Regex Tester

Write a regular expression, paste some text and see every match highlighted instantly, with groups, positions and a replace preview.

Runs entirely in your browser. Nothing you add is sent to us.

Create a free account to use the Regex Tester

Free forever for this tool. Takes a few seconds — then you come straight back here.

  • All 150 free tools, one login
  • Free website audit with fixes
  • Search Console dashboard
  • Free keyword rank tracker

Already have an account? Sign in

Regex Tester — regex tester

A regex tester lets you write a regular expression and see straight away what it matches, before you put it into code, a form validator, a spreadsheet formula or a redirect rule. Our free tool uses the JavaScript regular expression engine built into your browser. Type a pattern, switch flags such as g, i, m and s on or off, and every match is highlighted in your test text. You also get a list of matches with numbered and named capture groups and their positions, a replace mode that previews $1 and $<name> substitutions, ready-made patterns for emails, UK postcodes, UK phone numbers, URLs, IPv4 addresses and dates, and a short cheat sheet. Matching runs in a background worker with a time limit, so a badly behaved pattern cannot lock up the page, and nothing you paste leaves your device.

How to use the Regex tester

  1. 1 Enter your patternType the regular expression without the surrounding slashes, for example \d{3}-\d{4}. The tool shows it as a JavaScript literal with the flags you choose.
  2. 2 Choose the flagsTurn on g to find every match, i to ignore case, m so ^ and $ work on each line, and s so the dot also matches new lines. Hover over a flag to see what it does.
  3. 3 Paste some test textAdd realistic examples, including ones that should not match. Matches are highlighted in alternating colours so neighbouring matches are easy to tell apart.
  4. 4 Check the groupsThe match list shows each match, its position and the value of every capture group, including named groups. Turn on the d flag to see where each group starts and ends.
  5. 5 Preview a replacementSwitch to Replace, type a replacement such as $2/$1 or $<year>-$<month>-$<day>, and copy the result once it looks right.

What a regular expression is

A regular expression, usually shortened to regex, is a compact way to describe a pattern in text. Instead of searching for one fixed word, you describe the shape of what you want: three digits followed by a hyphen, a word that starts with a capital letter, or anything that looks like an email address. Programming languages, text editors, databases, spreadsheet tools and web servers all support regular expressions, so learning the basics pays off in many places.

Regex has a reputation for being hard to read, and long patterns can be. The trick is to build them up a piece at a time and test each step against real examples. That is exactly what a regex tester is for. You can see at once whether a pattern matches too much, too little or nothing at all, and fix it before it reaches a live form or a production server.

Regular expressions also come in several dialects. The core syntax is shared, but features such as lookbehind, named groups, possessive quantifiers and Unicode property classes vary between engines. This tool uses JavaScript, which is what runs in browsers and Node.js, so results match what your front-end validation and most modern web code will do.

Understanding the flags

Flags change how the whole pattern behaves. They sit after the closing slash in a JavaScript literal, so /cat/gi means the pattern cat with the g and i flags. The tester supports all the flags most people need.

  • g (global): find every match in the text. Without it, only the first match is returned and replace only changes the first one.
  • i (ignore case): treat upper and lower case letters as the same, so london matches London and LONDON.
  • m (multiline): make ^ and $ match at the start and end of every line, not only the start and end of the whole text. Useful for lists pasted one item per line.
  • s (dotAll): let the dot match line breaks as well as other characters. Without it, .* stops at the end of a line.
  • u (unicode): read the pattern as full Unicode, which is needed for \p{L} style classes and for emoji and other characters outside the basic range.
  • y (sticky): only match at the exact current position. In this tester that means the match must start at the beginning of the text, or straight after the previous match when used with g.
  • d (indices): record the start and end position of every capture group. The tester shows these next to each group so you can see exactly what was captured.

Capture groups, named groups and replacements

Round brackets do two jobs: they group part of a pattern so a quantifier applies to all of it, and they capture whatever that part matched. In the pattern (\d{2})/(\d{2})/(\d{4}), the three groups hold the day, month and year. In a replacement, $1, $2 and $3 refer to those groups, so the replacement $3-$2-$1 turns 05/11/2026 into 2026-11-05.

Numbered groups get confusing once a pattern has more than two or three of them. Named groups solve this. Write (?<year>\d{4}) and the match list will show the value under the name year, and the replacement can use $<year>. Named groups make patterns easier to read months later, and they keep working if you add another group in front.

If you need brackets only for grouping, use a non-capturing group such as (?:https?|ftp). It behaves like normal brackets for alternation and quantifiers but does not create a numbered group, which keeps your $1 and $2 references stable. In the replace box, $& inserts the whole match and $$ inserts a literal dollar sign.

Using the common patterns safely

The preset buttons load a pattern, sensible flags and sample text so you can see how each one behaves. They are practical starting points, not perfect validators. Email addresses in particular are defined by a long and permissive standard, and a pattern strict enough to reject every invalid address will also reject some real ones. The email preset catches typical addresses and is fine for finding them in text or for a basic sanity check on a form. The only reliable way to confirm an address is to send it a message.

