Quick answer
A regex tester runs the pattern you write against the text you provide and instantly highlights what matches. This tool highlights matches live, lists capture groups and named groups, previews find-and-replace, explains the pattern piece by piece, and generates equivalent code for JavaScript, Python, PHP, and Java — entirely in your browser, with nothing sent to a server.
22Ready-made templates
5Flags (g,i,m,s,u)
4Code languages
100%Client-side
⚙️ Accuracy & engine note: This tool uses the browser's built-in ECMAScript (JavaScript) regex engine. PCRE (PHP), Python's re, and Java's regex engine share most syntax but can differ slightly on advanced features (like atomic groups or possessive quantifiers) — test the "Generate Code" output separately in your target language. The credit card and IBAN templates check format only; they do not verify checksums.
What is regex, and how do you test one?
A complete guide — syntax, capture groups, find & replace, and flags — explained and made citable.
A regular expression (regex, for short) is a special syntax used to describe a pattern within text. For example, \d{4} means "four digits in a row," and [A-Z][a-z]+ means "a word that starts with a capital letter." Regex is used for form validation (phone numbers, email addresses, credit card formats), log file analysis, search-and-replace, and data extraction — and nearly every programming language, including JavaScript, Python, PHP, and Java, supports very similar syntax.
Why does testing a regex pattern matter?
Quick answerRegex syntax is dense and easy to get wrong — forgetting to escape a character (using . instead of \., for example) can lead to unexpected matches. Testing your pattern live against real sample data, and visually confirming which parts actually match, is the most reliable way to catch mistakes before a bad pattern ships to production.
What is a capture group?
Quick answerA section wrapped in parentheses, like (abc), forms a "capture group" and makes that part of the match separately accessible. (?:abc) is a non-capturing group — it groups without being numbered. (?<name>abc) assigns a name to a group (a named group); the result can then be accessed by number or by name.
- Numbered group —
(\d{2})-(\d{2}): in "12-34," group 1 = "12," group 2 = "34."
- Named group —
(?<year>\d{4}): accessible in the result as groups.year.
- Non-capturing group —
(?:abc)+: groups repeated "abc" without numbering it.
How does find & replace work?
Quick answerIn a find-and-replace operation, the parts matched by the regex are swapped for another string; capture groups are referenced with $1, $2… or, for named groups, $<name>. For example, running (\d{4})-(\d{2})-(\d{2}) against replacement $2/$3/$1 turns "2026-07-19" into "07/19/2026." If the "g" flag isn't set, only the first match is replaced — try it live in the "Replace" tab above.
What do regex flags do?
Quick answerg finds every match (without it, only the first); i turns off case sensitivity; m makes ^/$ anchors match the start/end of every line, not just the whole string; s (dotall) lets . match newlines too; and u interprets the pattern by Unicode code points. Flags are added as a separate option, not appended inside the pattern itself.
Common regex symbols (quick summary)
Quick reference — see the full Reference section below for everything
| Symbol | Meaning | Example |
|---|
| \d | Digit (0-9) | \d{4} → "2026" |
| \w | Word character (letter/digit/_) | \w+ → "hello_123" |
| \s | Whitespace (space/tab/newline) | \s+ → " " |
| ^ $ | Start and end of text/line | ^abc$ → exactly "abc" |
| * + ? {n,m} | Quantifiers (repetition) | a{2,4} → "aa".."aaaa" |
| (...) (?:...) (?<name>...) | Capture / non-capturing / named group | (\d+)-(\d+) |
Regex terms glossary
Short definitions of the core concepts used in regular expressions.
PatternThe regex text itself that defines what to match.
FlagAn extra letter that changes how the pattern behaves: g, i, m, s, u, for example.
Capture groupA part of the pattern in parentheses (...) whose matched text becomes separately accessible.
Named groupA capture group given a name with (?<name>...); accessed by that name in the result.
Greedy / LazyA greedy quantifier tries to match as much as possible; a lazy one (with a trailing ?) tries to match as little as possible.
BackreferenceReferring back to an earlier capture group within the pattern, using \1, \2, etc.
Anchor^ and $ — they mark the start and end of the text/line without consuming any characters.
Lookahead / LookbehindChecks whether a pattern exists before or after a position, without including it in the match.
MetacharacterA character with special meaning in regex: . * + ? ^ $ ( ) [ ] { } | \.
EscapePutting a \ before a metacharacter to match it literally, e.g. \..
Replace / SubstitutionSwapping the matched text for another string, referencing groups with $1, etc.
Global (g) matchFinding every match in the text, not just the first one.
Frequently asked questions
How do you test a regex pattern?
Write your regex pattern into a testing tool and enter the text you want to check it against to see
matches live. In this tool, after entering your pattern and flags (g, i, m, s, u), matching portions of the text
are automatically highlighted in color; capture groups, position information, and named groups are listed in a
separate table. You can refine your pattern through quick trial and error.
What is a regular expression (regex)?
A regular expression (regex) is a special syntax used to define a specific pattern within text.
For example, the pattern \d{11} means "11 digits in a row." Regex is widely used for form validation
(email, phone number, credit card format), text search-and-replace, log analysis, and data extraction, and is
supported with very similar syntax in almost every programming language (JavaScript, Python, PHP, Java).
How do you write a regex for a US phone number?
