Metacharacters and Core Character Classes
Metacharacters govern character types and anchor positions in text. Escape any reserved metacharacter with a backslash (\) to treat it as a literal character:
| Character | Definition | Matching Example |
|---|---|---|
| . | Any single character except line breaks (unless the s flag is enabled) | a.c → abc, a1c, a-c |
| \d / \D | Any digit [0-9] / Any non-digit character | \d4 → 2026 |
| \w / \W | Alphanumeric word character [a-zA-Z0-9_] / Non-word character | \w+ → user_name |
| \s / \S | Whitespace character (space, tab, newline) / Non-whitespace | \s+ → matches consecutive spaces |
| ^ / $ | Start of string / End of string (or line boundary in multiline mode) | ^https → only matches beginning |
| \b / \B | Word boundary / Non-word boundary | \bcat\b → cat (excludes catalog) |
Quantifiers: Greedy, Lazy, and Explicit Ranges
Quantifiers dictate how many consecutive occurrences of the preceding element or group are required:
Standard Repetition * : 0 or more times+ : 1 or more times? : 0 or 1 time (optional)
Interval Counts {3} : exactly 3 times{2,5} : between 2 and 5 times{3,} : 3 or more times
Lazy Matching *? : minimal repetition+? : stop at first match{2,5}? : match smallest limit (2)
Grouping and Lookaround Assertions (Zero-Width Checks)
Parentheses establish sub-patterns, capturing matches or testing contextual preconditions without advancing cursor offsets:
(abc) — Capturing Group. Stores matched text in memory index $1.(?:abc) — Non-capturing Group. Organizes branches without memory overhead.(?<name>abc) — Named Group. Stores match under groups.name.(?=abc) — Positive Lookahead. Asserts that abc follows immediately ahead.(?!abc) — Negative Lookahead. Asserts that abc does NOT follow ahead.(?<=abc) — Positive Lookbehind. Asserts that abc precedes immediately behind.(?<!abc) — Negative Lookbehind. Asserts that abc does NOT precede behind.
6 Production-Tested Patterns for Copy-Paste
1. Email Address (Industry Production Standard) ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$
2. URL with http / https protocol ^https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*)$
3. International Phone Number (E.164 Format) ^\+?[1-9]\d{1,14}$
4. ISO 8601 Calendar Date (YYYY-MM-DD) ^\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$
5. IPv4 Address (Strict 0-255 Octet Range) ^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
6. Hexadecimal Color Code (#RGB or #RRGGBB) ^#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$
Related Digital Vault PRO Tools
-
👉 Regex Tester & Debugger — real-time regular expression evaluation in your browser with color-coded capturing groups.
-
👉 Text Cleaner & Formatter — strip whitespace, deduplicate lists, and clean raw text datasets.
-
👉 SQL Formatter & Validator — beautify, indent, and validate database queries.
Frequently asked questions
What is the difference between greedy and lazy quantifiers in Regular Expressions?
By default, quantifiers (*, +, {n,}) are greedy: they match as much text as possible. Adding a question mark (?, *?, +?, {n,}?) converts them to lazy quantifiers, which stop matching at the very first possible occurrence. For example, in the string "<p>one</p><p>two</p>", the greedy pattern "<p>.*</p>" matches the entire string, while the lazy pattern "<p>.*?</p>" extracts each paragraph separately.
What is the difference between Positive Lookahead (?=...) and Negative Lookahead (?!...)?
Lookahead assertions inspect what follows without including those characters in the final match result (zero-width assertion). Positive Lookahead (?=...) asserts that the specified condition is present immediately ahead (e.g., \d+(?=px) matches numbers followed by "px"). Negative Lookahead (?!...) asserts that the condition is NOT present (e.g., (?!admin) filters out text not followed by "admin").
What is the standard production regex pattern for email address validation?
Strict RFC 5322 compliance regexes are overly complex for web forms. The universally adopted production standard for client-side sanity checking is: ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$. On backend servers, definitive email validation should always conclude with sending a one-time verification code.
What do standard regex flags mean: g, i, m, s, u, y?
Flags alter engine matching mechanics: g (global) matches all occurrences across the string; i (ignoreCase) enables case-insensitive matching; m (multiline) causes ^ and $ to match the start and end of individual lines; s (dotAll) allows the dot (.) to match newline characters; u (unicode) correctly handles 4-byte UTF-16 code points and emojis; y (sticky) matches strictly at the lastIndex offset.
What is ReDoS (Catastrophic Backtracking) and how do you prevent it?
Regular Expression Denial of Service (ReDoS) occurs when vulnerable expressions featuring nested quantifiers (such as (a+)+$) evaluate non-matching strings. The engine explores trillions of permutations, freezing the execution thread at 100% CPU. Mitigation strategies include avoiding nested repetition, enforcing execution timeouts, and leveraging non-backtracking engines.