InterLAB tools · Highlighting · groups · replace · code for 5 languages

Regex tester

Type a pattern and matches and groups light up in the text instantly. Next to it: a breakdown, replace, test cases and code for five languages. Matching runs in a background thread, so even an explosive pattern cannot hang the page.

Free, no sign-up

Regular expression

Without the enclosing slashes. Hover a breakdown row to highlight that part of the pattern.

Test text

The pattern, cases and text up to 200 KB are saved in this browser only.

How the tester works

In-text highlighting
The pattern runs on your browser’s engine (ECMAScript RegExp) — exactly as JavaScript will run it in your product. Matches are highlighted right in the text field and groups are underlined in their own colours; the text stays editable.
Groups and positions
Every match shows its start and end, group numbers and names, their values and positions (as with the d flag). Without the g flag only the first match is found — like exec.
Replace, split, test cases
Replace follows GetSubstitution: $1, $<name>, $&, $`, $', $$ — you see the full result and the replacement of each match. Test cases check lines that should and should not match.
Breakdown and code
The pattern is split into parts with an explanation of each: anchors, classes, quantifiers (greedy and lazy), groups, lookahead and lookbehind, backreferences, Unicode properties. Code is generated for JavaScript, Python, Go, PHP, Java with flags and syntax translated.

Standards and rules

Syntax and behaviour follow ECMAScript (ECMA-262) as implemented by your browser: the v flag (ES2024) and modifier groups (?i:…) (ES2025) work where the browser supports them. Code for other languages accounts for their differences: Python re, Go regexp (RE2), PHP PCRE, Java java.util.regex.

Flag	Property	What it does
g	global	all matches, not only the first
i	ignoreCase	case-insensitive
m	multiline	^ and $ match at each line
s	dotAll	dot also matches line breaks
u	unicode	Unicode: \p{…}, \u{…}, an emoji is one character, strict syntax
v	unicodeSets	like u, plus nested classes and -- / && (ES2024)
y	sticky	match only at lastIndex, no scanning ahead
d	hasIndices	start and end of every group (match.indices)

Property: global
What it does: all matches, not only the first

Property: ignoreCase
What it does: case-insensitive

Property: multiline
What it does: ^ and $ match at each line

Property: dotAll
What it does: dot also matches line breaks

Property: unicode
What it does: Unicode: \p{…}, \u{…}, an emoji is one character, strict syntax

Property: unicodeSets
What it does: like u, plus nested classes and -- / && (ES2024)

Property: sticky
What it does: match only at lastIndex, no scanning ahead

Property: hasIndices
What it does: start and end of every group (match.indices)

ECMAScript flags

Rule	Example	What is wrong
R1 · Nested quantifiers — risk of a freeze	(a+)+ (\w+\s?)*	The inner repetition can end an iteration exactly where the next outer iteration starts, so the text can be split in exponentially many ways. On a non-matching text the engine tries them all. Remove the nesting (a+ instead of (a+)+) or make the iteration boundary mandatory.
R2 · Overlapping alternatives under repetition — risk of a freeze	(a\|a)* (\w\|\d)+	Two alternatives match the same character and the group repeats, so each character can go either way — 2^n options. Merge them into one class ([\w] instead of (\w\|\d)) or make them mutually exclusive.
R3 · Adjacent repetitions over the same characters — slow on long text	\d+\d+ ..	Two unbounded repetitions in a row share the same characters: on failure the engine tries every split point between them (polynomial growth, n² or worse). Keep one repetition or put a mandatory separator between them.

R1 · Nested quantifiers — risk of a freeze

Example: (a+)+ (\w+\s?)*
What is wrong: The inner repetition can end an iteration exactly where the next outer iteration starts, so the text can be split in exponentially many ways. On a non-matching text the engine tries them all. Remove the nesting (a+ instead of (a+)+) or make the iteration boundary mandatory.

R2 · Overlapping alternatives under repetition — risk of a freeze

Example: (a|a)* (\w|\d)+
What is wrong: Two alternatives match the same character and the group repeats, so each character can go either way — 2^n options. Merge them into one class ([\w] instead of (\w|\d)) or make them mutually exclusive.

R3 · Adjacent repetitions over the same characters — slow on long text

Example: \d+\d+ .*.*
What is wrong: Two unbounded repetitions in a row share the same characters: on failure the engine tries every split point between them (polynomial growth, n² or worse). Keep one repetition or put a mandatory separator between them.

Dangerous-shape rules

The heuristics look for classic shapes and do not prove safety: the timeout is what protects you. For server code that handles user input, choose linear-time engines (RE2) or limit the input length.

Pattern	What it does not check
Email (practical)	Catches typos, not whether the address exists. RFC 5322 allows more (quoted local parts, IP literals); Cyrillic domains need punycode first. The reliable check is a confirmation email.
URL http(s)	Only http and https with a domain name (no localhost or IP). To take a URL apart in code, new URL() is more reliable.
IPv4	Four numbers 0–255 without leading zeros. No mask (/24) or port.
IPv6	Full and compressed (::) forms. No zone index (%eth0) and no embedded IPv4 (::ffff:1.2.3.4).
UUID (RFC 9562)	Versions 1–8 and the RFC 9562 variant. The Nil and Max UUIDs (all zeros / all f) do not pass — add them separately if needed.
ISO 8601 date (YYYY-MM-DD)	Checks the format, not the calendar: 2026-02-31 passes. Check that the date exists in code.
ISO 8601 date-time	The RFC 3339 profile: a time zone is required (Z or ±HH:MM). Leap second 60 is not accepted.
Phone KZ/RU (+7)	The +7/8 format with 10 digits, spaces, brackets and hyphens. It does not check that the operator code exists; store numbers as +7XXXXXXXXXX.
IIN/BIN (12 digits, format only)	Only 12 digits. The check digit and the birth date inside an IIN are not verified — a regex cannot compute them; do it in code.
HEX colour	#RGB, #RGBA, #RRGGBB and #RRGGBBAA, as in CSS.
Slug (page address)	Lowercase Latin letters, digits and single hyphens between words.
SemVer 2.0.0	The official expression from semver.org: groups are major, minor, patch, pre-release, build.
JWT (shape)	Three base64url parts separated by dots — the shape only. The signature and expiry are checked by a JWT library on the server.

