Regex Tester for JavaScript

Regex cheat sheet (JavaScript syntax)

Most of these tokens mean the same in PCRE, Python and Java. The differences come further down.

• . any character except a line break (with s, line breaks too). \. is a literal dot.
• \d a digit 0 to 9, \w a letter, digit or underscore (ASCII only), \s whitespace including line breaks. \D, \W and \S match everything else.
• [abc] one of a, b or c. [^abc] anything but those. [a-z0-9] ranges. Inside brackets, . and + are plain characters.
• ^ and $ the start and end of the text, or of each line with m. \b a word boundary: \bcat\b finds cat but not category.
• * zero or more, + one or more, ? optional, {3} exactly three, {2,5} two to five, {2,} two or more. Add ? for the lazy version: +?, {2,5}?.
• (...) a capture group ($1), (?:...) a group that doesn't capture, (?<name>...) a named group. \1 or \k<name> repeats the captured text: \b(\w+)\s+\1\b finds is is and the the in This is is a test of the the tool.
• a|b either side. Group it to limit its reach: ^(?:cat|dog)$, not ^cat|dog$.
• (?=...) followed by, (?!...) not followed by, (?<=...) preceded by, (?<!...) not preceded by. They check text without including it: \d+(?=px) returns 100 from 100px.
• \p{L} a letter in any script, \p{Lu} an upper-case letter, \p{N} any number (Arabic-Indic ٣٤٥ too), \p{Script=Arabic} one script. These need u or v.

JavaScript regex flags

In code, flags follow the closing slash (/abc/gi) or go in the second argument of new RegExp("abc", "gi").

• g global: every match, not just the first. matchAll and replaceAll throw a TypeError without it.
• i ignoreCase: /colou?r/gi finds Color and COLOUR.
• m multiline: ^ and $ work per line. /^\d+$/g finds nothing in three lines of numbers; with gm it finds all three.
• s dotAll: . matches line breaks too.
• u unicode: reads code points, enables \p{...} and rejects sloppy escapes. \q matches q without u and fails with Invalid escape with it.
• v unicodeSets: u plus set operations. [\p{L}--[a-z]]+ (letters except a to z) finds ÄÖü and Ω in abcÄÖü xyz Ω. Chrome 112, Firefox 116, Safari 17, Node.js 20.
• y sticky: matches only at lastIndex, which is useful in tokenizers.
• d hasIndices: start and end of the match and of each group. On 10:02 ERROR PAY-402 card declined, (?<level>ERROR|WARN) (?<code>[A-Z]+-\d+) shows Index 6-19 and groups [6-11] and [12-19]. Chrome 90, Firefox 88, Safari 15, Node.js 16.

Copying a pattern from Python, PHP, Java or Go

Patterns from other languages usually work here. When one doesn't, it's normally one of these:

• Python re writes named groups as (?P<name>...), which JavaScript rejects with Invalid group. Its \d and \w are Unicode-aware, so \d matches ٣٤٥, and its lookbehind must have a fixed length.
• PHP (PCRE2) and Java have possessive quantifiers (a++) and atomic groups ((?>...)). JavaScript has neither: a++ fails with Nothing to repeat.
• An inline (?i) at the start is an error in JavaScript. Use the i button, or the scoped (?i:abc), which recent Chrome, Firefox and Node.js versions accept.
• Go's regexp (RE2) has no lookarounds or backreferences, but it always runs in linear time.
• Java string literals double every backslash, so \d+ becomes "\\d+".

Catastrophic backtracking (ReDoS)

When part of a pattern fails, JavaScript's engine steps back and tries another way to split the text. With nested quantifiers such as (a+)+$, a run of as followed by ! can be split in an exponential number of ways. In fresh Node.js 25 processes, 26 as took 3.8 seconds, 27 took 7.3 and 28 took 15: each extra character doubles the time.

This page stops the run at 1 second. A Node.js server has no such limit, so one long form field can block it for every user. That attack is called ReDoS. To avoid it:

• Don't nest quantifiers over the same characters. a+$ matches the same strings as (a+)+$ in microseconds.
• Don't let alternatives overlap. (\w|\d)+ is slow for the same reason; \w+ is enough.
• Limit input length before matching.
• On a server, a linear-time engine (Go's regexp, or the re2 package for Node.js) removes the risk, minus lookarounds and backreferences.

Use the pattern in code

The date pattern from the examples in four languages, plus grep. PHP can't use group names in a replacement, so it uses numbers. For JSON, use a parser instead of a regex: the JSON Formatter shows the line and column where it breaks.

const text = "Dates: 2024-03-15 and 1999-12-31";
const re = /(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})/g;

for (const m of text.matchAll(re)) {
  console.log(m.index, m[0], m.groups.year);
}
// 7 2024-03-15 2024
// 22 1999-12-31 1999

text.replaceAll(re, "$<day>/$<month>/$<year>");
// "Dates: 15/03/2024 and 31/12/1999"

import re

text = "Dates: 2024-03-15 and 1999-12-31"
pattern = r"(?P<year>\d{4})-(?P<month>\d{2})-(?P<day>\d{2})"

for m in re.finditer(pattern, text):
    print(m.start(), m.group(0), m.group("year"))
# 7 2024-03-15 2024
# 22 1999-12-31 1999

re.sub(pattern, r"\g<day>/\g<month>/\g<year>", text)
# 'Dates: 15/03/2024 and 31/12/1999'

$text = "Dates: 2024-03-15 and 1999-12-31";
$pattern = '/(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})/';

preg_match_all($pattern, $text, $m, PREG_SET_ORDER);
foreach ($m as $match) {
    echo $match[0], ' ', $match['year'], "\n";
}
// 2024-03-15 2024
// 1999-12-31 1999

echo preg_replace($pattern, '$3/$2/$1', $text);
// Dates: 15/03/2024 and 31/12/1999

re := regexp.MustCompile(`(?P<year>\d{4})-(?P<month>\d{2})-(?P<day>\d{2})`)
text := "Dates: 2024-03-15 and 1999-12-31"

fmt.Println(re.FindAllString(text, -1))
fmt.Println(re.ReplaceAllString(text, "${day}/${month}/${year}"))

# POSIX extended syntax: [0-9] instead of \d, no lookarounds
grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2}' app.log

# Perl-compatible syntax (GNU grep; the grep that ships with macOS has no -P)
grep -oP '(?<=\$)\d+' app.log