Regex Tester
Test JavaScript regex with numbered and named groups, inline highlighting and a replace preview, run with a two-second timeout.
Regex Tester workspace
g finds every match; i ignores case; m makes ^ and $ match each line.
Matching runs in a background worker and is stopped after 2 seconds, so a catastrophically backtracking pattern cannot freeze this tab.
Source Editor
Press Ctrl/Cmd + Enter to run.
Your draft is kept in this tab only (sessionStorage) and disappears when the tab closes. .
Result Console
Using Regex Tester
Enter your pattern, or load one of the Email, URL Address, IP Address and Phone Number presets.
Set the flags: g to find every match, i to ignore case, m to anchor per line.
Paste the text you want to search into the editor below.
Optionally fill in the substitution string to preview a replace, then press Test Pattern.
Every match comes back with its position in the subject string, its numbered capture groups and any named ones, and is highlighted in place so overlaps and empty matches are visible. The match itself runs inside a Web Worker under a hard timeout, which keeps a runaway pattern from taking the tab down with it.
Enter a pattern, enter flags, and paste the text you want to run it against. Matching uses the JavaScript RegExp engine, so what you see here is what String.prototype.match and replace will do in a browser or in Node. It isn't PCRE or Python's re, and the POSIX classes some cheatsheets assume won't work.
Catastrophic backtracking is a real denial of service
The pattern (a+)+b looks innocent. Run it against 28 letter As with no b at the end, and a naive engine will try roughly 2^28 ways of dividing those characters between the inner and outer quantifier before it concludes there's no match. In an earlier build of this page, that froze the browser tab for eighteen seconds, on a page whose own text warned about the problem.
Matching now runs inside a Web Worker with a two-second ceiling. If the worker hasn't answered by then, it's terminated and you get a message naming nested quantifiers as the likely cause. The tab stays responsive the whole time. This matters well beyond one page: the same class of pattern reaching a server-side validator is CVE material. Cloudflare's July 2019 global outage was one regular expression with this shape, deployed to every edge machine at once.
Watch for a quantifier wrapped around a quantified group, such as (a+)+, (a*)* or (\s+)+$, and for alternations whose branches can match the same text, like (a|a)*. If the timeout fires, that's what to go looking for, and possessive matching or an atomic rewrite usually fixes it.
What comes back
For every hit, the results panel gives you the matched text, its zero-based index in the subject string, and every capture group. Numbered groups appear as $1, $2 and so on; named groups from (?<year>\d{4}) appear under their names alongside them. The previous implementation computed all of that and then threw it away before rendering, which is why the panel used to show a bare list of matched substrings.
Matches are also highlighted in place in the test string, so you can spot overlapping expectations and accidental empty matches without counting characters.
Flags, briefly
g keeps scanning after the first hit instead of stopping. i makes the match case-insensitive. m makes ^ and $ mean the start and end of each line instead of the whole subject. Without g you'll get at most one result here, so if a pattern that clearly appears three times reports one match, check that flag first.
Substitution preview
Fill in the substitution field and the panel shows the result of applying replace with your pattern. Backreferences work as they do in JavaScript: $1 inserts the first capture group, $& inserts the whole match, and a doubled dollar sign escapes to a single literal one. It's the quickest way to check a redaction rule before you point it at a log file. Write the pattern, set the replacement to [REDACTED], and read the rewritten text.
Presets, cheatsheet and limits
Four preset buttons load a starting pattern for email addresses, URLs, IPv4 addresses and E.164 phone numbers. Use them as starting points. A fully correct email pattern per RFC 5322 is several hundred characters long and almost never what you actually want. The cheatsheet toggles open with the anchors, character classes and quantifiers you look up most often.
A run collects at most 5000 matches and lists the first 50, with a note when the cap was hit. If you're matching more than that, you've outgrown a text box and it's time to write a script.
For scrubbing whitespace, blank lines and duplicate lines out of a file, Text Cleaner does the common jobs without needing a pattern at all.
Your pattern and your test text stay on your machine. There's no request in this code path, the worker is built from a blob URL in the page itself, and the draft is dropped when the tab closes.
Frequently asked
Why does matching run in a background worker?
So a catastrophically backtracking pattern cannot freeze the page. A pattern such as (a+)+b against a long run of the letter a explores an exponential number of possibilities before failing; in an earlier build that locked this tab for eighteen seconds. Matching is now stopped after two seconds with an explanation of the likely cause.
Which regex flavour does this follow?
The JavaScript RegExp engine, so results match what String.match and String.replace do in a browser or in Node. Constructs borrowed from PCRE or Python, such as possessive quantifiers or POSIX bracket classes, are not available.
Are named capture groups supported?
Yes. A group written as (?<year>\d{4}) is listed under its name next to the numbered groups, along with each match's zero-based index in the subject string. An earlier version computed all of that and discarded it before rendering.
Is there a limit on how many matches it reports?
A run collects at most 5000 matches and lists the first 50, with a note when the cap is reached. Past that point the job belongs in a script rather than a text box.