Regex Recipes v1.0.0

Regex Recipes

Copy-paste regex patterns that actually work, with test strings and the gotchas that bite you at 2am. Flavors covered: Python re, JavaScript, and PCRE (grep -P, PHP). Differences are flagged where they matter.

Golden rules before the recipes:

1. Test with both matches AND non-matches. A pattern that matches everything is not a validator.
2. Anchor when validating, don't anchor when searching. ^...$ for "is this an email", bare pattern for "find emails in this text".
3. Prefer simple over clever. If the pattern needs a paragraph to explain, split it into two steps in code instead.

Email address (practical, not RFC-perfect)

^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$

• Matches: user.name+tag@example.com
• Rejects: user@, @example.com, user@example (no TLD)
• Gotcha: this rejects some technically-valid RFC addresses (quoted strings, IP literals). That's fine — you want the 99.9% case, and the real validation is sending a confirmation email anyway.
• Never use regex alone to "verify" an email. Pattern-check, then send the confirmation link. That's the validation.

URL (http/https)

https?://[^\s/$.?#].[^\s]*$

• Matches: https://example.com/path?q=1#frag
• For extracting URLs from text, drop the $ anchor and use the global flag.
• Gotcha: trailing punctuation. In prose, https://example.com. often captures the period. Strip [.,;:!?)] from the end after matching: in Python, url.rstrip('.,;:!?)').

Phone numbers (international-ish)

^\+?[0-9][0-9\s().-]{6,18}[0-9]$

• Matches: +1 (205) 555-0142, 2055550142, +44 20 7946 0958
• Rejects: abc, 123 (too short)
• This is intentionally loose. Phone formats vary too much for strict regex; pair it with a digit-count check: len(re.sub(r'\D', '', s)) between 7 and 15.
• For US-only strictness: ^\(?[0-9]{3}\)?[-.\s]?[0-9]{3}[-.\s]?[0-9]{4}$

Dates

ISO 8601 (strict-ish):

^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$

US MM/DD/YYYY:

^(0[1-9]|1[0-2])/(0[1-9]|[12]\d|3[01])/\d{4}$

• Gotcha: 2026-02-30 passes the pattern but isn't a real date. Regex checks shape, not validity — parse with a real date library after.
• Rule of thumb: regex for shape, datetime.strptime / Date for truth.

IPv4

^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$

• Matches: 192.168.1.1, rejects 999.1.1.1
• The octet pattern (25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d) is the standard 0-255 matcher — memorize it, it recurs everywhere.

Semantic version

^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z.-]+))?(?:\+([0-9A-Za-z.-]+))?$

• Groups: 1=major, 2=minor, 3=patch, 4=prerelease, 5=build
• Matches: 1.2.3, 2.0.0-beta.1+build.42

Hex color

^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$

• Matches #fff, #ff8800, #ff8800cc (with alpha). Rejects #ffff.

Slug (URL-safe identifier)

^[a-z0-9]+(?:-[a-z0-9]+)*$

• Matches my-cool-post-2, rejects -leading, trailing-, double--dash, UPPERCASE, under_scores.

Whitespace cleanup

Collapse runs of whitespace to single spaces:

# Python
re.sub(r'\s+', ' ', text).strip()
# JavaScript
text.replace(/\s+/g, ' ').trim()

Split on blank lines (paragraphs):

re.split(r'\n\s*\n', text)

Numbers in text

Integer or decimal, optional sign:

^[+-]?(?:\d+\.?\d*|\.\d+)$

Thousands-separated (US):

^\d{1,3}(?:,\d{3})*(?:\.\d+)?$

• Gotcha: the second pattern rejects 1234 (no comma). If both plain and grouped numbers are valid input, strip commas first, then use the first pattern.

Quoted strings (with escapes)

"([^"\\]|\\.)*"

• Matches "say \"hi\"" correctly, stopping at the unescaped quote.
• The ([^"\\]|\\.) idiom — "not a quote or backslash, OR an escape sequence" — is the standard safe way to match quoted content.

<[^>]+>

• Replace with '' to strip tags. Works for well-formed markup.
• Warning: this is a stripper, not a parser. For anything beyond quick cleanup, use a real HTML parser. Regex cannot parse HTML in the general case — nested tags, comments, and CDATA will fool it.

python
phone_re = re.compile(r"""
    ^\+?              # optional country-code plus
    [0-9]             # first digit
    [0-9\s().-]{6,18} # middle chunk
    [0-9]$            # last digit
""", re.VERBOSE)

python
m = re.match(r'(?P<year>\d{4})-(?P<month>\d{2})-(?P<day>\d{2})', s)
m.group('year')  # clearer than m.group(1)

1. Never nest a quantifier inside a repeated group: (a+)+ is the classic killer. Rewrite as (a+) or use atomic groups where supported: (?>a+)+.
2. Make alternatives mutually exclusive so the engine can't re-split the input many ways: (?:ab|a) is safer ordered as (?:ab|a) with the longer alternative first.
3. If a pattern comes from user input, set a timeout: Python 3.11+ has no built-in regex timeout — run it in a thread with a deadline, or use the third-party regex module which supports timeout=.
4. Test every new pattern against a long non-matching string ('a' 50 + '!') and time it. If it takes >10ms, rewrite it.

Quick reference

| Token | Meaning | |---|---| | . | any char except newline | | \d \w \s | digit / word char / whitespace | | \D \W \S | negations | | ^ $ | start / end of string (or line with m) | | \b | word boundary | | + ? | 0+, 1+, 0-or-1 (greedy) | | ? +? ?? | lazy versions | | {n} {n,} {n,m} | exact / at-least / range | | (...) | group; (?:...) non-capturing | | (?=...) / (?<=...) | lookahead / lookbehind | | a\|b | alternation | | [abc] [^abc] [a-z] | char class / negated / range | | \1 or \k<name> | backreference |

Debugging checklist

• [ ] Anchored (^$) if validating, unanchored if searching?
• [ ] Tested with inputs that should FAIL, not just pass?
• [ ] Escaped literal dots, parens, plus signs in the pattern?
• [ ] Character classes: is - at the start/end or escaped?
• [ ] Quantifier applied to what you think (group vs single char)?
• [ ] Timed against a long non-matching string (backtracking check)?
• [ ] Unicode behavior of \d, \w checked for this flavor?