Regular expressions — regex — look like keyboard noise at first. But once you understand the building blocks, regex becomes one of the most powerful tools in any developer's arsenal. Here are the 10 patterns you will actually use.
Core Building Blocks
| Symbol | Meaning |
|---|---|
| . | Any single character |
| * | Zero or more of the previous |
| + | One or more of the previous |
| ^ | Start of string |
| $ | End of string |
| d | Any digit 0–9 |
| w | Any word character (a-z, A-Z, 0-9, _) |
| {n,m} | Between n and m repetitions |
10 Essential Patterns
1. Email address — matches standard email format with domain validation
2. URL — matches http and https URLs with paths and query strings
3. US phone number — matches common formats: (555) 123-4567, 555-123-4567, +1 555 123 4567
4. Hex color code — matches both 3-digit (#FFF) and 6-digit (#FFFFFF) hex colors
5. ISO date YYYY-MM-DD — validates month range (01–12) and day range (01–31)
6. IP address — matches dotted decimal notation with 1–3 digits per octet
7. URL slug — matches clean URL slugs with lowercase letters, numbers, and hyphens only
8. Strong password — requires uppercase, lowercase, digit, and special character, minimum 8 chars
9. Extract links from HTML — captures all URLs from href attributes in an HTML string
10. Remove extra whitespace — replace with a single space to normalize any string, one of the most-used patterns in data cleaning
Why Regex Engines Actually Differ
A pattern that works perfectly in JavaScript can fail or behave differently in Python or PCRE, because each language implements its own regex engine with different feature support — named capture groups, lookbehind assertions, and Unicode property escapes all have varying levels of support across engines. This isn't a minor compatibility footnote: copying a regex pattern from one language's documentation into another without testing it is a common source of subtle bugs that only surface on specific edge-case inputs.
The Catastrophic Backtracking Trap
Certain regex patterns, especially ones with nested quantifiers like (a+)+, can cause the engine's backtracking to explore an exponentially growing number of possible matches on certain inputs, freezing or crashing the application — this is a real, documented class of vulnerability (ReDoS, Regular Expression Denial of Service) that has taken down production services. Testing patterns against long or adversarial input strings, not just the happy-path examples, is the only reliable way to catch this before it becomes an outage.
Test Your Patterns Free
Use the Anonymiz Regex Tester to write a pattern and test it against sample text in real time. See matches highlighted instantly. Supports JavaScript, Python, and PCRE modes. No setup, no account.
