Regular Expressions for Beginners: Reading Regex Without Panic

AI coding tools love regular expressions. Ask for email validation, a search feature, or a log parser, and you'll likely get something like:

^[\w.+-]+@[\w-]+\.[a-z]{2,}$

You don't need to write regex from memory. But being able to read one — enough to know roughly what it does and spot when it's wrong — is a genuinely useful skill.

What a regular expression is

A regular expression (regex) is a pattern for matching text. You use it to:

Check whether text fits a pattern ("is this a valid postcode?").
Find things in text ("every date in this log file").
Replace parts of text ("change all phone numbers to [redacted]").

Most languages support them, with small differences: JavaScript, Python, and most editors' search boxes.

The dozen symbols that cover most regex

Literal characters

cat matches the text "cat." Most letters and numbers just match themselves.

Character classes — "one of these"

Pattern	Matches
`[abc]`	one of a, b, or c
`[a-z]`	any lowercase letter
`[0-9]`	any digit
`[^0-9]`	anything except a digit
`.`	any single character (except a newline)
`\d`	a digit (same as `[0-9]`)
`\w`	a "word" character: letter, digit, or underscore
`\s`	whitespace: space, tab, newline

Quantifiers — "how many"

Pattern	Means
`a*`	zero or more a's
`a+`	one or more
`a?`	zero or one (optional)
`a{3}`	exactly three
`a{2,}`	two or more
`a{2,5}`	between two and five

Anchors — "where"

Pattern	Means
`^`	start of the text (or line)
`$`	end of the text (or line)
`\b`	a word boundary

Groups and alternatives

Pattern	Means
`(abc)`	a group — treat as one unit, and capture it
`cat\|dog`	cat or dog

Escaping

Symbols like ., +, ?, (, and $ have special meanings. To match them literally, put a backslash in front: \. matches an actual full stop.

Reading one, piece by piece

Back to our email pattern:

^[\w.+-]+@[\w-]+\.[a-z]{2,}$

Break it apart:

Piece	Meaning
`^`	start of the text
`[\w.+-]+`	one or more letters, digits, underscores, dots, pluses, or hyphens
`@`	a literal @
`[\w-]+`	one or more letters, digits, underscores, or hyphens
`\.`	a literal full stop
`[a-z]{2,}`	two or more lowercase letters
`$`	end of the text

So it matches [email protected] — and, reading it, you can spot limitations: it rejects [email protected] (only one dot is allowed after the @), and uppercase endings like .COM. Reading regex is how you catch this.

A few practical examples

/^\d{5}$/                 // exactly five digits (a US ZIP code)
/\b\d{4}-\d{2}-\d{2}\b/   // a date like 2026-09-24
/^\s+|\s+$/g              // leading or trailing whitespace
/https?:\/\/\S+/g         // URLs starting with http:// or https://

In JavaScript, a regex is written between slashes. Letters after the closing slash are flags: g for "find all matches," i for "ignore case," m for "multi-line."

"Call 555-1234 or 555-9876".match(/\d{3}-\d{4}/g)
// ["555-1234", "555-9876"]

"Hello World".replace(/world/i, "there")
// "Hello there"

Testing a regex

Never trust a regex you haven't tested — including one your AI tool wrote. Use an interactive tester like regex101.com: paste the pattern and some sample text, and it highlights matches and explains every part in plain English.

Test with:

Text that should match — including unusual but valid cases.
Text that shouldn't match.
Edge cases: empty text, very long text, spaces, accented letters.

Better still, ask your AI tool to write tests with those examples, so the regex stays correct when someone changes it. (How to Write Tests With AI.)

When not to use regex

Email validation. Real email addresses are far more varied than any simple pattern. Do a light check (there's an @ and a dot after it) with <input type="email"> and then send a confirmation email — the only real test. (Form Validation Explained.)
Parsing HTML, JSON, or other structured formats. Use a proper parser — JSON.parse, an HTML parser. Regex breaks on nesting.
Dates, URLs, and phone numbers where a library exists. Libraries handle the endless edge cases.
Anything you can't read. A 200-character regex nobody understands is a bug waiting to happen. Split it, comment it, or use code.

A warning: slow regex

Some patterns — typically nested quantifiers like (a+)+ — can take an extremely long time on certain inputs. Attackers can exploit this with crafted input to freeze a server, an attack known as ReDoS. Be wary of complex patterns applied to user input, and keep input length limited.

EasySpawn gives Claude Code a full workspace to run your test suite, so a regex it writes can be checked against real examples before it ships. See how it works or join the waitlist.