What's the difference between greedy and lazy matching?

Greedy quantifiers (*, +, ?) match as much text as possible while still allowing the overall pattern to succeed. Lazy quantifiers (*?, +?, ??) match as little as possible. For example, given " bold ", the pattern greedily matches the whole string, while matches just " ". Use lazy matching when you want the shortest possible match.

How do I match an email address with regex?

A practical pattern for most email addresses is [a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}. Click "Common patterns → Email address" to insert it. Note that the full RFC 5321 email spec is extremely complex; this pattern handles the vast majority of real-world addresses.

What is catastrophic backtracking?

Catastrophic backtracking (ReDoS) happens when a regex engine tries an exponential number of paths through the pattern before determining it cannot match. It is usually triggered by patterns with nested quantifiers on overlapping character classes, like (a+)+. This tool runs regex in a worker and terminates it after 1 second to prevent the page from hanging.

What do the flags do?

g (global) - find all matches, not just the first. i - case insensitive. m (multiline) - ^ and $ match the start/end of each line. s (dotAll) - the dot (.) also matches newline characters. u (unicode) - enables full Unicode support. d (indices) - include start/end positions for each capture group in the result.

How does the Replace mode work?

Replace mode runs String.replace(regex, replacement) on your test text. In the replacement string, $1, $2, etc. refer to numbered capture groups, $ to named groups, and $& to the full match. For example, with pattern (\w+)\s+(\w+) and replacement $2 $1, the words swap order.

Can I share my regex with someone?

Yes - click "Copy share link" to get a URL that encodes the current pattern, flags, and test text as query parameters. Anyone who opens that URL will see your exact configuration.

Regex Tester - Toolcroft

How regular expressions work

A regular expression (regex) is a pattern that a regex engine matches against a string. The engine scans through the input character by character, testing whether the pattern can be satisfied starting at each position. When it finds a match, it records the position and the text matched, then continues scanning (if the g flag is set).

Patterns are made up of literals (characters that match themselves), metacharacters (special characters like ., ^, $, *, +, ?), character classes ([a-z], \d, \w), and groups ((…)). Quantifiers (*, +, {n,m}) control how many times a preceding element may repeat.

Common regex patterns

These are frequently used patterns. Click the "Common patterns" dropdown in the tool to insert any of them instantly.

Pattern	Matches
`[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}`	Email addresses
`https?:\/\/[^\s/$.?#][^\s]*`	HTTP/HTTPS URLs
`#(?:[0-9a-fA-F]{3}){1,2}`	CSS hex colors (#rgb or #rrggbb)
`\d{4}-(?:0[1-9]\|1[0-2])-(?:0[1-9]\|[12]\d\|3[01])`	ISO 8601 dates (YYYY-MM-DD)
`\b(\w+)\s+\1\b`	Duplicate consecutive words

 Avoiding catastrophic backtracking
 
Catastrophic backtracking (also called ReDoS) is a vulnerability where a regex engine
      exponentially increases the number of paths it tries when a match fails. The classic example
      is patterns with nested quantifiers on overlapping character classes:
   (a+)+b applied to a long string of a characters: the engine tries every
        possible grouping before giving up.
  (a|aa)+: similar issue.
 
 Rules to avoid ReDoS:
  Avoid nested quantifiers with overlapping character classes.
 Use possessive quantifiers or atomic groups when your regex flavor supports them.
 
Be specific: use [0-9] instead of . when you know the domain.
 Test against long failure strings, not just success cases.
 
 
This tool runs every regex in a Web Worker with a 1-second timeout. If the pattern hangs, the
      worker is terminated and you get a "timed out" warning instead of a frozen browser tab.
 Flags explained
  g (global): find all matches in the string, not just the first.
 i (ignore case): treat uppercase and lowercase as equivalent.
  m (multiline): ^ and $ match the start and end of each
        line (as separated by \n), not just the whole string.
  s (dotAll): the . metacharacter also matches newline characters (\n, \r).
 u (unicode): treat the pattern and string as Unicode code points.
  d (indices): include start and end indices for each capture group in the result object.
 
 Capture groups tutorial
 
Parentheses in a regex create capturing groups that record the text matched by
      the sub-pattern:
   Numbered groups: (\d+) creates group 1. Access via match[1] or $1 in replace.
  Non-capturing groups: (?:...) groups without recording — useful
        for alternation: (?:cat|dog)s matches “cats” or “dogs” without
        capturing.
  Named groups: (?<name>...) (ES2018) — access via match.groups.name.
  Backreferences: \1 matches the same text as group 1. Classic use:
        detecting doubled words: \b(\w+)\s+\1\b matches “the the”.
 
 Replace mode
 In replace mode, the replacement string supports special tokens:
  $1, $2… insert the text of numbered capture groups.
 $<name> inserts a named capture group (ES2018).
 $& inserts the entire matched substring.
  $` inserts the text before the match; $' inserts the text after.
 
 
Example: reformat a date from 2025-07-04 to July 4, 2025 using pattern
(\d{4})-(\d{2})-(\d{2}) and replacement $2/$3/$1.