Regular Expressions is a 25-lesson interactive course: each lesson gives you a piece of test text and a goal (“match these, do not match those” or “capture this part”), you edit the pattern in the input box, the matches and groups are highlighted live on the right, and the checker tells you item by item which goals you have met. Everything is checked by the browser's own JavaScript regular expression engine, and no text is uploaded.

The course progresses by difficulty: first the basics of finding characters — literals, the dot and escaping; then character classes and ranges, the predefined classes \d \w \s and the four quantifiers; then anchors and word boundaries, alternation, the three kinds of grouping and backreferences, greedy and lazy matching; then lookahead and lookbehind assertions and the flags; and finally three real patterns (mainland China mobile numbers, email addresses and dates) to practise on, closing with a lesson on catastrophic backtracking where you deliberately write a pattern that locks the engine up and then fix it.

It takes about 60 minutes. It suits people who have never written a regular expression, or who can copy one but not adapt it; readers who already know the basics can jump to the lookaround and traps from lesson 17 onwards.

1. 01Read the goalthe “Goal” line at the top of the exercise area states in one sentence what this lesson should and should not match; the test text below lists the fragments that should match and those that should not.
2. 02Edit the patterntype or change the pattern in the regular expression box and the test text highlights the matches as you type, with capture groups in different colours and the match count at the top right.
3. 03Read the verdictthe result bar under the input lists “should match ✓/✕”, “should not match ✓/✕” and “capture group ✓/✕” one by one; when everything is ticked the lesson is passed and turns green in the contents.
4. 04When you are stuckclick “Hint” for an idea that gives nothing away, and “Show answer” for a reference pattern that can be filled into the exercise area with one click so you can keep editing it.
5. 05Progress and sharingcompletion is stored in the local browser and survives a refresh; “Share this lesson” copies a link with ?lesson=n that lands directly on that lesson, and “Reset progress” clears every record for the course.

Lesson 14, “capture groups”, asks you to pull the year out of 2026-09-09. Here is a record of one run:

Test text       Release date: 2026-09-09, deadline: 2027-01-31
First attempt   \d+
  Matches       2026  09  09  2027  01  31       ← 6 matches, no capture group
  Verdict       ✕ only two whole dates should match   ✕ group 1 should be the year

Second attempt  (\d{4})-\d{2}-\d{2}
  Matches       2026-09-09  2027-01-31            ← 2 matches
  Group 1       2026        2027
  Verdict       ✓ 2 matches   ✓ group 1 = 2026 / 2027   → passed

Lesson 25, “catastrophic backtracking”, works the other way round: first you write a nested quantifier such as ^(a+)+$ and test it against a run of aaaaaaaaaaaaaaaaaaaaaaaaaaaa!, and the page reports the attempt count growing exponentially; then you are asked to rewrite it as something equivalent such as ^a+$ to pass.

A regular expression is a “pattern language”

A regular expression describes “what a class of strings looks like” with a small set of symbols. Letters and digits mostly stand for themselves, while a dozen metacharacters (. * + ? ^ $ | ( ) [ ] { } \) carry special meaning. The engine scans the text from left to right with the pattern, tries to match at every position and reports the position and length when it succeeds. This course uses the JavaScript (ECMAScript) dialect, whose basic syntax is almost identical to Python, Java and Go; the differences cluster around lookaround, Unicode properties and some flags.

Lessons 1–3: literals, the dot and escaping

cat matches the three characters c, a and t in sequence. The dot . matches any single character except a newline, so c.t matches cat, cut and c9t. When you really want a full stop (the dot before a file extension, say) you write \. — the backslash returns a metacharacter to its literal meaning. Every metacharacter can be escaped this way; inside a character class only ] \ ^ - need it.

Lessons 4–7: character classes

Square brackets list the candidates: [aeiou] matches any vowel; [a-z] and [0-9] use a hyphen for a range and can be listed side by side as [A-Za-z0-9_]; a leading ^ negates, so [^0-9] matches anything that is not a digit. Three common predefined classes are shorthand for these:

The uppercase forms \D \W \S are the negations. \w not covering CJK is the trap CJK users hit most often: to match CJK characters write [\u4e00-\u9fa5], or use \p{Script=Han} under the u flag.

