What is catastrophic backtracking?

It is when the engine has to try an exponential number of ways to match before deciding a string does not match. It comes from a quantifier inside another quantifier, such as (a+)+ or (\s*\w+)*. The pattern looks harmless and is fast on short input, then hangs on a slightly longer string that fails.

My pattern was flagged for backtracking — how do I fix it?

Remove one of the two quantifiers. (a+)+ matches exactly what a+ matches, and (\s*\w+)* is usually meant to be \w+(\s+\w+)*. Where the length is known, state it: {10} cannot blow up the way + can.

Why does my regex work here but fail in Python or PHP?

This tester uses the browser's own JavaScript engine. Lookbehind, named groups and Unicode property escapes work, but flavour-specific syntax such as PCRE atomic groups and possessive quantifiers does not — and those are precisely the features you would use elsewhere to stop backtracking.

Is it safe to paste production logs or customer data?

The pattern and the test text are processed inside the page and nothing is sent anywhere, so log lines containing emails, order IDs or phone numbers stay on your machine. There is no server step to reach.

How do I match an Indian mobile number?

^[6-9]\d{9}$ covers the current ten-digit series. Strip spaces, hyphens and a leading +91 or 0 before validating, rather than trying to allow every written format in one pattern. That habit is how patterns grow the nested quantifiers that make them slow.

Regex Tester

Test a regular expression against real text, read a plain-English explanation of every token, and get a warning when the pattern can backtrack catastrophically — all in your browser, with nothing uploaded.

Runs in your browser — nothing is uploaded

Pattern

Matched by your browser's own RegExp, so results are exactly what your JavaScript will do.

JavaScript flavour. No other engine is offered, because no other engine is used.

Test text

Ctrl + Enter run now

Your pattern and your test text stay in this tab. Nothing is uploaded, logged or sent to a server — patterns often contain the shape of real data.

Matches

Matches appear here as you type.

Test suite

Import

Pin down what should and should not match, then re-run them all whenever you change the pattern.

No test cases yet. Add one for something that should match, and one for something that should not — those two together catch most mistakes a pattern can make.

Need this as an API?

Why use it

Built to be genuinely useful

Plain-English breakdown

Every token gets a sentence, so you can check the pattern says what you meant rather than assume it does.

Backtracking warning

Nested quantifiers like (a+)+ are flagged from the pattern alone, before one crafted input ties up a request thread.

Groups you can see

Matches and their numbered capture groups are highlighted as you type, so you know what group 1 actually holds.

Free, with no account

No sign-up, a 2,000 character cap on the pattern and no daily limit.

How it works

Three steps

1
Enter the pattern and pick the flags you will use in production — g, i, m or s.
2
Paste real text, including the lines that should not match.
3
Read the token breakdown, then check the highlighted groups and any backtracking warning.

The failure mode that takes sites down

Write ^(a+)+$ and test it against a string of twenty-five a characters followed by an X. The match fails, but before the engine gives up it tries every way of splitting those characters between the inner and outer quantifier — about thirty-three million attempts. Add five more characters and it is over a billion, and the tab stops responding.

That is catastrophic backtracking, and it is not a laboratory curiosity. The same shape hides in ordinary email and URL validators: a group ending in plus or star placed inside another plus or star. On a server it is worse than a frozen tab, because one crafted input can hold a request thread until the process is killed.

The warning here is static. It reads the pattern itself, finds quantifiers nested inside quantifiers, and flags them before anything runs — which matters, because the sample text you happen to be testing with will usually match instantly and tell you nothing is wrong.

Reading the pattern instead of guessing

Most regex faults are comprehension faults. A full stop means any character outside a character class and a literal full stop inside one. \d{4} matches exactly four digits; \d{4,} matches four or more. (?:...) groups without capturing. The breakdown names each of these in a sentence, so the pattern stops being a wall of punctuation.

Greediness causes most of the rest. Against the line a=1; b=2; the pattern a=.*; matches all the way to the final semicolon, because .* takes everything it can and hands characters back only until the match can succeed. Write a=.*?; and it stops at the first. The breakdown tells you which of the two you have written.

Test with the input that fails

Paste input that should not match, not only input that should. A pattern that matches in a microsecond can still take minutes to reject, because backtracking explodes on failure, not on success. Testing only well-formed samples hides the exact case that will arrive from a form field at two in the morning.

Validators are where this bites. An Indian GSTIN is exactly fifteen characters, so ^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z][1-9A-Z]Z[0-9A-Z]$ needs no open-ended quantifier at all. A mobile number is ^[6-9]\d{9}$. Fixed lengths written as fixed lengths cannot backtrack, and they fail in the same time they succeed.

Anchors matter as much as quantifiers. Drop the ^ and $ from that mobile pattern and it will cheerfully find a valid ten-digit number inside a twenty-digit string and report a match. A large share of bugs filed as the regex is wrong are anchors that were never written.

FAQ

Questions people ask

API access

Need Regex Testing and Matching in Your Application?

Integrate regex testing and matching directly into your application, backend or build pipeline through API access.

Tell us what you are building, how you plan to use it and the volume you expect. We will come back to you with availability, integration details and a quote for your usage.

Related tools

More developer tools

Available tools are linked; the rest are in development.

HTML Formatter CSS Formatter JavaScript Formatter SQL Formatter AI Writer AI Summarizer AI Paraphraser AI Humanizer AI Grammar Checker AI Rewriter AI Translator AI PDF Summarizer

All Developer Tools

Need a tool like this for your business?

We build internal tools, dashboards and automation that fit how your team works.

See Our Services