Regex Tester

A regular expression is easy to write and hard to be sure about, which is why a tester is worth more than a reference card: you find out what the pattern actually does to your text rather than what you meant it to do. This page shows every match as you type, marks it in the text, lists what each group captured — by name when the group has one — and breaks the pattern into pieces with a plain sentence for each. The pattern is yours and the text is yours; both stay in this page. The match itself runs on a worker thread with a time budget, so a pattern that would otherwise lock up the tab is stopped and reported instead.

How it is calculated

(?<name>pattern) → match.groups.name

A named capturing group gives a group a label so the piece it captured can be read back by name rather than by counting brackets from the left. The name has to be unique inside one pattern — two groups sharing a name is a syntax error, not a warning — and the captured text turns up under the groups property of the match. That is why the table below has a name column for some rows and a number for the rest.

Source: MDN, Named capturing group: "A named capturing group is a particular kind of capturing group that allows you to give a name to the group. The group's matching result can later be identified by this name instead of by its index in the pattern." Its match is read from "the groups property of the return value of RegExp.prototype.exec()"

Questions people ask

Can a pattern I paste here hang my browser?

That pattern did not finish in time on this text, so it was stopped. A backtracking engine can take a number of steps that doubles with every extra character — the classic shape is a repeat inside a repeat, such as (a+)+$ against a long run of a followed by one b. Nothing here is broken; the pattern is. Try pinning the repeat down, or shortening the text.

Why does the classic (a+)+$ take so long?

Because the engine backtracks. OWASP works the arithmetic through for that exact pattern: against sixteen a characters followed by an X there are 65,536 paths to try before it can say no, and every further a doubles the number. The text does not have to be long — twenty-five characters is enough to make a browser sit still.

Which flags can I use?

d, g, i, m, s, u, v and y — the eight the JavaScript engine accepts. This page always collects every match, so the g flag changes nothing here; the ones that change the answer are i for case, m for whether ^ and $ mean the line or the whole text, s for whether a dot crosses a line break, and y for a match that has to start exactly where the last one ended.

Is this the same regex engine my code will use?

It is the one your browser ships, which is the JavaScript engine. Patterns written for PCRE, Python or Go mostly carry over, but not entirely: possessive quantifiers and atomic groups do not exist here, and lookbehind is supported in JavaScript but was not always. Check anything exotic against the language you are actually writing in.

What does an empty match mean?

A pattern that can match nothing — x* for instance — matches at every position, including the one past the last character. The list will show a zero-length match at each of them. That is correct behaviour rather than a bug, and it is usually a sign the pattern needs a + rather than a *.

Does my text leave the page?

No. The pattern and the text are compiled and run in your browser, on a worker thread belonging to this page. Nothing is posted anywhere, which is the point when the text you are testing against is a log or a customer list.

Sources

The documents this page reads its numbers out of, linked so you can check them yourself.

1. MDN, Named capturing group: "A named capturing group is a particular kind of capturing group that allows you to give a name to the group. The group's matching result can later be identified by this name instead of by its index in the pattern." Its match is read from "the groups property of the return value of RegExp.prototype.exec()"
2. MDN, Regular expressions guide, the flags table: g "Global search", i "Case-insensitive search", m "Makes ^ and $ match the start and end of each line instead of those of the entire string", s "Allows . to match newline characters", y "Perform a 'sticky' search that matches starting at the current position in the target string"
3. OWASP, Regular expression Denial of Service (ReDoS): the attack "exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size)", and the evil regex examples it lists begin with (a+)+$

Related tools