Why does my global regex skip every other match?

The g flag makes the RegExp object stateful via lastIndex, which persists between test() and exec() calls. Create the regex inside the loop, reset lastIndex to 0, or use matchAll() which handles the state for you.

Is a regex written here portable to Python or Go?

Often, but not always. Basic syntax is shared; lookbehind, named-group syntax and Unicode property escapes differ. Go's RE2 in particular has no backreferences or lookaround at all, by design.

What is catastrophic backtracking?

A pattern whose nested quantifiers force the engine to try exponentially many ways to match before failing. If user input reaches such a pattern, a single request can consume a CPU core indefinitely — the ReDoS vulnerability class.

Does the tester send my text anywhere?

No. The pattern and subject are evaluated by your browser's own regex engine. Nothing is transmitted, which also means results reflect your browser's JavaScript version.

Developer🔒 Browser (client-side)API available📴 Works offlineintermediate

Regex Tester

Tests a regular expression against sample text, showing matches live.

Data stays in your browser

Ready to runInstant execution

All tools →

Result

—

What does this tool do?

Tests a regular expression against sample text, showing matches live.

Why would I use it?

You are building a pattern for validation or search.
A regex works in one tool but not your code (flags, escaping).
You want to see match positions and groups.

Real-life example

Input

Pattern: w+@w+.w+  Text: "contact us at hello@example.com"

Output

1 match: hello@example.com

The tester shows each match and capture groups.

Input → Process → Output → Next

Input: Enter pattern, flags and test text.
Process: The browser evaluates the regex safely.
Output: Matches with positions, or an error for invalid patterns.
Next action: Refine the pattern until it matches exactly what you intend.

Common mistakes

Catastrophic backtracking with nested quantifiers (use atomic/possessive forms).
Forgetting to escape dots and slashes.
Testing only happy-path input — test edge cases too.

What the result means

A match confirms the pattern matches; zero matches means it does not (check flags).

Privacy & security

Your input is processed entirely in your browser and never sent to a YAS server.

API

Endpoint

POST https://yas.sh/api/v1/tools/regex-tester

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/regex-tester" \
  -H "Content-Type: application/json" \
  -d '{"pattern":"(\\w+)@(\\w+)","text":"hello there world","flags":"g"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/regex-tester", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "pattern": "(\\w+)@(\\w+)",
  "text": "hello there world",
  "flags": "g"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/regex-tester", json={"pattern":"(\\w+)@(\\w+)","text":"hello there world","flags":"g"})
data = r.json()

Field	Type	Required	Description
pattern	string	Yes	≤ 500 chars; nested-quantifier patterns rejected
text	string	Yes	Test string (≤ 10 KB)
flags	string	No (default "g")	Subset of d g i m s u v y

Success response

{ "slug": "regex-tester", "count": 2, "truncated": false, "result": [{ "match": "o t", "index": 4 }, ...] }

Test a regex against a string (ReDoS-guarded, max 100 matches).

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How Regex Tester works

The pattern is compiled into a JavaScript RegExp object and executed against the subject text with the flags you select. JavaScript uses a backtracking engine: alternatives are tried in order and the engine rewinds on failure. That gives features a finite automaton cannot offer — backreferences, lookbehind, capture groups — at the cost of worst-case exponential time on pathological patterns.

Flags change the semantics, not just the convenience. The g flag makes a regex stateful by advancing lastIndex between calls, which is why reusing a global regex in a loop appears to skip matches. The m flag makes ^ and $ match at line boundaries; s makes '.' match newlines; i is case-insensitive; u enables full Unicode code-point semantics and \p{...} property escapes.

Capture groups are what you extract. Numbered groups are counted by opening parenthesis, named groups (?<name>...) are readable and refactor-safe, and non-capturing groups (?:...) let you apply a quantifier to a sequence without adding it to the results. Lookaheads (?=...) and lookbehinds (?<=...) assert context without consuming characters.

When to use it: real-world scenarios

Building a validation pattern before shipping it

Test the pattern against both the values it must accept and the values it must reject. A pattern that only accepts is half tested; most validation bugs are false negatives on legitimate input, such as plus-addressed email or an apostrophe in a surname.

Extracting fields from unstructured logs

Named capture groups turn a log line into a record. Test against real lines including the awkward ones — multi-line stack traces, quoted fields containing spaces — before wiring the pattern into an ingestion pipeline.

Writing a safe find-and-replace across a codebase

Verify the match set before running the replacement. Checking what a pattern matches in a sample file is considerably cheaper than reverting a repository-wide substitution that also hit strings inside comments.

Reviewing a pattern for catastrophic backtracking

Nested quantifiers such as (a+)+ against a long non-matching string cause exponential blowup. If the tester hangs on a modest input, the pattern is a denial-of-service risk in any request path that applies it to user input.

Pro tips

Prefer named groups over numbered ones. Adding a parenthesis later renumbers every group after it and silently breaks downstream code.
Anchor validation patterns with ^ and $. Without anchors, /\d{4}/ happily matches four digits inside a much longer string of nonsense.
Escape the dot inside character classes only when you mean it: inside [ ] a dot is literal already, so [a.b] matches three characters, not 'any character'.
Never validate email addresses with an elaborate regex. RFC 5322 permits far more than any practical pattern allows; check for a single '@' with something either side, then send a confirmation message.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

Only JavaScript regex semantics are supported. PCRE, Python re, Go RE2 and Java differ on lookbehind support, possessive quantifiers, atomic groups and named-group syntax — a pattern that works here may not port unchanged.
Recursive patterns and subroutine calls (PCRE (?R)) do not exist in JavaScript and cannot be tested.
Catastrophic backtracking can freeze the tab, because the pattern runs on the main thread just as it would in your application.
Regex cannot parse nested structures. HTML, JSON and balanced parentheses need a parser; a pattern that appears to work will fail on the first nested case.

Frequently asked questions

Why does my global regex skip every other match?: The g flag makes the RegExp object stateful via lastIndex, which persists between test() and exec() calls. Create the regex inside the loop, reset lastIndex to 0, or use matchAll() which handles the state for you.
Is a regex written here portable to Python or Go?: Often, but not always. Basic syntax is shared; lookbehind, named-group syntax and Unicode property escapes differ. Go's RE2 in particular has no backreferences or lookaround at all, by design.
What is catastrophic backtracking?: A pattern whose nested quantifiers force the engine to try exponentially many ways to match before failing. If user input reaches such a pattern, a single request can consume a CPU core indefinitely — the ReDoS vulnerability class.
Does the tester send my text anywhere?: No. The pattern and subject are evaluated by your browser's own regex engine. Nothing is transmitted, which also means results reflect your browser's JavaScript version.

Related tools

Regex Escaper String Length