Skip to tool
ecech.
💻 Developer & Code

Free Regex Tester with Live Match Highlighting and Capture Groups

Matches highlight as you type, capture groups are listed per match, and a runaway pattern is stopped before it hangs your tab instead of after.

/ /

Test string

Matches, highlighted

Matches

0

Groups

0

Characters matched

0

Time

Patterns people actually need

Advertisement

How the calculation works

One pattern, taken apart (\w+) @ (\w+) \. (com|org|net) group 1 one or more word chars literal group 2 escaped dot a bare . means any character group 3 alternation The single most common bug a.b matches "axb", "a5b", "a b" a\.b matches only "a.b" An unescaped dot inside a domain, filename or IP address pattern is why it "works" on your test data and fails in production.

How to Use This Tool

A regular expression is easy to write and hard to be sure about. The gap between "it matched my three test strings" and "it is correct" is where most regex bugs live, and the only reliable way to close it is to watch the matches highlight against real data as you type.

Writing and testing

Type the pattern in the top field — without the surrounding slashes, which are shown for you. Flags go in the box after, or use the checkboxes. The test string below highlights every match live, and the panel underneath lists each match with its position and every capture group broken out separately.

Capture groups are the part worth paying attention to. A pattern that matches is only half the job; if you are extracting data you need the groups to land where you expect. The list shows group 1, group 2 and any named groups by name, per match, so a mistake is visible immediately rather than three functions later.

Greedy versus lazy, on <b>bold</b> and <i>italic</i> <.+> greedy <b>bold</b> and <i>italic</i> one match, swallowing everything between the first < and the last > <.+?> lazy <b>bold</b> and <i>italic</i> four matches, each stopping at the nearest closing bracket
Adding ? after a quantifier makes it lazy. This one character is the difference between four tags and one enormous match, and it is the second most common regex mistake.

The backtracking guard

Some patterns are pathological. Nested quantifiers such as (a+)+b can make the engine try an exponential number of paths on input that nearly matches, freezing the tab for minutes. This is not a theoretical concern — it is a real denial-of-service class called ReDoS, and it has taken down production services.

Every evaluation here runs under a time budget. If the pattern exceeds it, execution stops, you get an explanation naming the likely culprit, and your browser stays responsive. That is a feature most online regex testers do not have, which is why some of them can be crashed by a five-character pattern.

Replace preview

The bottom field previews a replacement across the whole test string. Use $1, $2 for capture groups and $& for the whole match. Getting a replacement right in a preview takes seconds; getting it wrong in a script that has already rewritten four hundred files takes considerably longer.

A note about flavour

This uses JavaScript's regex engine, which is what runs in browsers and Node. Most syntax is shared across languages, but there are real differences: JavaScript has no lookbehind in older Safari, no atomic groups, and no \A or \z anchors. A pattern verified here will work in JavaScript; if you are targeting Python, PCRE or Go, test it there before trusting it.

Advertisement

Frequently Asked Questions

Why does my pattern match more than I expected?
Almost always a greedy quantifier. By default + and * take as much as they can and only give characters back when forced. Adding a question mark makes them lazy, so <.+?> matches each tag separately rather than swallowing everything from the first opening bracket to the last closing one.
Why does my dot match the wrong thing?
An unescaped dot means any character. In a domain, filename or IP pattern you almost always want a literal dot, which is written backslash-dot. This is the most common regex bug there is: the pattern appears to work on your test data and then matches something absurd in production.
What is catastrophic backtracking?
A pattern with nested quantifiers, such as (a+)+b, can force the engine to try an exponential number of paths on input that nearly matches. Twenty characters can take minutes. It is a real denial-of-service class called ReDoS. This tester runs every evaluation under a time budget and stops rather than freezing your tab.
Does this use the same regex flavour as Python or PCRE?
No. This is JavaScript's engine, which is what runs in browsers and Node. Most syntax is shared, but JavaScript lacks atomic groups and possessive quantifiers, uses different anchor syntax, and older Safari lacks lookbehind. Verify elsewhere if you are targeting another language.
How do I use capture groups in a replacement?
Use $1 for the first group, $2 for the second and so on, or $& for the whole match. Named groups are referenced as $. The replace preview at the bottom shows the result across your whole test string before you run it against anything real.
What does the u flag do?
It enables full Unicode mode, which makes escapes like \u{1F600} work and treats surrogate pairs as single characters. Without it, a regex operating on emoji or non-BMP characters will match half a character and produce broken output. Turn it on whenever your data might contain emoji.
Is my test data sent anywhere?
No. The pattern and the text are evaluated by your browser's own regex engine. Nothing is transmitted, which matters because people routinely paste production log lines, customer records and API responses into regex testers.

Related tools in Developer & Code

Browse all Developer & Code tools
The desk where ecech. tools get written: a laptop, a notebook of to-dos and a whiteboard listing the tools on the site.

Made by one person

ecech. is not a content farm. Every tool here is written and checked by hand, one at a time, by someone who wanted the tool to exist and could not find a version that showed its working.

No accounts and no sign-in, and nothing you type reaches a server — every calculation on this page runs inside your browser. The ads are served by Google and do set their own cookies, which is set out in full on the privacy page. More about the site.