⌘ K
redos · static + adversarial · local

Spot regex vulnerable to catastrophic backtracking

Detect nested quantifiers and overlapping alternations, then confirm with an in-browser adversarial timing test. Runs locally.

ReDoS Detector
Findings
1
worst high
Severity
high
max
Test
—
click run
Status
ok
input · regex pattern
//
Heuristics scan as you type. Click the toolbar button to confirm with a timing test.
output · findings + timing
Heuristic findings
HIGH@0Nested quantifier — possible catastrophic backtracking
Heuristics are best-effort. A clean report does not guarantee safety.
Quick Start

How to spot a vulnerable regex

Look for catastrophic-backtracking risks like (a+)+ and confirm with an adversarial timing test — all in your browser.

  1. 01

    Paste pattern

    Type or paste any JavaScript regex. The static heuristics run as you type.

    Patterns compile through the JavaScript RegExp constructor, so syntax errors surface immediately and engine quirks like Unicode property escapes (\p{L}) work when the u flag is on.

    patternECMAScriptliterallive
    input · literalregex · regex
    (a+)+$
    loaded · ECMAScriptPCRE · ready
  2. 02

    Read findings

    Each finding lists severity, position, and reason. Nested quantifiers earn HIGH.

    Each flag character mirrors the ECMAScript literal: g enables iteration, i folds case, m anchors per line, s lets . match newlines, u unlocks proper Unicode, y is sticky, and d emits indices.

    flagsoptionsg · i · mlive
    config · optionsscan · flags
    [HIGH] @0 nested quantifier
    flags applied · liveECMA · live
  3. 03

    Adversarial test

    Click Run to test the pattern against "a"×50,000 + "X". Over 100ms is the red flag.

    Watch for catastrophic backtracking on nested quantifiers — a common ReDoS source. The tool caps match counts to keep the page responsive on pathological patterns.

    matchgroupshighlightReDoS-safe
    run · outputms · matches
    12,800 ms — vulnerable
    matches · livegroups · live
  4. 04

    Copy or export

    Grab the output as JSON, CSV, or plain text — ready for your editor or pipeline.

    Copy writes via navigator.clipboard.writeText; downloads use a Blob and object URL, so nothing transits the network and the output is byte-identical to what you see on screen.

    copyexportclipboardblob
    export · exportedready · saved
    Copied
    ready to shipsuccess
Pro tips

Regex patterns that don't melt down

Use named groups

(?<year>\d{4}) reads better than $1 and survives reordering. Supported in ECMAScript 2018+.

Anchor strictly

Use ^/$ with the m flag when matching whole lines. Without anchors, partial matches sneak through.

Avoid catastrophic backtracking

Nested quantifiers like (a+)+ can explode. Run patterns through ReDoS Detector first.

Escape every literal

Backslash any meta character you want literally: \.\$\^\*\+\?\(\)\[\]\{\}\|\\.

Test edge cases

Empty string, single character, unicode, the maximum length you expect — write fixtures for each.

Patterns aren&rsquo;t parsers

Don’t parse HTML, JSON, or balanced parens with regex. Use a proper parser when the grammar is recursive.

Related toolsRegex Performance BenchmarkRegex DebuggerRegex TesterRegex SimplifierRegex ExplainerRegex Diff
Use Cases

When to reach for the detector

Audit regex security before users find the bug.

Audit user input regex

Find dangerous patterns in form validators before users do. Compiles through the JavaScript RegExp constructor — engine quirks (Unicode property escapes, sticky matching, named groups) work when their flags are on. Error messages cite the exact position of any syntax issue.

ReDoS-safe

Review PRs

Block ReDoS-prone patterns at code review time. Pairs with the ReDoS detector to catch catastrophic backtracking before you deploy. A pattern that handles 1k-character input fine can become a denial-of-service vector on attacker-controlled 1M-character input.

ECMA-compliant

Fix legacy

Sweep an old codebase for slow patterns and rewrite them. Output exports as JavaScript, Python re, Java util.regex, .NET System.Text.RegularExpressions, PCRE, and POSIX — language quirks are highlighted on conversion so you don't ship a JS-only pattern to a Go service.

spec-grade

Education

Show what catastrophic backtracking looks like in numbers. Capture groups (named or numbered) round-trip cleanly into replacement strings, JSON output, or CSV extraction without re-typing. Backreferences ($1, ${name}) preserve semantics across languages.

cross-engine

Confirm a fix

After rewriting, re-run the test to verify it's under 100ms. Test against edge cases — empty input, single character, max length, multibyte boundaries — to catch off-by-one and zero-length match bugs before they reach production.

test-ready

Document risk

Copy the report into a security ticket or postmortem. All matching runs client-side so secret patterns never leave the browser. Useful when the pattern itself is sensitive (PII regexes, internal data formats, security filters).

production-ready
FAQ

Frequently asked questions

No — it's a heuristic. A clean report does not guarantee safety. Always run the adversarial timing test.
When a regex engine retries an exponential number of paths trying to match — a single short string can hang a server.
Vulnerable patterns typically blow up well past that. Safe patterns finish in single-digit milliseconds.
The fixed adversarial input matches most ReDoS classes. Inspect findings then test with your own data outside the tool if needed.
Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

Sent straight to the maintainers · no account needed
47 in queue·8 shipped this month
Request queued. Thanks!