Regex Tester

• RegExp Object: The native JavaScript `RegExp` class is used to compile the patterns. Flags like g (global), i (case-insensitive), and m (multiline) modify the state machine behavior.
• String.prototype.matchAll(): Used to extract all matches along with their indices and capture groups, enabling the rich UI highlighting you see above.

Regex can be a severe security vulnerability known as Regular Expression Denial of Service (ReDoS).

• Catastrophic Backtracking: Patterns like ^(a+)+$ applied to the string "aaaaX" will cause the regex engine to try every possible grouping combination before failing, leading to O(2^N) time complexity.
• Mitigation: Never execute user-supplied regex on a backend server without a strict timeout or using a safe engine (like RE2) that guarantees O(N) complexity by dropping backreferences.

A well-written regex executes in O(N) time where N is the length of the string.

However, heavy use of lookaheads (?=...), lookbehinds (?<=...), and nested quantifiers can degrade performance to polynomial or exponential time. In JavaScript, regex evaluation blocks the main thread.

• ECMAScript Regex: This tool uses the JS flavor of regex. It lacks some features found in PCRE (PHP/Perl) or .NET, such as atomic groups.
• Unicode Property Escapes: The tool supports the unicode u flag, allowing patterns like \p{Emoji}.

Regex bugs are notoriously difficult to spot:

• Greedy vs Lazy: .* will match as much as possible. If you want it to stop at the first match, you must use .*?.
• Escaping: Forgetting to escape special characters like . (which matches any character) when you actually meant a literal dot.