# Regex Toolkit > Test, explain, and debug regular expressions with live matches and a backtracking-risk check. - Tool: https://ronutz.com/en/tools/regex - Family: Web & HTTP --- ## What it does Test, explain, and debug a regular expression. Enter a pattern and some text and the tool shows every match with its capture groups live as you type; enter a pattern on its own and it breaks the pattern into annotated pieces so you can read what each part does; and throughout, it warns when a pattern is at risk of catastrophic backtracking. It uses the JavaScript (ECMAScript) regex engine and runs entirely in your browser. ## Three jobs in one The tool does the three things you actually want from a regex workbench: - **Test.** It compiles your pattern and flags, reports any syntax error in plain terms, and runs the pattern against your input, returning every match along with its numbered and named capture groups. The number of matches it collects is capped, so a pattern that matches a huge input cannot lock up the page. - **Explain.** It parses the pattern into annotated tokens, labeling each quantifier, character class, group, and assertion, so you can understand a regex without running it in your head. - **Check for ReDoS.** It looks for the structures that cause catastrophic backtracking and warns you about them. ## What ReDoS is, and why it matters here Regular expression Denial of Service (ReDoS) happens when a pattern can backtrack an exponential number of ways on certain inputs, so a short string makes the engine run effectively forever. The classic shape is a quantifier applied to a group that itself contains a quantifier, like `(a+)+`, matched against input that ultimately fails. This matters directly in the browser: a synchronous regex match cannot be interrupted, so a catastrophic pattern would hang the page. That is why the tool both caps its work and flags risky patterns, and it is a real warning to heed before shipping a pattern that will run on untrusted input. ## The engine and its flavor Regex syntax varies between languages, and this tool uses the JavaScript flavor defined by the ECMAScript specification, with its flags (global, ignore-case, multiline, dotall, unicode, and sticky) and its support for named groups and lookarounds. If you are writing regex for JavaScript, or for anything that shares its semantics, what you see here is what you will get. ## Using it Enter a pattern and flags, and optionally some text to match against, and read the live matches, the token-by-token explanation, and any backtracking warning. Everything is computed locally. ## Standards and references - [MDN: Regular expressions](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_expressions) - JavaScript regex syntax, flags, groups, and assertions - [ECMAScript Language Specification: RegExp](https://tc39.es/ecma262/multipage/text-processing.html) - the normative regex grammar and semantics - [OWASP: Regular expression Denial of Service (ReDoS)](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) - catastrophic backtracking and how to avoid it ## Related reading - [Catastrophic Backtracking and ReDoS](https://ronutz.com/en/learn/regex-catastrophic-backtracking.md): Some innocent-looking patterns can take seconds, minutes, or effectively forever on a short string. The cause is catastrophic backtracking, and when an attacker controls the input it becomes a denial-of-service bug. Here is why it happens and how to write patterns that cannot. - [Regex Anchors and Boundaries](https://ronutz.com/en/learn/regex-anchors-and-boundaries.md): Anchors match a position, not a character: the start or end of the string, or the edge of a word. They are the difference between a pattern that matches anywhere and one that matches only where you mean. This covers ^, $, \b, and their multiline behavior, plus the mistakes they cause. - [Regex Flags and Modes](https://ronutz.com/en/learn/regex-flags-and-modes.md): A flag changes how the whole pattern matches: case sensitivity, whether ^ and $ see lines, whether the dot crosses newlines, and whether whitespace in the pattern is ignored. The same regex can match completely different things depending on its flags, so knowing them prevents a lot of confusion. - [Regex Groups, Backreferences, and Lookarounds](https://ronutz.com/en/learn/regex-groups-and-backreferences.md): Parentheses do far more than set precedence in a regex. They capture text for you to reuse, name the pieces you care about, and — with a question mark prefix — let you assert what comes before or after without consuming it. - [Regex Quantifiers and Character Classes](https://ronutz.com/en/learn/regex-quantifiers-and-classes.md): A regular expression is built from two questions: what character do I want, and how many of them? Character classes answer the first, quantifiers answer the second. Get these two right and most of regex falls into place.