Lessons 8–10: quantifiers

A quantifier follows one atom (a single character, a character class or a group) and says how many times it repeats:

• * zero or more, + one or more, ? zero or one;
• {n} exactly n times, {n,} at least n, {n,m} between n and m.

\d{4} reads better than \d\d\d\d, and \d{11} is a phone number's length. A quantifier applies only to the one atom immediately before it: ab+ is a followed by one or more b, and repeating the whole ab needs (ab)+.

Lessons 11–12: anchors and boundaries

^ and $ match no characters at all, only positions: the start and end of the string (or of each line in multiline mode). Form validation should almost always use ^…$, or \d{11} will happily “match” the first 11 digits of a 12-digit number. \b is a word boundary — the position between a \w and a \W (or the ends of the string). \bcat\b matches a cat but not concatenate. Again because \w excludes CJK, \b is essentially useless in CJK text.

Lessons 13–17: alternation, grouping and references

| means “or” and has the lowest precedence: cat|dog matches either word, and limiting the scope needs parentheses, as in gr(a|e)y. Parentheses also create a capture group: after a successful match the text inside can be read by number (match[1]) or referenced in a replacement string with $1 — one of the most productive uses of regular expressions, since turning 2026-09-09 into 09/09/2026 takes a single replace.

(?<year>\d{4}) is a named group read as groups.year, which is far less likely to shift when you edit the pattern than a numeric index. (?:…) is a non-capturing group: it groups without taking a number, which is what you want when you only need to scope a quantifier or an alternation. \1 is a backreference — it demands that whatever group 1 captured appears again here: (\w)\1 matches doubled letters such as ll and oo, and <(\w+)>.*?</\1> matches a pair of HTML tags.

Lesson 18: greedy and lazy

Quantifiers are greedy by default: they take as much as they can and then give some back. Applied to "a" and "b", ".+" swallows everything from the first quote to the last. Adding ? after a quantifier makes it lazy: ".+?" takes as little as possible, giving two matches "a" and "b". A more precise alternative is a negated character class, "[^"]+", which does not rely on backtracking and is usually faster.

Lessons 19–20: lookaround assertions

Lookaround matches a position like an anchor does, but with the condition that a pattern is (or is not) next to it:

• (?=…) lookahead: what follows must be …; \d+(?=元) matches the 100 in 100元 without including the currency character in the match.
• (?!…) negative lookahead: what follows must not be ….
• (?<=…) lookbehind: what precedes must be …; (?<=¥)\d+ matches a price without the currency symbol.
• (?<!…) negative lookbehind.

JavaScript has supported lookbehind since ES2018, and only from Safari 16.4 is it universally available; Python requires lookbehind to be fixed-length. Password strength checks are the classic use: ^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}$ uses three lookaheads to check “contains a digit, contains a lowercase, contains an uppercase” from the same position, and then .{8,} consumes the whole string.

Lesson 21: flags

Flags go outside the pattern: i ignores case; g finds every match rather than the first (the course's highlighting always uses g); m makes ^ and $ match each line; s lets . match newlines too; u turns on Unicode mode, so . matches by code point rather than UTF-16 code unit and an emoji counts as one character; y is sticky, requiring a match immediately at lastIndex.

Lessons 22–24: three everyday patterns

Mainland China mobile numbers: ^1[3-9]\d{9}$ — starting with 1, second digit 3–9, eleven digits in all. Do not try to enumerate carrier prefixes; they are extended every year.

Email: a regular expression that fully implements RFC 5322 runs to thousands of characters and is not practical. A reasonable form check is ^[^\s@]+@[^\s@]+\.[^\s@]+$: exactly one @, non-empty on both sides, and at least one dot in the domain part. Real verification is a confirmation email.

Dates: ^(\d{4})-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$ constrains the month to 01–12 and the day to 01–31, but cannot know how many days February has — leave syntax to the regular expression and semantics to code.

