Regex Tester

What is a regex tester?#

A regular expression is a compact notation for describing patterns in text: “everything that looks like an email”, “the third word of each line”, “all numbers that are not inside quotes”. Writing the pattern is only half the job — the other half is seeing what it actually matches, on text that resembles yours, before you paste it into production code. A regex tester is the page where you do that.

This tool runs your pattern against your sample text in real time, highlights every match in place, and lists each capture group separately so you can confirm not just that it matched, but what it captured. It uses the JavaScript regex engine (the same one your browser and Node already speak), so behaviour here matches what your code will do.

How to use it#

1. Enter the Pattern between the two / markers in the top-left. You do not type the slashes yourself — they are drawn for you, the way a literal regex is written in code.
2. Enter Flags in the small box on the right of the pattern. The ones you will reach for most:
   • g — find all matches, not just the first.
   • i — case-insensitive.
   • m — ^ and $ match the start and end of each line, not just the whole string.
   • s — let . match newlines as well.
   • u — treat the pattern as Unicode (matters for emoji and non-ASCII).
3. Paste your Test text in the box below. Use text that actually resembles your real input — a pattern that works on tidy examples often misbehaves on messier data.
4. Read the highlighted preview on the right: every match is shown in place, in context. Below it, each capture group is listed with its index, its captured text, and the offset where it was found.

Key features#

• Live highlighting. Every match is rendered in place against the original text, so you can see boundaries at a glance — including the awkward case where a match runs across whitespace.
• Per-group capture list. Group index, matched substring, and character offset, one row per capture. Essential when a pattern has three or four groups and you need to know which is which.
• Multiple flags at once. Combine g, i, m, s, u freely (for example giu for global, case-insensitive, Unicode-aware).
• ReDoS heads-up. Some patterns — typically nested quantifiers like (a+)+ — can blow up exponentially on crafted input. The status line flags the pattern itself the moment it matches, prompting you to simplify before it ever meets hostile input. The check reads the shape of your pattern; it does not measure how long the last run took, and a truly catastrophic pattern can still lock the tab — so heed the warning.
• Bounded by design. Input is capped at 250 000 characters and the match list stops growing past a few thousand entries (the capture panel shows the first 200), so an accidental paste of a huge file cannot quietly run forever.
• No round-trip. Pattern and text are processed in your browser; nothing is sent anywhere.

Worked example#

Suppose you have a list of log lines and you want to pull the method and the path out of lines that start with an HTTP verb. Use this pattern:

(\w+)\s+(/[\w/-]+)

with flags gm, and test it against:

GET /api/users
POST /api/login
DELETE /api/users/42
not a log line
PUT /api/items/3-qty

The tool highlights the first, second, third and fifth lines (the fourth does not start with a word followed by a path). The capture list reports, for each match, the method and the path separately — so DELETE is group 1 and /api/users/42 is group 2, and you can confirm the path group correctly includes the trailing -qty segment on the last line.

FAQ#

Which regex flavour does this use?#

JavaScript’s built-in engine — the same one used by String.prototype.match, RegExp.prototype.exec, and Node’s regex literals. A pattern that works here will work unchanged in your front-end code or your Node server. It is not PCRE, RE2 or Rust’s regex; if you copy a pattern from a PHP or Go codebase, test it here before relying on it.

The tool warns about a possible ReDoS. What does that mean?#

Certain patterns can be made to run for a very long time on hostile input — the classic example is (a+)+b matched against a string of as with no trailing b. Attackers exploit this to denial-of-service regex-based services. The warning is a static read of your pattern’s shape (nested quantifiers, overlapping alternation); it fires the moment such a pattern produces a match, not based on how long the last run took. If you see it, simplify the pattern: remove nested quantifiers, anchor it, or use atomic groups if your target engine supports them.

Why does my pattern only match once?#

You are probably missing the g flag. Without g, a JavaScript regex stops at the first match. Add g to find every non-overlapping occurrence.

Does . match newlines?#

Not by default — . matches any character except a line terminator. Add the s flag (sometimes called “dotall”) if you want . to span newlines, which is useful when matching blocks that include line breaks.