Regex Tester Online — Regular Expression Debugger & Builder

Popular Developer Tools tools

• JWT DecoderDecode, inspect, and validate JWT tokens with claim and signature analysis.
• Cron ParserParse, validate, explain, and build cron expressions with next run times and visual timeline.
• JSON to TypeScript & Schema GeneratorGenerate TypeScript interfaces, Zod schemas, and Valibot schemas from JSON.
• AI Token CounterCount tokens and estimate API costs for 100+ LLMs with exact BPE and provider tokenization.
• AI Prompt BuilderBuild structured LLM prompts with per-section token counting, variable injection, and provider-aware exports for OpenAI, Anthropic, and Google.

How to Regex Tester Online

1. 1

   Enter your regular expression in the pattern field at the top of the left panel. The regex is validated in real-time — errors are shown immediately with clear messages.

2. 2

   Toggle regex flags using the flag buttons below the pattern: g (global), i (case-insensitive), m (multiline), s (dotall), u (unicode), v (unicode sets), d (indices), y (sticky).

3. 3

   Paste or type your test string in the text area below the flags. Matches are highlighted instantly with alternating colors.

4. 4

   View match results in the right panel: each match shows the full text, index, length, numbered capture groups, and named capture groups.

5. 5

   Switch between modes using the bottom bar: Test (match highlighting), Replace (substitution preview), Split (string splitting), Explain (regex breakdown tree), or Generate (code snippets in 9 languages).

6. 6

   Use the Cheat Sheet button for an inline regex syntax reference, or browse the Common Patterns library for 30+ battle-tested regex templates.

7. 7

   Copy results with ⌘⇧C, or share your regex and test string via a compressed URL.

Regex Tester Features

• ✓

  Real-time match highlighting: all matches highlighted with alternating colors directly in the test string as you type.

• ✓

  Full capture group support: view numbered groups ($1, $2, ...) and named groups (?<name>...) for every match.

• ✓

  8 regex flags: toggle g, i, m, s, u, v, d, y with instant visual feedback and tooltip descriptions.

• ✓

  Replace mode: test string.replace() and string.replaceAll() with substitution tokens ($1, $&, $', $`, $<name>).

• ✓

  Split mode: test string.split(regex) and view the resulting array with element count.

• ✓

  Regex explainer: visual tree breakdown of your regex structure — groups, quantifiers, anchors, lookarounds, and character classes explained in plain English.

• ✓

  Code generation: generate ready-to-use regex code in JavaScript, TypeScript, Python, Go, Java, C#, PHP, Ruby, and Rust.

• ✓

  Match statistics: total matches, unique matches, average match length, coverage percentage, shortest and longest match.

• ✓

  Inline regex cheat sheet: searchable reference for all regex syntax — character classes, quantifiers, anchors, groups, lookarounds, Unicode properties, and escapes.

• ✓

  Common patterns library: 30+ categorized, battle-tested regex templates for emails, URLs, IPs, dates, passwords, HTML tags, and more.

• ✓

  Pattern validation: real-time syntax checking with clear error messages for invalid regex.

• ✓

  Catastrophic backtracking protection: patterns that would cause excessive execution time are safely terminated.

• ✓

  Shareable URLs: gzip-compresses your pattern, flags, and test string into a URL for team sharing.

• ✓

  Works entirely in your browser — no regex patterns or test data are ever sent to any server. Your data stays completely private.

• ✓

  Keyboard shortcuts for power users: ⌘↵ to run, ⌘⇧R for replace, ⌘⇧E for explain, ⌘⇧G for generate, ⌘⇧H for cheat sheet.

Supported Formats & Dialects

The Regex Tester supports 6 syntax formats and dialects for accurate parsing and processing.

ECMAScript / Modern JavaScript (ES2024)

Supports standard JS RegExp features including Unicode Sets (v flag), match indices (d flag), named capture groups (?<name>...), lookbehind assertions (?<=...), and Unicode property escapes (\p{Letter}).

PCRE / PCRE2 (Perl Compatible Regular Expressions)

The de facto standard engine used in PHP, Apache, and Nginx. Features support for possessive quantifiers (++), atomic groups (?>...), recursion, callouts, and subroutine references.

Python re & regex Modules

Standard library re module supports standard NFA backtracking, verbose mode (re.VERBOSE / (?x)), named groups (?P<name>...), and conditional expressions (?(group)yes|no).

Go regexp & Rust regex (RE2 / DFA Linear Time)

Deterministic Finite Automaton (DFA) engines with guaranteed O(n) execution time. Completely immune to ReDoS attacks, but deliberately omit backreferences and lookaround assertions.

Java java.util.regex & .NET System.Text.RegularExpressions

Enterprise engines supporting character class intersection ([a-z&&[^aeiou]]), possessive quantifiers, variable-width lookbehinds (.NET), and balancing group definitions.

POSIX Basic & Extended Regular Expressions (BRE / ERE)

Standardized for UNIX utilities (grep, sed, awk). BRE requires escaping parentheses \( \) and braces \{ \}, while ERE treats them as metacharacters without backslashes.

