Regex Tester

Type a pattern, pick your flags, and paste a test string. Every match is highlighted inline so you can see exactly what the engine grabbed, and each match is listed below with its start index, length, and a breakdown of every capture group. Named groups — the (?<name>...) syntax — are labeled by name. The whole thing recomputes as you type, so you can dial a pattern in by feel.

The global flag changes everything. Without g, the engine returns the first match and stops. With it, you get every non-overlapping match in the string. This tester handles the subtle trap that bites people writing their own match loops: a zero-width match (a pattern that can match the empty string) will loop forever unless you manually advance past it. We advance lastIndex for you, so empty matches do not hang the page.

A word on engine differences. This runs the browser's native JavaScript regex engine, so it mirrors what your front-end and Node.js code will do. But regex flavors are not interchangeable: a pattern that works in Python's re or PCRE may behave differently or be invalid here, and vice versa. Always test in the engine you will ship to. If your validation logic lives in several languages, that inconsistency is a real source of bugs we untangle during custom software builds.

Regex is a security surface, not just a utility. A carelessly written pattern with nested quantifiers — the classic (a+)+ shape — can be driven into exponential backtracking by a malicious input, freezing the thread that runs it. This is ReDoS, and it is a genuine denial-of-service vector when the regex touches user input on your server. Validating untrusted data with hand-rolled patterns is one of the things we scrutinize during a web application penetration test and our broader penetration testing engagements.

Put your expression in the pattern box — no surrounding slashes needed, they are shown for clarity. Toggle flags with the buttons; the active set appears after the closing slash. Paste or type your test string and the matches highlight immediately, with a per-match breakdown of groups underneath. If your pattern is syntactically invalid, you will get the engine's error message instead of silent failure. Nothing leaves your browser, so a refresh resets the tool.