The UK postcode preset checks the general shape, such as SW1A 1AA or M1 1AE, with an optional space. It does not know whether a postcode actually exists. If you need real validation, check against the Royal Mail Postcode Address File or a service built on it. The UK phone preset accepts numbers starting with 0 or +44 with common spacing and brackets, but phone formats vary, so normalise numbers by removing spaces before storing them.

The IPv4 preset only accepts numbers from 0 to 255 in each part, which is stricter than the common \d{1,3} shortcut. The date preset matches day, month and year in UK order with named groups, but a regular expression cannot tell that 31/02/2026 is not a real date. Check the actual date in code after matching.

Catastrophic backtracking and why the tester has a time limit

Most regex engines, including the one in JavaScript, work by trying a path through the pattern and backing up to try another path when one fails. Usually this is fast. But certain patterns, especially nested quantifiers such as (a+)+ or (\w+\s?)*$, can force the engine to try an exponential number of paths when the text almost matches but not quite. A string of thirty characters can then take minutes or longer to fail.

This is known as catastrophic backtracking, and on a server it can become a denial-of-service weakness, often called ReDoS. In a browser it freezes the tab. To protect you, this tester runs every match inside a separate Web Worker and stops it after two seconds. If you see the timeout warning, look for repeated groups that can match the same characters in more than one way, and make them more specific. Replacing .* with a negated class such as [^,]* is a common fix, and so is removing a quantifier from inside a group that is already repeated.

The test text is also limited to 200,000 characters and the match list shows the first 200 matches, so very large inputs stay responsive. The total match count is still shown.

Where regex is used on a typical business website

Even if you never write application code, regular expressions turn up in everyday website work. Apache .htaccess files and nginx configuration use them in redirect and rewrite rules, so a pattern such as ^blog/(\d{4})/(.*)$ can send an old URL structure to a new one in a single line. Google Analytics 4 and Looker Studio use regex filters to group pages or exclude internal traffic. Google Search Console lets you filter queries and pages with regular expressions, which is handy for separating branded from non-branded searches.

Form builders and CMS plugins often accept a pattern to validate fields such as order numbers, membership IDs or postcodes, and spreadsheet tools such as Google Sheets offer REGEXMATCH, REGEXEXTRACT and REGEXREPLACE. Be aware that some of these use a different engine. Google Sheets and Search Console use the RE2 syntax, which does not support lookarounds or back-references, and server software may use PCRE. Test the core pattern here, then check it once in the tool that will actually run it.

Examples you can copy

Reformat UK dates to ISO 8601 with named groups

Pattern:      (?<day>\d{2})/(?<month>\d{2})/(?<year>\d{4})
Flags:        g
Replace with: $<year>-$<month>-$<day>

05/11/2026  ->  2026-11-05

Find lines that do not contain a word (multiline)

Pattern: ^(?!.*\bdraft\b).+$
Flags:   gim

Matches every line that does not include the word "draft".

Redirect rule pattern for .htaccess

RewriteRule ^news/(\d{4})/([a-z0-9-]+)/?$ /blog/$2 [R=301,L]

Test the part between ^ and $ here first: news/2026/spring-offer

Common mistakes to avoid

Forgetting to escape special characters

A dot matches any character, so example.com also matches exampleXcom. Write example\.com when you mean a literal dot, and escape ? + * ( ) [ ] { } | ^ $ and \ in the same way.

Leaving out anchors when validating

Without ^ and $, \d{5} happily matches inside 1234567. Anchor the pattern when the whole value must fit the format.

Using greedy .* where a lazy or narrower match is needed

Greedy quantifiers grab as much as possible, so <.*> matches from the first < to the last >. Use .*? or a class such as [^>]* instead.

Testing only examples that should match

Always include text that should fail. A pattern that matches everything you expect can also match a lot you did not intend.

Assuming every tool uses the same regex engine

JavaScript, PCRE and RE2 differ on lookbehind, named groups and back-references. Recheck the final pattern where it will run.

Frequently asked questions

No. Matching runs in a background worker that is stopped after two seconds, so a pattern that backtracks catastrophically shows a warning instead of freezing your browser.

They check the general format only. A postcode can look right and still not exist, so use an address lookup when you need certainty.

It uses the JavaScript (ECMAScript) engine in your browser, so results match front-end code, Node.js and most browser-based validation. Other engines such as PCRE, Python and RE2 share most syntax but differ in some features.

The g (global) flag is probably off. Without it, JavaScript stops at the first match. Turn on g to find every match and to replace all of them.

Use \n for a line feed, or \r?\n to cover Windows line endings too. To let the dot match across lines, turn on the s flag.

Yes. Modern browsers support both (?<=…) for positive and (?<!…) for negative lookbehind. Very old browsers do not, so check your audience if you rely on it in front-end code.

It asks the engine to record the start and end index of every capture group. The tester shows these positions in square brackets next to each group value.

The pattern most likely triggers catastrophic backtracking on your test text. Look for nested quantifiers such as (a+)+ or overlapping alternatives, and make the repeated part more specific.

No. Everything runs in your browser in a background worker. Nothing is sent to a server, stored or logged, so it is safe to test against real data such as logs or customer lists.

Free website audit

See how your site scores, free

Speed, SEO, DNS, email (SPF/DKIM/DMARC) and security in one scan, with a prioritised fix list.