Lesson 25: catastrophic backtracking

The engines in JavaScript, Python, Java and PCRE all backtrack: when several splits are possible they try one, and on failure they come back and try the next. Nested quantifiers make the number of splits grow exponentially: faced with 30 a characters plus a !, ^(a+)+$ has to try more than 2^30 different splits before it can declare failure, freezing the browser tab for seconds or minutes. A pattern like that accepting user input is a denial-of-service attack (ReDoS).

The rules for avoiding it: do not let two adjacent quantifiers match the same characters ((a+)+, (\w+\s?)+ and (.*)* are all danger signs); replace a lazy .*? with a negated character class; and put a length limit on the input. Go and Rust use Thompson NFA / DFA engines that guarantee linear time, at the cost of not supporting backreferences or lookaround — Russ Cox's article explains the difference between the two implementations most clearly.

What regular expressions are not good for

Matching nested structures (balanced brackets, a whole HTML document), tasks that need counting (deciding whether the numbers of opening and closing brackets are equal) and judgements that depend on context or semantics (whether a number is a legal date) are impossible or very hard with regular expressions. They are a tool for the lexical layer: finding tokens, splitting, simple validation and bulk replacement — and for those they are irreplaceable.

Dialect

only JavaScript (ECMAScript 2018+) regular expressions are taught; PCRE's inline (?i) modifier, Python's (?P<name>), Java's \p{javaLowerCase} and the POSIX character classes [[:alpha:]] are not covered.

Unicode

the u flag is only introduced briefly in the flags lesson; \p{…} property escapes and the set operations of the v flag are out of scope.

Checking

a lesson passes when every fragment that should match does, every fragment that should not match does not, and the named capture groups have the expected content; the answer is not unique, and any pattern that satisfies the conditions passes.

Backtracking demo

lesson 25 simulates the freeze with a step limit and never actually locks the page; a real engine's cost depends on the input length.

What it does not do

it is not a regex tester (use “Regex Test” to debug against large text), does not generate patterns, and does not cover the API calls of individual programming languages.

• “\w matches CJK characters”: it does not. \w is ASCII letters, digits and underscore only; use [\u4e00-\u9fa5] or \p{Script=Han} (which needs the u flag) for CJK.
• “. matches any character”: by default it does not match a newline; add the s flag or use [\s\S] to cross lines.
• “Writing \d{11} accepts exactly 11 digits”: without anchors it will find an 11-digit run inside a longer number; validation always needs ^…$.
• “[A-z] is all the letters”: in ASCII there are six symbols between uppercase Z (90) and lowercase a (97) — [ \ ] ^ _ \`` — and they are matched too; write [A-Za-z]`.
• “A quantifier applies to everything before it”: ab+ repeats only the b; ab{2} matches abb and not abab.
• “Regular expressions are a convenient way to parse HTML”: only for the simplest fragments of known shape; nested tags, a > inside an attribute and comments all defeat it, so use a DOM parser.

The course runs entirely locally in the browser: the patterns and test text you type go only to the browser's own regular expression engine and are never sent to a server; progress is stored in local localStorage. The input is released when the page is closed.

• ECMA-262, ECMAScript Language Specification, §22.2 RegExp (Regular Expression) Objects — the authoritative syntax and semantics of JavaScript regular expressions: https://tc39.es/ecma262/#sec-regexp-regular-expression-objects（访问日期：2026-09-09）
• MDN Web Docs, the Regular expressions guide and the regular expression syntax cheat sheet — the practical reference for this course's dialect, including browser compatibility tables for every flag and assertion: https://developer.mozilla.org/zh-CN/docs/Web/JavaScript/Guide/Regular_expressions（访问日期：2026-09-09）
• Russ Cox, Regular Expression Matching Can Be Simple And Fast (2007) — the performance difference between backtracking engines and Thompson NFAs, and the theory behind lesson 25: https://swtch.com/~rsc/regexp/regexp1.html（访问日期：2026-09-09）
• OWASP, Regular expression Denial of Service - ReDoS — recognising dangerous patterns and defending against them: https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS（访问日期：2026-09-09）
• Jeffrey E. F. Friedl, Mastering Regular Expressions, 3rd ed., O'Reilly, 2006 — the most complete treatment of backtracking and cross-dialect differences.