Regex Tester.

Write a pattern, see what it matches, and read it in plain English. Runaway patterns are stopped, not left to freeze your tab.

Runs in your browser. Nothing you type is uploaded. Uses JavaScript regular expressions.

Test a pattern Backtracking and ReDoS

Tester

Match, replace, explain.

Start from a security preset or write your own. Results update as you type.

Pattern

Test text

Matches in your text

Match details

Replace with

In plain English

Backtracking and ReDoS

When a pattern turns on you.

Greedy and lazy

Take as much, or as little.

.* grabs everything it can, then gives some back. .*? takes the least it can. Most surprise matches come from this one choice.

Anchors

Say where it must match.

^ and $ pin a match to the start and end. \b marks a word edge. Without them, a pattern for a 4 digit number will happily match inside a 12 digit one.

ReDoS

Some patterns never finish.

Nested repeats such as (a+)+ can take longer with every extra character. An attacker who can send such input can freeze a server. This tool stops any pattern after two seconds.

Forgetting to escape the dot.An unescaped . matches any character, so 10.0.0.1 also matches 10x0y0z1. Write \. for a real dot.

Validating emails with one big pattern.A perfect email regex does not exist. Use a simple check, then send a message to the address and see if it arrives.

Using regex to block attacks.Filters built from patterns are easy to get around with encoding and odd spacing. Treat them as a speed bump, never as the only defence.

Free live toolIOC extractor and defanger Free live toolBase64, URL and hex Free live toolTimestamp converter

More free tools.

Lessons, tools and datasheets. No sign-up.

Back to Free See the courses