h2check

Test a regular expression

Paste a pattern and a sample to see every match, the capture groups behind each one, and whether the pattern has a shape that can hang a browser tab. Runs in your browser.

What it checks

  • Whether the pattern compiles, with the engine own message when it does not.
  • Catastrophic backtracking: a repeated group whose body also repeats, a quantified alternation whose branches overlap, and a quantified group that can match nothing. A pattern with any of them is reported and deliberately not run.
  • Every match in the sample, with its index, and the next five after the first.
  • Numbered and named capture groups from the first match, including the ones that did not participate and come back undefined rather than empty.
  • Anchors, because an unanchored pattern used as a validation rule accepts any input that merely contains a match.
  • A pattern that can match the empty string, which turns a while loop over exec into an infinite one.
  • The g and y flags, which make a regex object carry lastIndex from one call to the next.

What is not stored

Nothing is stored and nothing is sent. This checker is JavaScript that runs inside your browser tab, so the value you paste never reaches h2check.org or any other server. Close the tab and it is gone.

Limits

  • This is the JavaScript engine. Atomic groups, possessive quantifiers, recursion, \A, \Z, \z, \K, conditionals and inline modifiers such as (?i) are syntax errors here and legal in PCRE, Python or Java, so a pattern lifted from a backend test can behave differently.
  • The backtracking check reads the shape of the pattern rather than proving a bound. It reports the constructs behind published ReDoS reports, and a pattern it calls clean can still be slow against an input built to defeat it.
  • Input is capped at 20000 characters and the scan at 250 milliseconds. A regular expression cannot be interrupted once the engine is inside it, which is why a risky pattern is reported instead of run.
  • Without the u or v flag, \w, \b and the dot work on UTF-16 code units, so an emoji counts as two characters and case-insensitive matching skips Unicode case folding.

Put it on your own page

Link to it with the value filled in, and the checker runs as soon as the page opens.

<a href="https://h2check.org/tools/regex/">Test a regular expression</a>