Regex tester, debugger & match explainer
Test and debug regular expressions with real-time match highlighting, capture group inspection, and string replacement. Evaluated safely in your browser with built-in catastrophic backtracking protection.
How to test regular expressions
- Enter your regular expression pattern in the top pattern bar (between the forward slashes
/.../). - Toggle active regex flags (g, i, m, s, u) by clicking the flag buttons.
- Type or paste your test text into the left pane, or click Sample to load a sample text containing emails and URLs.
- Inspect matched tokens highlighted in real time in the right-hand panel, alongside the active match counter in the toolbar.
- Use the Substitution / Replace bar at the bottom to preview string replacements using capture tokens (e.g.
$1,$&, or custom replacement text).
How the JavaScript Regular Expression Engine Works
Modern JavaScript engines (such as V8 in Chrome and Edge, SpiderMonkey in Firefox, and JavaScriptCore in Safari) evaluate regular expressions using a Backtracking Nondeterministic Finite Automaton (NFA). Unlike purely linear Deterministic Finite Automata (DFA) engines, NFA engines support advanced language features such as lookaround assertions, backreferences, and named capture groups.
In an NFA engine, the regex matcher moves through the test string character by character. When it encounters multiple possible branch paths (such as alternations a|b or greedy quantifiers a*), it commits to one path. If that path eventually fails to match, the engine backtracks to the last decision point and attempts the alternative route.
Understanding Catastrophic Backtracking and ReDoS
While backtracking allows flexible pattern matching, poorly constructed patterns with nested quantifiers can trigger Catastrophic Backtracking, leading to a Regular Expression Denial of Service (ReDoS) attack.
Consider the classic pathological pattern:
/^(a+)+$/
When evaluated against a matching string like "aaaa", it finishes in negligible milliseconds. However, when evaluated against a non-matching string ending in a mismatch (e.g. "aaaaaaaaaaaaaaaaaaaaaaaaaaaa!"), the engine must test every possible mathematical permutation of the outer and inner plus quantifiers before concluding the string does not match. For a string of length \(n\), the number of combinatorial steps explodes exponentially at \(O(2^n)\):
- At 20 characters: ~1,000,000 backtracking steps.
- At 30 characters: ~1,000,000,000 backtracking steps.
- At 40 characters: 1 trillion steps — completely freezing a Node.js event loop or browser tab.
How DevSandbox Protects You: Our client-side evaluator includes an iteration limiter and execution safety boundary. If an entered pattern exceeds safety thresholds, evaluation halts immediately, protecting your browser tab from locking up.
Syntax and Character Class Reference
| Character | Category | Meaning |
|---|---|---|
\d / \D | Digit class | Matches any Arabic digit [0-9] / any non-digit character. |
\w / \W | Word character | Matches any alphanumeric character or underscore [A-Za-z0-9_] / non-word. |
\s / \S | Whitespace | Matches spaces, tabs, carriage returns, and newlines / non-whitespace. |
^ / $ | String anchors | Asserts match at the beginning / end of the input string (or each line if m is active). |
\b / \B | Word boundary | Asserts match at a word boundary between a word character and non-word character. |
[abc] | Character set | Matches any single character listed inside the brackets. Use [^abc] for negation. |
+ / * / ? | Quantifiers | Matches 1 or more / 0 or more / 0 or 1 (optional) occurrences. |
{min,max} | Range quantifier | Matches at least min and at most max occurrences (e.g. {2,4}). |
Advanced Assertions: Lookahead & Lookbehind
Zero-width assertions match a position without consuming characters in the match result:
- Positive Lookahead
(?=...): Asserts that what follows matches the pattern. E.g.\d+(?=px)matches numbers only if followed immediately bypx(without includingpxin the match). - Negative Lookahead
(?!...): Asserts that what follows does NOT match. E.g.\d+(?!px)matches numbers not followed bypx. - Positive Lookbehind
(?<=...): Asserts that what precedes matches. E.g.(?<=\$)\d+matches digits preceded by$. - Negative Lookbehind
(?<!...): Asserts that what precedes does NOT match. E.g.(?<!https:\/\/)\w+\.commatches domains not using HTTPS.
Capturing Groups and Substitution Tokens
Parentheses (...) group subexpressions and capture their values into numbered memory slots:
$1,$2, ...: Refers to the first, second, etc., captured group.$&: Refers to the complete matched substring.(?:...): Non-capturing group — groups tokens for quantification (e.g.(?:abc)+) without memory allocation overhead.(?<name>...): Named capturing group — stores the matched group in a dedicated named dictionary. In replacement strings, reference it via$<name>.
Active Regex Flags Explained
- g (Global): Finds all matches throughout the text rather than halting after the first occurrence.
- i (Ignore Case): Case-insensitive matching (
Amatchesa). - m (Multiline): Modifies
^and$anchors to match the start and end of every line, rather than the start and end of the entire string. - s (DotAll): Allows the wildcard dot
.to match newline characters (\n). - u (Unicode): Enables full Unicode code point handling and surrogates (essential for multi-byte emojis).
100% Client-Side Privacy Guarantee
Proprietary logs, source code, and customer data should never be pasted into online regex tools that transmit data over HTTP. DevSandbox compiles and tests regular expressions strictly inside your browser's local sandbox using the native ECMAScript RegExp engine. Zero data is uploaded to remote servers.
Frequently asked questions
Is regular expression evaluation protected against ReDoS?
Yes. DevSandbox includes an execution iteration limiter and regex safety checks to prevent catastrophic backtracking from freezing your browser tab.
Does the regex tester support named capture groups?
Yes. It supports named capture groups (?<name>...), standard capturing parentheses, non-capturing groups, and all modern regex flags (g, i, m, s, u).
What is the difference between capturing and non-capturing groups?
Capturing groups (abc) save matched substrings into numbered memory variables ($1, $2). Non-capturing groups (?:abc) group expressions without saving them to memory, reducing execution overhead.
How do zero-width lookahead and lookbehind assertions work?
Lookaheads (?=...) and lookbehinds (?<=...) assert that a pattern must precede or follow the current position without consuming or including those characters in the matched string.