Pattern

Regex for TODO / FIXME marker

TODO or FIXME comment marker in code.

The TODO / FIXME marker regex is (TODO|FIXME|HACK|XXX|NOTE)($[^)]+$)?:\s*(.*) — copy it below, or open it in the explainer for a token-by-token breakdown.

The pattern

(TODO|FIXME|HACK|XXX|NOTE)($[^)]+$)?:\s*(.*)

Try in explainer → Download cheat sheet ↓

What it matches

TODO: refactor this
FIXME(alice): null check
HACK: workaround for bug

What it doesn't match

todo lowercase
TO DO: space

Notes & gotchas

Captures the marker type, optional author/owner in parens, and the message. Use to grep for outstanding work in a codebase.

Code in your language

Use the explainer's Code tab to generate ready-to-paste snippets in JavaScript, Python, Java, .NET, Go, Ruby, and PHP for this pattern.

Open in explainer →

Token-by-token breakdown

Every part of the pattern, left to right:

Token	Meaning
`(`	start of a capturing group
`TODO`	literal text “TODO”
`\|`	OR — try the alternative
`FIXME`	literal text “FIXME”
`\|`	OR — try the alternative
`HACK`	literal text “HACK”
`\|`	OR — try the alternative
`XXX`	literal text “XXX”
`\|`	OR — try the alternative
`NOTE`	literal text “NOTE”
`)`	end of group
`(`	start of a capturing group
`\(`	literal “(”
`[^)]+`	one or more: any character except “)”
`\)`	literal “)”
`)?`	end of group, optional (zero or one)
`:`	literal text “:”
`\s*`	zero or more: whitespace
`(`	start of a capturing group
`.*`	zero or more of any character
`)`	end of group

About this pattern

Developer-oriented patterns help with code analysis, log parsing, and data transformation. Use these in build scripts, CI tools, and code review utilities.

Quick usage in different languages

This exact pattern — with the correct escaping and idioms for each language:

JavaScript: /(TODO|FIXME|HACK|XXX|NOTE)($[^)]+$)?:\s*(.*)/.test(value)
Python: re.match(r"(TODO|FIXME|HACK|XXX|NOTE)($[^)]+$)?:\s*(.*)", value)
Java: Pattern.compile("(TODO|FIXME|HACK|XXX|NOTE)(\$[^)]+\$)?:\\s*(.*)").matcher(value).matches()
C# / .NET: Regex.IsMatch(value, @"(TODO|FIXME|HACK|XXX|NOTE)($[^)]+$)?:\s*(.*)")
Go: regexp.MustCompile(`(TODO|FIXME|HACK|XXX|NOTE)($[^)]+$)?:\s*(.*)`).MatchString(value)
Ruby: /(TODO|FIXME|HACK|XXX|NOTE)($[^)]+$)?:\s*(.*)/.match?(value)
PHP: preg_match('~(TODO|FIXME|HACK|XXX|NOTE)($[^)]+$)?:\s*(.*)~', $value)

The explainer’s Code tab regenerates these for any pattern you paste, and the downloadable cheat sheet bundles the breakdown, all seven snippets, and the pitfalls below onto one printable page.

Common pitfalls

Not anchored. Without ^ and $ this can match a substring anywhere in the input — add anchors if you need the whole value to conform.
Greedy “.*”. A greedy .* / .+ can match more than intended. Use a lazy version (.*?) or a negated class ([^…]) to stop at the right place.
Escape it correctly per language. In Java and JavaScript strings each backslash must be doubled (\\d); in Python, Go, and C# use raw/verbatim strings so the backslashes survive.
Validate beyond format. Matching the format doesn't guarantee the value is real. Confirm the todo / fixme marker against a source of truth (database, API, or checksum) where it matters.

Related patterns

More patterns in the Developer category: