Regex tester: test regular expressions live

Write the pattern without the surrounding slashes, or paste a whole literal like /\d+/g and the flags are split out for you. The test string is searched with your browser's own JavaScript engine, so what you see is what new RegExp(pattern, flags) does in your code. Click a match in the list to select it in the text.

The result panel has six views:

• Matches: each match with its start and end index and every group, numbered and named. Download them as JSON.
• Replace: the text after text.replace(regex, replacement), live.
• List: one line per match built from a template, for pulling values out of logs or CSV.
• Split: the parts from text.split(regex). Capture groups are included in the result, as JavaScript does.
• Tests: lines that should match and lines that should not, each checked on its own with pass or fail.
• Code: the same pattern, flags and replacement as JavaScript, Python, Go or PHP.

The Common patterns menu loads tested patterns for emails, URLs, IP addresses, dates, UUIDs, semver and more, with examples that should and should not match. The full list, with every token explained, is on the regex cheat sheet.

Flags go after the closing slash (/x/gi) or in the second argument of new RegExp("x", "gi"). Click a flag above to toggle it. The u and v flags cannot be used together.

In String.prototype.replace and replaceAll, the replacement string can refer to parts of the match. The Replace tab applies the same rules, which come from the GetSubstitution step of the ECMAScript spec:

A $ that is not followed by one of these is kept as is, and $3 stays literal when the pattern has fewer than 3 groups. For anything more complex, pass a function: text.replace(re, (match, g1, g2) => ...).

JavaScript's regex engine is a backtracking engine. When a match fails, it goes back and tries every other way the pattern could have matched. For most patterns that is fast. For a pattern like ^(a+)+$ on a line of a's that ends in a b, the number of ways to split the a's between the inner and outer + doubles with every extra character, and the page freezes. On a server, the same pattern can be used to tie up a process with crafted input; OWASP calls this ReDoS.

Here the pattern runs in a web worker. If it takes more than 2 seconds, the worker is stopped and you get a message instead of a frozen tab. The explanation also flags nested quantifiers before you run anything. To fix such a pattern, make each part match in only one way:

// Slow: a group of repeated items, repeated again
/^(\w+\s?)*$/

// Fast: the same text, but the words and spaces cannot overlap
/^\w+(?:\s\w+)*$/

The Code tab writes this for you. These are the main differences to watch when you move a pattern between languages:

Go uses the RE2 engine, which guarantees linear time but has no lookarounds or backreferences. PHP's preg_ functions use PCRE and need delimiters around the pattern, like '/\d+/i'. A JavaScript example with all matches and named groups:

const re = /(?<user>[\w.+-]+)@(?<domain>[\w-]+(?:\.[\w-]+)+)/g;
for (const m of text.matchAll(re)) {
  console.log(m.index, m.groups.user, m.groups.domain);
}

• Double escaping in strings. In new RegExp("\\d+") the backslash must be doubled, because the string literal eats one. The literal /\d+/ needs only one.
• An unescaped dot. example.com also matches exampleXcom. Write example\.com.
• [A-z] instead of [A-Za-z]. The range also covers [ \ ] ^ _ and the backtick, which sit between Z and a in ASCII.
• Forgetting anchors when validating. /\d{5}/.test("abc123456") is true. Use ^\d{5}$ to check the whole value.
• \w and \b are ASCII only. \w does not match é or ü, even with the u flag. Use \p{L} with the u or v flag for letters in any language.

Building a pattern from user input? Escape it first, or every . and ( in the input becomes regex syntax. The string escape tool has a regex mode. For JSON data, a JSONPath query is often simpler than a regex, and to compare two outputs use the diff checker. More developer tools for testing are in the testing tools directory.