Frequently Asked Questions

How do ECMAScript 2024 Unicode Sets (v flag) differ from standard Unicode (u flag)?

The v flag (ES2024) upgrades the character class parser to support set operations and multi-character string properties. Unlike the u flag, the v flag allows set intersection ([\p{Script=Greek}&&\p{Letter}]), set subtraction/difference ([\p{ASCII}--[0-9]]), and matching multi-code-point sequences like emoji flag sequences (\p{RGI_Emoji_Flag_Sequence}). Note that the u and v flags are mutually exclusive in ECMAScript.

What is catastrophic backtracking and how does this tester mitigate ReDoS vulnerabilities?

Catastrophic backtracking occurs when an NFA engine tests exponential execution branches due to nested or overlapping quantifiers (such as (a+)+$ against aaaaaaaaaaaaaa!). This causes Regular Expression Denial of Service (ReDoS) that freezes the runtime. DevFlow Regex Tester protects against CPU lockups with built-in iteration limits and 100ms execution guards that safely abort stalled evaluations.

What is the difference between greedy, lazy, and possessive quantifiers?

A greedy quantifier (*, +, {n,m}) matches as much text as possible and backtracks character-by-character if the remaining pattern fails. A lazy (non-greedy) quantifier (*?, +?, {n,m}?) matches as few characters as possible and expands if subsequent tokens fail. A possessive quantifier (*+, ++, available in PCRE/Java) matches as much as possible but never relinquishes matched characters, preventing backtracking entirely.

How do lookaround assertions (lookahead & lookbehind) evaluate without consuming characters?

Lookaround assertions are zero-width checks that inspect preceding or succeeding characters without advancing the regex match cursor. Positive lookahead (?=abc) asserts that abc follows the cursor; negative lookahead (?!abc) asserts abc does not follow. Positive lookbehind (?<=abc) asserts abc precedes the current position, and negative lookbehind (?<!abc) asserts abc does not precede it. Because they do not consume characters, subsequent pattern tokens match starting at the original cursor position.

How do named capture groups integrate with replacement tokens and backreferences?

Named capture groups use the syntax (?<groupName>pattern). Within the pattern itself, you can backreference the group using \k<groupName>. In JavaScript match results, named captures are accessible via match.groups.groupName. In replacement strings, reference them using $<groupName> (e.g. String.prototype.replace(regex, "$<groupName>_transformed")).

What is the d (hasIndices) flag and how are match indices represented?

The d flag generates start and end index offsets for all full matches and individual capture groups. In modern JavaScript engines, accessing match.indices returns an array of [startIndex, endIndex] tuples, where match.indices[0] corresponds to the whole match and match.indices[1] corresponds to the first capture group. This enables precise source-mapping, syntax highlighters, and inline code transformations.

What is the operational difference between the global (g) and sticky (y) flags?

The global (g) flag searches forward through the entire string to identify all occurrences, advancing lastIndex automatically. The sticky (y) flag attempts to match strictly at the exact index indicated by regex.lastIndex without searching forward. If a match does not succeed at that exact offset, the match fails and lastIndex resets to 0. The sticky flag is ideal for writing high-performance lexical analyzers and tokenizers.

How does string substitution work with replacement tokens ($1, $&, $`, $', $$)?

In regex replacement strings: $1, $2, etc. insert the corresponding numbered capture groups; $<name> inserts a named capture group; $& inserts the entire matched substring; $` inserts the text preceding the match; $' inserts the text following the match; and $$ inserts a literal dollar sign symbol ($).

Why do regular expressions behave differently between NFA (JS/Python) and DFA/RE2 (Go/Rust) engines?

NFA (Non-deterministic Finite Automaton) engines (JavaScript, Python, Ruby, PHP) support advanced syntax like lookarounds, backreferences, and recursion by backtracking through execution states, which creates potential ReDoS risks. In contrast, DFA (Deterministic Finite Automaton) engines like Google RE2 (used in Go and Rust) compile expressions into state machines that guarantee linear O(n) execution time without backtracking, at the cost of omitting backreferences and arbitrary lookarounds.

How can I safely validate email addresses, URLs, and network addresses using regular expressions?

For production validation, use well-tested standard patterns rather than overly strict ad-hoc regular expressions. For emails, prefer a simplified RFC 5322 expression like ^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$ combined with length limits (<254 chars). For IPv4, use bounded octet checks (\b(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b. Always validate input length boundaries prior to executing regexes to guard against memory exhaustion.

Related Developer Tools

• Regex ExplainerBreak down any regex into plain English, token by token.
• Text Diff CheckerCompare two text blocks and highlight exactly what changed.
• Text Case ConverterConvert text between 20+ case formats: camelCase, snake_case, kebab-case, Title Case, and more.
• Prompt Injection & Secret ScannerScan prompts, code, and text for prompt injection patterns, secret leaks, unsafe instructions, and PII exposure.
• JSON Path TesterQuery and extract data from JSON documents using JSONPath.
• CSS Selector TesterTest CSS selectors against HTML with real-time matching and specificity analysis.
• Stack Trace AnalyzerParse, format, and analyze error stack traces with root cause isolation.