The pattern ^(?:\+1|1)?\s?\(?\d{3}\)?[\s.-]?\d{3}[\s.-]?\d{4}$ matches a 10-digit US
phone number with an optional +1/1 country code, optional parentheses around the area code, and optional spaces,
dots, or dashes between groups. That means "(555) 123-4567," "555.123.4567," and "+1 555 123 4567" can all match
with the same pattern. This pattern only checks common formatting — it doesn't verify that an area code is
actually assigned.
What's an example email regex?
A practical email validation pattern is ^[\w.+-]+@[\w-]+\.[a-zA-Z]{2,}$: it looks for
letters, digits, underscore, dot, plus, or dash in the username, an @ sign, a domain name, and an extension of at
least two letters. A fully RFC 5322-compliant email regex is far more complex; in practice, this simplified
pattern is good enough for most form validation.
How do you validate a credit card number format with regex — and is that enough?
The pattern ^\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}$ checks that a card number is
four groups of four digits, optionally separated by spaces or dashes. That's a format check only — a genuinely
valid card number also needs to pass the Luhn checksum algorithm, a digit-by-digit arithmetic calculation that a
regex alone cannot perform. In practice, use a two-step approach: a quick regex format filter, followed by a
Luhn check in your application code.
Is an online regex tester safe to use?
In this tool, your regex pattern and test string are processed entirely in your browser
(client-side JavaScript); nothing is sent to a server, saved, or logged. When you build a shareable link, only
the pattern and flags are added to the URL — your test string, which may contain personal data, is never
included in the link.
What is a capture group in regex?
A section wrapped in parentheses, like (abc), forms a "capture group" and makes the
matched text of that section separately accessible; for example, the pattern (\d{2})-(\d{2})
applied to "12-34" captures group 1 = "12" and group 2 = "34." Groups can be named with
(?<name>...) syntax (a named group); (?:...) groups without capturing at
all.
How does regex find-and-replace work?
In a find-and-replace operation, the text matched by the regex is swapped for another string;
capture groups are referenced with $1, $2… or, for named groups, with
$<name>. For example, running the pattern (\d{4})-(\d{2})-(\d{2}) against the
replacement $2/$3/$1 turns "2026-07-19" into "07/19/2026." If the "g" flag isn't checked, only the
first match is replaced.
How do I extract all emails or phone numbers from a block of text with regex?
Write your pattern (e.g. [\w.+-]+@[\w-]+\.[a-zA-Z]{2,} for email), turn on the "g"
flag, and paste in your text; then, on the "Extract / List" tab, every match is listed as plain text — one per
line, comma-separated, or with a custom separator. Use "remove duplicates" to drop repeats, copy the list with
one click, or download it as .txt, or as .csv with position and group details included. Tip: don't use
^ and $ anchors if you want to search within a line rather than match the whole
line.
How do I test my regex pattern against multiple examples (unit testing)?
Use the "Tests" tab: enter examples that should match your pattern in the "Should match" box, and
examples that should NOT match in the "Should NOT match" box, one per line. The tool runs every line against
your pattern, compares it to your expectation, and marks each one green (passed) or red (failed), with an
"X/Y tests passed" summary at the top. It's ideal for hardening validation patterns like phone numbers or
emails against several real examples. Use ^ and $ anchors for full-line
validation.
Where do the built-in templates come from, and how often are they updated?
The ready-made templates (US phone, email, ZIP code, IBAN, credit card, hex color, strong
password, URL, IPv4/IPv6, UUID, HTML tag, MAC address, US SSN, US/ISO date, time, slug, hashtag, YouTube video
ID, file extension, HTML comment) are based on widely accepted format conventions, and — as evergreen structural
rules — don't require frequent updates. The matching engine is your browser's built-in ECMAScript regex engine.
Last updated: July 28, 2026.
What is ReDoS (catastrophic backtracking), and how does the quick-check work?
ReDoS (Regular expression Denial of Service) happens when a pattern with ambiguous nested or
overlapping quantifiers — like (a+)+ or (a|a)* — takes exponentially longer to fail
as the input grows, sometimes freezing the page or server for seconds or minutes on a single string. The badge
under the pattern field runs your compiled pattern against a few adversarial repeated-character strings of
increasing length, entirely in your browser; if any probe takes noticeably longer than expected, it's flagged
as "may be slow on certain inputs." This is a best-effort heuristic, not a formal proof — a clean result doesn't
guarantee a pattern is completely safe, but a flagged one is worth rewriting (e.g. replacing nested quantifiers
with more specific character classes).
Methodology & sources
ToolPico's Regex Tester is an independent, free tool. The matching engine uses the browser's built-in
ECMAScript (JavaScript) RegExp implementation directly — no server-side processing or third-party
API is required. The 22 ready-made templates (phone, email, ZIP code, IBAN, credit card, hex color, strong
password, URL, IPv4/IPv6, UUID, HTML tag, MAC address, US SSN, US/ISO date, time, slug, hashtag, YouTube video
ID, file extension, HTML comment) are built on widely accepted format conventions. The ReDoS quick-check badge
runs a heuristic, client-side timing probe against adversarial repeated-character inputs — it is not a formal
proof of safety.
Sources: ECMA-262 (JavaScript) regular expression syntax reference · ISO 13616 (IBAN structure) ·
generally accepted US phone number and ZIP code formatting conventions · the Luhn algorithm (ISO/IEC 7812-1)
for card-number checksums · OWASP guidance on Regular expression Denial of Service (ReDoS). Last updated:
July 28, 2026. Results are for informational and development purposes; combine with algorithmic (checksum)
validation for critical data checks.