Regular Expressions: They're Not as Scary as They Look
A practical guide to regex covering character classes, quantifiers, groups, lookahead/lookbehind, with real examples for email validation, log parsing, and find-and-replace.
Regular expressions have a reputation for being unreadable. And honestly, when you see something like ^(?:[a-z0-9!#$%&'+/=?^_{|}~-]+(?:\.[a-z0-9!#$%&'+/=?^_{|}~-]+)|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f])")@ that reputation feels earned. But most regex you'll write in practice is nowhere near that complex. The basics are genuinely simple, and they'll save you hours of string parsing.
The Building Blocks
Literal characters
cat matches the string "cat". Nothing fancy. Most characters match themselves.
Character classes
Square brackets match any single character from a set:
[aeiou]-- any vowel[0-9]-- any digit[a-zA-Z]-- any letter[^0-9]-- any character that's NOT a digit (the^negates inside brackets)
\d-- any digit (same as[0-9])\w-- any "word character" (letters, digits, underscore)\s-- any whitespace (space, tab, newline).-- any character except newline
Quantifiers
How many times should something repeat?
a*-- zero or more "a"sa+-- one or more "a"sa?-- zero or one "a" (optional)a{3}-- exactly 3 "a"sa{2,5}-- between 2 and 5 "a"sa{2,}-- 2 or more "a"s
Anchors
^-- start of string (or line, with multiline flag)$-- end of string\b-- word boundary
^hello$ matches only the exact string "hello", not "hello world" or "say hello".
Groups and Capturing
Parentheses group things together and capture the match:
(\d{4})-(\d{2})-(\d{2})This matches a date like 2026-03-26 and captures three groups: year, month, day. In most languages, you can access these captures:
import re
match = re.search(r'(\d{4})-(\d{2})-(\d{2})', '2026-03-26')
year = match.group(1) # "2026"
month = match.group(2) # "03"
day = match.group(3) # "26"(?:...) when you need grouping but don't care about capturing:
(?:http|https)://\S+This matches URLs starting with http or https but doesn't waste a capture group on the protocol.
Lookahead and Lookbehind
These let you assert that something exists before or after your match without including it in the match itself.
Positive lookahead(?=...) -- what follows must match:
\d+(?=px)Matches "16" in "16px" but not "16" in "16em". The "px" is checked but not included in the match.
Negative lookahead(?!...) -- what follows must NOT match:
\d+(?!px)Matches "16" in "16em" but not in "16px".
Lookbehind works the same but checks what comes before:(?<=...) for positive, (? for negative.
(?<=\$)\d+
Matches "50" in "$50" but not in "50 items".
Practical Examples
Validating email addresses (and why it's hard)
Here's a "good enough" email regex:
^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$
This catches most valid emails. But technically, the full email spec (RFC 5322) allows quoted strings, comments, and all sorts of edge cases that make a truly compliant regex absurdly long. For production use, validate the format loosely with a simple regex, then verify the email actually exists by sending a confirmation.
The real lesson: regex is great for pattern matching, but don't try to encode an entire specification into one pattern.
Extracting data from logs
Given log lines like:
[2026-03-26 14:23:45] ERROR: Connection timeout (host=db-primary, retry=3)
Extract the timestamp and error message:
\[(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2})\] ERROR: (.+)
Group 1 gives you the timestamp, Group 2 gives you the error message.
Find-and-replace in your editor
Most code editors support regex in find/replace. Some patterns I use regularly:
Convert console.log calls to use a logger:
Find: console\.log\((.+)\)
Replace: logger.info($1)
Swap function arguments:
Find: doThing\((\w+), (\w+)\)
Replace: doThing($2, $1)
Remove trailing whitespace:
Find: \s+$
Replace: (empty)
Convert single quotes to double quotes (carefully):
Find: '([^']*)'
Replace: "$1"
Matching IP addresses
\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b
This matches the format but doesn't validate ranges (it would match 999.999.999.999). For strict validation, you'd need more complex alternation -- or just parse the string and check numerically. Again, regex for format, code for validation.
Tools for Testing
regex101.com is the gold standard. Paste your regex, paste your test string, and it highlights matches, explains each token, and shows capture groups. It supports different regex flavors (Python, JavaScript, Go, etc.) since they have subtle differences.
Your IDE's built-in find/replace with regex enabled is also great for quick testing against real code.
Common Traps
Greedy vs lazy matching. By default, . is greedy -- it matches as much as possible. Given the string hello and world, the pattern . matches the entire thing (from the first ? to make it lazy: .*? matches hello only.
Forgetting to escape special characters. If you want to match a literal dot, use \. not . (which matches any character). Same for \(, \, \*, etc.
Backtracking catastrophe. Badly written regex can be exponentially slow on certain inputs. Patterns like (a+)+b against a string of all "a"s will cause the regex engine to choke. Avoid nested quantifiers on the same characters.
When NOT to Use Regex
- Parsing HTML or XML. Use a proper parser. Regex and nested structures don't mix.
- Complex data validation. Parse it into a data structure and validate with code.
- When
string.split() or string.startsWith() would do the job. Simpler is better.
Regex is a tool, not a lifestyle. Use it for pattern matching on flat text, and reach for something else when the structure gets nested.
If you want to practice regex alongside other programming fundamentals, [CodeUp has interactive challenges that help you build pattern-matching intuition -- way more effective than just reading about it.