Regex Tester & Debugger at a glance
- What it does
- Test JavaScript regular expressions against sample text with live match highlighting and capture groups.
- Where it runs
- Entirely in your browser — no data is uploaded
- Works offline
- Yes, once the page has loaded
- Cost
- Free, with no account and no usage limit
- Category
- Developer & Code
How to use the regex tester
- Enter your pattern without the surrounding slashes.
- Set the flags you need -
gfor every match rather than the first,ifor case-insensitive,mto make^and$match at line boundaries. - Paste sample text that includes both cases you want matched and cases you want rejected.
- Read the highlights and the match list below, which shows each match, its index and any capture groups.
The syntax you will use most
| Pattern | Matches |
|---|---|
. | Any character except a newline. |
\d \w \s | A digit, a word character ([A-Za-z0-9_]), whitespace. Capitalise to negate. |
[abc] [^abc] | Any one of a, b, c - or anything except those. |
* + ? | Zero or more, one or more, zero or one. |
{2,5} | Between two and five repetitions. |
^ $ | Start and end of the string, or of each line with the m flag. |
\b | A word boundary. \bcat\b matches "cat" but not "category". |
(abc) | A capture group - the matched text is available as group 1. |
(?:abc) | A group that does not capture. Slightly faster and keeps group numbers tidy. |
(?<name>abc) | A named group, readable in code as match.groups.name. |
a|b | Either alternative. |
(?=abc) (?!abc) | Lookahead: assert what follows without consuming it. |
Greedy versus lazy - the classic bug
Quantifiers are greedy by default: they take as much as possible and give characters back only when the rest of the pattern fails. Given <b>bold</b> and <i>italic</i>, the pattern <.+> matches the entire string, not the first tag.
Adding ? after the quantifier makes it lazy - it takes as little as possible. <.+?> matches <b> alone. When a pattern swallows far more than you expected, greediness is nearly always the reason.
Patterns worth keeping
# Trim whitespace at both ends
^\s+|\s+$
# A hex colour, three or six digits
#([0-9a-fA-F]{3}){1,2}\b
# An ISO date
\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])
# Duplicate consecutive words
\b(\w+)\s+\1\b
# A quoted string, handling escapes
"(?:[^"\\]|\\.)*"Email is the pattern everyone reaches for and almost nobody needs. The full RFC 5322 grammar is enormous, and any short approximation rejects valid addresses. For a signup form, check for a single @ with something either side, then send a confirmation email - that is the only real validation.
Catastrophic backtracking
Nested quantifiers over overlapping character classes - (a+)+$ is the textbook case - can make the engine explore an exponential number of paths. On a 30-character non-matching input, that is effectively an infinite loop, and if the pattern runs on user input it becomes a denial-of-service vector known as ReDoS.
The defences are to avoid nesting quantifiers, prefer specific character classes over ., anchor patterns where you can, and put a length cap on any input you run a regex against.
Frequently asked questions
JavaScript (ECMAScript). It is close to PCRE but not identical: JavaScript has no atomic groups or possessive quantifiers, and lookbehind requires a reasonably modern browser. Patterns copied from Perl, Python or PHP mostly work, with occasional adjustments.
A regex object with the g flag carries a lastIndex that advances on each call to test() or exec(). Reusing the same object across calls silently starts each search where the last one stopped. Create the regex fresh, or reset lastIndex to 0.
No. HTML nesting is not a regular language, so any pattern will break on comments, attributes containing angle brackets, or unusual nesting. Use DOMParser in the browser or a real parser on the server.
No. The pattern is compiled and executed by your browser's own JavaScript engine on your machine. Nothing is transmitted.
Nothing you enter here leaves your browser
Regex Tester & Debugger does its work in JavaScript running on your own device. The page loads once, and after that there is no upload step and no server involved — which matters here because API responses, tokens and configuration files are exactly the kind of thing that should not be posted to someone else’s server for formatting.
You can verify this rather than taking our word for it: load the page, disconnect from the internet, and the tool keeps working. Our privacy policy sets out what is and is not collected, and this guide explains why the distinction matters.