RegexLab
See how a regular expression actually runs. Visualize it as a state machine, step through matching character by character, and catch the catastrophic backtracking that hangs servers — on a regex engine built from scratch, all in your browser.
⚡ 100% local — your pattern and text never leave your deviceHow it works
RegexLab ships its own regular-expression engine. When you type a pattern, it is parsed into a syntax tree and compiled two ways. The first is a Thompson NFA, the classic construction that turns a regex into a finite state machine. The automaton view draws that machine, and the play button runs it as a real linear-time simulation: at each character it keeps a set of states the engine could be in, so it never has to guess or backtrack. That is how tools like grep and RE2 stay fast no matter what you throw at them.
The second compilation is a backtracking matcher, the same family of algorithm that JavaScript, Python, Java and PCRE use. It is more flexible, but on certain patterns it explores an exponential number of paths. The profiler tab feeds the engine a crafted, ever-longer input and charts how many steps it takes, so a dangerous pattern reveals itself as a curve that shoots straight up.
What is catastrophic backtracking (ReDoS)?
Take (a+)+$. Against a string of as followed by a character that can't match, a backtracking engine tries every possible way to split those as between the inner and outer +, and the number of splits doubles with every extra character. Twenty or thirty characters is enough to freeze a thread for seconds. When that thread is a web server validating user input, an attacker can take the whole service down with a tiny request. This is a regular-expression denial of service, or ReDoS, and it hides in innocent-looking validation patterns all the time. RegexLab flags it before it reaches production.
Why run it in the browser?
Because your patterns and test data often aren't things you want to paste into someone else's website. Everything here — parsing, the automaton, the simulation, the profiler — is plain JavaScript running on your own machine. Nothing is uploaded, there is no account, and it keeps working with your connection off.
Things to try
Load the (a+)+$ preset and watch the profiler curve. Then change the pattern to a+$ or a{1,20}$ and see the same input become safe. Switch to the NFA tab with gr(a|e)y to see alternation as two branches, or a(b|c)*d to see a star become a loop in the graph. Share any pattern with the URL — the link carries your regex, flags and test string.
Does my pattern or text get uploaded?
No. RegexLab runs entirely in your browser on its own engine. Nothing is sent to a server, so it is safe to use on private logs and data.
Which regex features are supported?
Literals and escapes (\d \w \s and friends), the dot, character classes with ranges, anchors ^ $ \b \B, groups and (?:…), alternation, and quantifiers * + ? {m} {m,} {m,n} including lazy *? forms, plus the i, m and s flags. Backreferences and lookaround are intentionally out of scope for the visual engine, because the NFA view exists to show the regular core of regular expressions.
Is the ReDoS verdict authoritative?
It is an empirical probe: RegexLab grows an adversarial input and measures real step counts, then classifies the growth as linear, polynomial or exponential. It is excellent at catching the common catastrophic patterns, but treat it as a strong warning, not a formal proof. A clean result is not a security guarantee.
Why are there two engines?
To show the trade-off. The NFA is fast and immune to catastrophic backtracking but can't do features like backreferences. The backtracking engine is flexible but can blow up. Seeing both side by side is the whole point.
I build a tool like this every day.
Senior full-stack engineer, open to senior or staff roles and contract work, fully remote. Browse the rest of the lab or get in touch.