Regex Tester
Test JavaScript regex with numbered and named groups, inline highlighting and a replace preview, run with a two-second timeout.
Regex Tester workspace
g finds every match; i ignores case; m makes ^ and $ match each line.
Matching runs in a background worker and is stopped after 2 seconds, so a catastrophically backtracking pattern cannot freeze this tab.
Source Editor
Press Ctrl/Cmd + Enter to run.
Your draft is kept in this tab only (sessionStorage) and disappears when the tab closes. .
Result Console
Using Regex Tester
Enter your pattern, or load one of the Email, URL Address, IP Address and Phone Number presets.
Set the flags: g to find every match, i to ignore case, m to anchor per line.
Paste the text you want to search into the editor below.
Optionally fill in the substitution string to preview a replace, then press Test Pattern.
Every match comes back with its position in the subject string, its numbered capture groups and any named ones, and is highlighted in place so overlaps and empty matches are visible. The match itself runs inside a Web Worker under a hard timeout, which keeps a runaway pattern from taking the tab down with it.
Enter a pattern, enter flags, paste the text you want to run it against. Matching uses the JavaScript RegExp engine, so what you see here is what String.prototype.match and replace will do in a browser or in Node — not PCRE, not Python's re, and not the POSIX classes some cheatsheets assume.
Catastrophic backtracking is a real denial of service
The pattern (a+)+b looks innocent. Run it against 28 letter As with no b at the end and a naive engine will try roughly 2^28 ways to divide those characters between the inner and outer quantifier before it concludes there is no match. On this page, in an earlier build, that froze the browser tab for eighteen seconds — on a page whose own text warned about the problem.
Matching now happens inside a Web Worker with a two-second ceiling. If the worker has not answered by then it is terminated and you get a message naming nested quantifiers as the likely cause, while the tab stays responsive throughout. That is not a cosmetic improvement. The same class of pattern reaching a server-side validator is CVE material: Cloudflare's July 2019 global outage was one regular expression with this shape, deployed to every edge machine at once.
The shapes to watch for are a quantifier wrapped around a quantified group — (a+)+, (a*)*, (\s+)+$ — and alternations whose branches can match the same text, like (a|a)*. If the timeout fires, that is the thing to go looking for, and possessive matching or an atomic rewrite is usually the fix.
What comes back
For every hit the results panel gives you the matched text, its zero-based index in the subject string, and every capture group. Numbered groups appear as $1, $2 and so on; named groups from (?<year>\d{4}) appear under their names alongside them. The previous implementation computed all of that and then discarded it before rendering, which is why the panel used to show a bare list of matched substrings.
Matches are also highlighted in place in the test string, so overlapping expectations and accidental empty matches become obvious rather than requiring you to count characters.
Flags, briefly
g keeps scanning after the first hit instead of stopping. i makes the match case-insensitive. m changes ^ and $ to mean start and end of each line rather than of the whole subject. Without g you get at most one result here, which is worth remembering when a pattern that clearly appears three times reports one match.
Substitution preview
Fill in the substitution field and the panel shows the result of applying replace with your pattern. Backreferences work as they do in JavaScript: $1 inserts the first capture group and $& inserts the whole match, while a doubled dollar sign escapes to a single literal one. This is the quickest way to check a redaction rule before you point it at a log file — write the pattern, set the replacement to [REDACTED], and read the rewritten text.
Presets, cheatsheet and limits
Four preset buttons load a starting pattern for email addresses, URLs, IPv4 addresses and E.164 phone numbers. Treat them as starting points; a fully correct email pattern per RFC 5322 is several hundred characters long and almost never what you actually want. The cheatsheet toggles open with the anchors, character classes and quantifiers you look up most often.
A run collects at most 5000 matches and lists the first 50, with a note when the cap was hit. If you are matching more than that, you are past what a text box is good for and into scripting territory.
For scrubbing whitespace, blank lines and duplicate lines out of a file, Text Cleaner does the common jobs without a pattern at all.
Your pattern and your test text stay on your machine. There is no request in this code path, the worker is built from a blob URL in the page itself, and the draft is dropped when the tab closes.
Frequently asked
Why does matching run in a background worker?
So a catastrophically backtracking pattern cannot freeze the page. A pattern such as (a+)+b against a long run of the letter a explores an exponential number of possibilities before failing; in an earlier build that locked this tab for eighteen seconds. Matching is now stopped after two seconds with an explanation of the likely cause.
Which regex flavour does this follow?
The JavaScript RegExp engine, so results match what String.match and String.replace do in a browser or in Node. Constructs borrowed from PCRE or Python, such as possessive quantifiers or POSIX bracket classes, are not available.
Are named capture groups supported?
Yes. A group written as (?<year>\d{4}) is listed under its name next to the numbered groups, along with each match's zero-based index in the subject string. An earlier version computed all of that and discarded it before rendering.
Is there a limit on how many matches it reports?
A run collects at most 5000 matches and lists the first 50, with a note when the cap is reached. Past that point the job belongs in a script rather than a text box.