Security & devFree
Free online regex tester. Try JavaScript regular expressions against sample text, view matches and capture groups instantly. Runs locally.
Last updated 18 October 2026
\b\w+@\w+\.\w+\b\d+The pattern and flags are handed to JavaScript's RegExp, exactly as a script on a web page would use them, and the test string is searched again on every keystroke. With the g flag the page lists every match; without it, only the first. Each match is shown with its position and any capture groups.
The default example finds 2 matches, [email protected] at position 14 and [email protected] at 36. Positions count UTF-16 code units, the way JavaScript strings do, so an emoji counts as two: \w on an emoji followed by a reports the a at position 2, not 1.
Because this is JavaScript's engine, a pattern written for PCRE, Python or .NET may behave differently or be rejected. The differences are measured further down.
The box accepts d, g, i, m, s, u, v and y. Any other character is removed without a message, so gx, with PCRE's extended-mode letter, runs as plain g. A letter typed twice is an error: gg gives "Invalid flags supplied to RegExp constructor 'gg'".
Until 18 October 2026 the box also dropped d and v. MDN describes v as an "upgrade" to the u flag that allows intersection, union and subtraction inside a character class. With v removed, a pattern such as [\p{L}--[a-z]] failed with a misleading error about a character range. It now runs: on aÄb it matches only Ä. The d flag records where each group starts and ends, which this page does not display, so it changes nothing you see.
With g, the search stops once it has more than 500 matches. Measured: the pattern a on 2,000 letter a's reports "501 matches" and lists 501, the last at position 500. Nothing says the list was cut, so if you see exactly 501, there are probably more.
abc gives 4 empty matches, at 0, 1, 2 and 3. x* on a gives 2.u, a dot sees an emoji as two halves: . on one emoji gives 2 matches, each a broken half. With u it gives 1. MDN: with the u flag, "Surrogate pairs will be interpreted as whole characters instead of two separate characters."u mode stepped into the middle of an emoji, the engine moved back to its start, and the page reported 501 matches all at position 0. It now steps past the whole character and reports 2, the same as JavaScript's own matchAll.é typed as one character found only the one-character form in a string holding both.Measured in Chromium 151:
(?<=\$)\d+ finding 40 in "cost $40"; named groups; and the inline modifier (?i:abc), which matched ABC. Inline modifiers are a recent addition to JavaScript, so an older browser may reject them.a++ ("Nothing to repeat") and atomic group (?>a) ("Invalid group").\A is read as a plain capital A, so \Aa found nothing in "aaa" and matched "Aa". With the u flag it is an error.^ and $ match only at the very start and end unless you add m, and . does not match a line break unless you add s.(?<y>\d{4})-(?<m>\d\d) on 2026-10 shows groups=["2026","10"] without the names. A group that did not take part shows as null.A badly nested pattern can take exponentially longer as the text grows, and because this page reruns the pattern on every keystroke, it freezes while you type. OWASP describes the problem: such patterns "may reach extreme situations that cause them to work very slowly (exponentially related to input size)", and lists (a+)+$ as an example. Measured with that pattern on a run of a's ending in b:
Each extra character roughly doubles the time, and there is no timeout. If you suspect a pattern, paste the test text in one go rather than typing it, and keep it short until you know the pattern is safe. A pattern that freezes here will do the same in your own code.
The starting pattern, \b\w+@\w+\.\w+\b, is a deliberately simple example. Measured against real address shapes, it matches only part of most of them:
[email protected] matches only [email protected].[email protected] matches only [email protected].[email protected] matches only [email protected].café@example.fr does not match at all, because \w covers only unaccented letters, digits and the underscore.[email protected] matches [email protected], so it also finds things that are not addresses.It is a useful demonstration of how a pattern can look right and still cut real data short, which is the main thing a tester like this is for.
To compare two versions of a text instead, use Text Diff.
v flag as an "upgrade" to u: MDN, "RegExp.prototype.unicodeSets". developer.mozilla.orgd flag records: MDN, "RegExp.prototype.hasIndices". developer.mozilla.orgu: MDN, "RegExp.prototype.unicode". developer.mozilla.org(a+)+$ example: OWASP, "Regular expression Denial of Service". owasp.orgEvery behaviour and every value on this page was measured against this tool as it is published, in a browser, on 18 October 2026.
JavaScript's, through the browser's built-in RegExp. Lookbehind and named groups work; PCRE's possessive quantifiers and atomic groups are rejected, and \A is read as a plain letter. Test in the flavour your code will actually run.
The page stops after 500 matches and reports the 501st it found, without saying the list was cut. If you see exactly 501, there are probably more. Narrow the pattern or test a shorter piece of text.
Only d, g, i, m, s, u, v and y are kept; any other letter is removed silently, so PCRE's x does nothing here. Typing a letter twice is an error. Without g you only ever see the first match.
The pattern is probably one that backtracks exponentially, such as (a+)+$, and it reruns on every keystroke. Measured, 30 characters took 6 seconds per keystroke. Wait for it, then shorten the text or rewrite the pattern without nested repetition.
Positions count UTF-16 code units, as JavaScript does, and most emoji take two. A letter after one emoji is reported at position 2. Add the u flag so a dot treats the emoji as one character, though positions still count units.
No. Groups are listed in order as an array, so (?<year>\d{4}) appears as the first group without its name. A group that did not take part in the match shows as null.
No. It is a simple demonstration: it cuts [email protected] down to [email protected], misses accented addresses entirely, and matches [email protected] inside [email protected]. Use it to learn the tool, not to validate input.
No. The pattern and the test string are matched by your browser, on your device. Nothing is uploaded, saved or shared, so it is safe to paste real log lines or data while you work on a pattern.