.

• Use a linear-time engine for patterns or text you don't control, such as Go's regexp, and cap the input length either way.

Regex in Excel, Google Sheets and SQL Server

Spreadsheets and databases now have regex functions too, and they don't share an engine. Microsoft's documentation for Excel's REGEXTEST function says it and its two siblings use PCRE2, so the PCRE2 column above applies, lookarounds included.

Microsoft Support's REGEXTEST page, September 28, 2026: REGEXTEST, REGEXEXTRACT and REGEXREPLACE use the PCRE2 flavour of regex.

Before reaching for REGEXTEST to police what people type into a cell, consider whether the allowed values are a fixed list. If they are, an Excel drop-down list stops bad entries before they happen and needs no pattern at all.

Google's help page for REGEXMATCH says "Google products use RE2 for regular expressions" and that Sheets supports RE2 "except Unicode character class matching". Going by those two pages, a pattern with a lookahead that Excel accepts will not work in Sheets. SQL Server 2025 is RE2 too:

Microsoft Learn's page on regular expressions in SQL Server, September 28, 2026: the REGEXP functions are based on the RE2 library.

In practice the Go column predicts what REGEXP_LIKE in SQL Server and REGEXMATCH in Sheets will accept. Neither was run for this article; that is what their documentation states.

How this cheat sheet was tested

Every example and table entry above comes from a test run on September 28, 2026 on an Apple M2 Mac, using these versions:

• JavaScript: Node.js 26.8.1 (V8 14.6)

• Python 3.14.7, plus Python 3.12.4 to see what changed

• PCRE2 10.46, through its own pcre2test tool

• Java 25.0.4.1 (Temurin), java.util.regex

• Go 1.27.1, the regexp package

• grep 2.6.0 on macOS, for the POSIX examples

The run covered 51 syntax cases, 349 engine runs in total, and 107 strings for the 17 patterns, checked in five engines each: 535 checks. Every example printed in the text was also run exactly as printed, in all five. Every result in the tables is what the engine returned, including its own error text. .NET, Rust, Ruby and R were not tested; their regex engines differ again. Where a claim rests on documentation rather than a run, such as Excel, Google Sheets and SQL Server, the article links it.

Frequently asked questions

What does .* mean in regex?

Any characters, any number of times, including none. . is any character except a line break and * repeats it. It is greedy, so a.*b runs to the last "b" on the line. Use .*? to stop at the first.

What is the difference between * and + in regex?

* allows zero repeats and + needs at least one. ab*c matches "ac", but ab+c doesn't.

How do I match a literal dot or bracket?

Put a backslash in front: \., \[, \(. Inside square brackets most characters are already literal, so [.] also matches a dot.

What does ?: mean in regex?

It makes a group that doesn't capture. (?:ab)+ repeats "ab" without saving it as group 1, which keeps the group numbers of the groups you do care about stable.

How do I make a regex case-insensitive?

Add the i flag: /hello/i in JavaScript, re.I in Python, Pattern.CASE_INSENSITIVE in Java, or (?i) at the start of the pattern anywhere but JavaScript. To make only part of a pattern case-insensitive, (?i:…) works in all five.

Can a regex validate an email address?

Only its shape. A simple pattern like the one in the table catches typos. Whether the mailbox exists, and belongs to the person typing it, only a confirmation email can tell you.

Is regex the same as the * in *.txt?

No. That is a glob, used by shells and file pickers, where * means "any characters". In regex, * repeats the item before it, so the regex equivalent of *.txt is ^.*\.txt$.

Can I use regex to read JSON or HTML?

Not reliably. Both allow nesting that a regex can't follow, as the HTML tag pattern's false positive shows. Parse them instead: JSON.parse for the JSON an API sends back, and a real HTML parser for pages.

Every example on this page was run on September 28, 2026. Engines change: Python 3.14 added \z, and JavaScript gained scoped flags in 2025, so check the version you run against the one tested here.