Regex file search: from wildcards to 10 copy-paste patterns

The short version: regex is wildcards with superpowers. Where *.xlsx matches "anything ending in .xlsx", a regex like \.(jpe?g|png|gif|webp)$ matches four image extensions in one query. You don't need to learn regex from scratch — grab a pattern from the 10 below, paste it into Everything (press Ctrl+Shift+R first), grepWin, or Agent Ransack, and tweak the obvious bits.

Wildcards vs regex: the mental bridge

You already know wildcards: *.xlsx finds every Excel file, report?.docx finds report1.docx through report9.docx. Wildcards have exactly two tricks — * for "any characters" and ? for "one character" — and that's where they stop. You can't say "this or that", "exactly four digits", or "only at the end of the name".

Regex (regular expressions) is the same idea with a richer alphabet. The bridge is literal: the wildcard *.xlsx becomes the regex ^.*\.xlsx$. Read it piece by piece: ^ means "start of the name", .* means "any characters" (regex's . is wildcard's ?, and * means "repeat the previous thing"), \. is a literal dot (escaped, because a bare dot is special), xlsx is literal text, and $ means "end of the name". Every regex is just those five kinds of pieces glued together: literals, "any character", repeats, alternatives, and anchors. Our glossary defines the jargon if you hit a term you don't know.

A 5-minute regex crash course

These eleven tokens cover 95% of file-search needs:

One habit change from wildcards: a regex matches anywhere in the name unless you anchor it. \.log happily matches "my.logfile.txt" — write \.log$ when you mean "ends with .log".

10 copy-paste regex patterns

Paste these as-is, then adjust the obvious literals (years, words, extensions). Patterns 1–5 and 10 are for filenames; 6–9 search file contents, so use them in grepWin, Agent Ransack's "Containing text" box, or ripgrep.

1. Invoices from the 2020s — matches invoice_2024.pdf, invoice-2027.xlsx; change the literal word to suit.

invoice[_-]20(2[0-9])

2. Any image, one query — every jpg/jpeg/png/gif/webp; add |bmp|tiff? inside the group for more.

\.(jpe?g|png|gif|webp)$

3. ISO-dated filenames — anything containing a 2026-06-12-style date, e.g. backups and exports.

\d{4}-\d{2}-\d{2}

4. Version numbers — v1.2, v2.10.3; the (\.\d+)? makes the third number optional.

v\d+\.\d+(\.\d+)?

5. Duplicate copies — files like "report (2).docx" or "photo (copy).jpg" left behind by Explorer and cloud sync.

\((copy|[0-9])\)\.

6. Email addresses in content — pragmatic, not RFC-perfect; great for auditing exports before sharing them.

[\w.+-]+@[\w-]+\.[\w.]+

7. IP addresses in content — finds 192.168.1.10 in logs and configs (also matches a few impossible ones like 999.1.1.1 — fine for searching).

\b\d{1,3}(\.\d{1,3}){3}\b

8. TODO/FIXME comments in code — every loose end across a project, with whatever was written after it.

\b(TODO|FIXME)\b.*

9. Phone-ish numbers in content — US-style 555-123-4567, (555) 123 4567; add your local format as another alternative.

\(?\d{3}\)?[-. ]\d{3}[-. ]\d{4}

10. Space before the extension — sloppy names like "summary .pdf" that break sorting and scripts.

\s+\.[A-Za-z0-9]+$

Where to use them: tool by tool

Everything (filenames, instant)

Everything is the fastest place to run filename patterns — results update as you type, even with regex. Enable it via Search → Enable Regex (Ctrl+Shift+R), or prefix a single query with regex:, e.g. regex:\((copy|[0-9])\)\.. Remember it searches names and paths only, never contents.

grepWin (contents + search-and-replace)

grepWin treats regex as its native language: right-click a folder in Explorer, choose Search with grepWin, make sure Regex search is selected, and paste a pattern into Search for. It's the only free tool here that also does regex replace with capture groups — pattern 3 plus a replace string can rename a thousand log lines in one pass.

Agent Ransack (contents, no index)

In Agent Ransack, both the File name and Containing text boxes have an expression-type dropdown next to them — switch it from "Boolean" to Regular Expression and paste away. It's the better choice when you want regex over Office documents and PDFs; see our Agent Ransack vs grepWin comparison for where each wins.

ripgrep (Linux, macOS, and Windows terminals)

On the command line, rg is the speed king for content patterns: rg "\b(TODO|FIXME)\b" ~/projects. For filename patterns, list and filter: rg --files | rg "\d{4}-\d{2}-\d{2}". Our Linux file search guide covers ripgrep, fd and friends in detail.

Escaping pitfalls (and the test-before-replace rule)

• The dot is the #1 trap. . means "any character", so backup.zip also matches "backup0zip" buried in a longer name. Write backup\.zip when you mean a literal dot.
• Parentheses and brackets are special too. Searching for "(final)" in a filename needs \(final\) — unescaped, the parentheses just form a group and silently match "final".
• Shells eat backslashes. In a Linux/Mac terminal, always single-quote patterns: rg '\d{4}'. Double quotes or no quotes let the shell mangle \, $ and | before ripgrep ever sees them.
• Case sensitivity differs per tool. Everything follows its Search → Match Case toggle, grepWin and Agent Ransack have case checkboxes, and ripgrep is case-sensitive unless you pass -i. If a pattern "doesn't work", check case first.

And the rule that saves careers: never run a regex replace you haven't run as a search first. Look at the match list, confirm it's exactly what you expect, and only then replace. In grepWin, also tick Create backup files before any replace — it writes a .bak copy of every modified file, which is the difference between an "oops" and an afternoon of restores. A regex that matches slightly too much can rewrite thousands of files in seconds.

FAQ