Email (practical)

What it does not check: Catches typos, not whether the address exists. RFC 5322 allows more (quoted local parts, IP literals); Cyrillic domains need punycode first. The reliable check is a confirmation email.

URL http(s)

What it does not check: Only http and https with a domain name (no localhost or IP). To take a URL apart in code, new URL() is more reliable.

IPv4

What it does not check: Four numbers 0–255 without leading zeros. No mask (/24) or port.

IPv6

What it does not check: Full and compressed (::) forms. No zone index (%eth0) and no embedded IPv4 (::ffff:1.2.3.4).

UUID (RFC 9562)

What it does not check: Versions 1–8 and the RFC 9562 variant. The Nil and Max UUIDs (all zeros / all f) do not pass — add them separately if needed.

ISO 8601 date (YYYY-MM-DD)

What it does not check: Checks the format, not the calendar: 2026-02-31 passes. Check that the date exists in code.

ISO 8601 date-time

What it does not check: The RFC 3339 profile: a time zone is required (Z or ±HH:MM). Leap second 60 is not accepted.

Phone KZ/RU (+7)

What it does not check: The +7/8 format with 10 digits, spaces, brackets and hyphens. It does not check that the operator code exists; store numbers as +7XXXXXXXXXX.

IIN/BIN (12 digits, format only)

What it does not check: Only 12 digits. The check digit and the birth date inside an IIN are not verified — a regex cannot compute them; do it in code.

HEX colour

What it does not check: #RGB, #RGBA, #RRGGBB and #RRGGBBAA, as in CSS.

Slug (page address)

What it does not check: Lowercase Latin letters, digits and single hyphens between words.

SemVer 2.0.0

What it does not check: The official expression from semver.org: groups are major, minor, patch, pre-release, build.

JWT (shape)

What it does not check: Three base64url parts separated by dots — the shape only. The signature and expiry are checked by a JWT library on the server.

Patterns and their caveats

Limitations

Behaviour is that of this browser’s engine: older browsers lack newer features (the v flag, modifiers), and another language may treat the same pattern differently — see the notes on the Code tab.
In-text highlighting covers up to 300 KB and 3,000 matches; the list shows up to 5,000 matches; text up to 5 MB.
The breakdown explains the syntax, not the intent: an “email-like” pattern does not guarantee a real address.
Patterns check the format, not the content: dates are not checked against the calendar, IIN/BIN against the check digit, JWT against the signature.

Privacy

The pattern and text are processed in your browser, in a background thread of this page; the text is never sent and the page address does not change. The pattern, flags and counts reach us only in a short summary if you attach it to a request yourself.
The pattern, flags, test cases and text up to 200 KB are kept in this browser only (localStorage); larger text lives only in the tab’s memory. “Reset all” deletes the data.
Analytics receives only the fact of copying or downloading code (the language) and the choice of a library pattern (its id) — never patterns or text.
The result reaches us only if you send a request yourself and keep the “Attach the result” box ticked — the form shows exactly what will be sent. Keys, passwords and tokens are never part of the summary.

Related tools

All tools · 40

Image compressor (WebP/AVIF)Drop images in — WebP, AVIF or JPEG by quality or a target size in KB, a 1:1 before/after slider, srcset and <picture>, batch ZIP. All in the browser.

Favicon and app icon generatorFrom an image, SVG or a letter → favicon.ico, favicon.svg with dark mode, PNGs in every size, apple-touch-icon, maskable, manifest and HTML; tab, iOS and Android previews — in one archive.

Link preview (Open Graph) checkerPaste HTML or fill in fields and see how a link looks in Telegram, WhatsApp, VK, Facebook, X, LinkedIn and Slack. Checks for og:image, text length and twitter:card, plus a ready <head> block.

JSON, YAML and CSV converterConvert between JSON, YAML and CSV with formatting, key sorting, syntax errors pinned to the exact spot, and a data tree.

Cron expression helperA cron expression ↔ plain language, the next runs in your time zone, a schedule builder and variants for Linux, Quartz, GitHub Actions and Kubernetes.

Base64, hashes, UUID and ULIDBase64/base64url, Base32, HEX, URL and HTML both ways, hashes of text and files of any size (SHA-256, SHA-3, BLAKE3, MD5, CRC-32), HMAC, checksum verification, generating and inspecting UUID v4/v7, ULID and NanoID.

Tell us about your task — we'll review your request and get back to you

Need data validation you can trust?

We design form and import checks on the client and server, with tests, and without fragile regexes where real parsing is needed. Scope and cost come after a brief.

The first short conversation is free — we choose the format
NDA — yours or ours
Pricing after a brief and an agreed scope

Message on WhatsApp