Regex Debugger & Explainer (JavaScript vs Python, ReDoS Check)

About the Regex Debugger & Explainer (JavaScript vs Python, ReDoS Check)

Debug a regular expression in two real engines at once. Your browser’s own JavaScript engine matches as you type, and one press runs the same pattern in CPython’s re module, so you see whether JavaScript and Python agree on your text and, if not, why. A pattern written for one engine runs in the other in that engine’s spelling: (?P<name>…) becomes (?<name>…), \A and \Z are rewritten, comments and verbose spacing are removed, and the page shows the exact pattern each engine ran.

Around the matches the page explains the pattern token by token, lists where the two engines read it differently, and checks it for catastrophic backtracking (ReDoS): nested or overlapping quantifiers are named, and the step debugger counts the steps on growing inputs to prove the slowdown. With the full result you also get a railroad diagram, a step-by-step replay of every attempt and backtrack, tests that must or must not match, and a complete program for JavaScript, Python, PHP, Java, Go, C# or Rust. The free preview shows the matches in both engines and the first lines of the explanation; copying or downloading a program needs a Pro pass or an unlock.

Common uses

• Porting a pattern between a JavaScript front end and a Python back end, and proving both accept the same inputs.
• Reviewing a validation pattern for ReDoS before it reaches production code that handles untrusted input.
• Understanding a pattern someone else wrote, token by token.
• Keeping a list of strings that must and must not match next to the pattern, and re-checking them after every change.
• Getting a ready-to-run program for Java, Go, C#, Rust or PHP, with a warning wherever that engine will not accept the pattern.

Where JavaScript and Python differ

• \d, \w and \b: ASCII only in JavaScript; any Unicode digit and letter in Python (unless re.ASCII).
• \s: Unicode spaces in both, but JavaScript’s also matches U+FEFF (the byte order mark) and Python’s also U+001C to U+001F and U+0085.
• $ without the multiline flag: JavaScript matches only at the very end; Python also just before a final newline.
• The dot: JavaScript’s refuses \n, \r, U+2028 and U+2029; Python’s refuses only \n.
• Named groups: (?<name>…) and \k<name> in JavaScript, (?P<name>…) and (?P=name) in Python.
• Lookbehind: any length in JavaScript; fixed width in Python.
• Atomic groups (?>…) and possessive quantifiers *+: Python 3.11 and later; not in JavaScript.
• \p{…} Unicode properties and the v flag’s set operations: JavaScript only (Python’s third-party regex module has properties).

How the ReDoS check works

Both engines are backtracking engines: when a match fails they go back and try every other way to split the text between the quantifiers. A quantifier around something that can itself repeat ((a+)+, (\w+\s?)*), alternatives under a quantifier that can match the same characters ((a|ab)*) and two loops in a row over the same characters (\d+\d+) can make that number of ways grow exponentially or polynomially with the input. A loop inside a repeated group is not flagged when a delimiter it cannot match ends every round ((\d+,)*, (?:-[a-z0-9]+)*), because its text then cannot move into the next round.

The page finds these shapes in the pattern’s tree, then builds an input from the repeated character followed by one that cannot match, and counts the steps the step debugger needs as the input grows: a count that multiplies with each few extra characters is the proof. A shape the count does not confirm on those inputs is called a possible risk, not a high one, since a different input may still be slow.

The programs for other languages

The program for each language holds your pattern in that language’s syntax, your flags and the first 2,000 characters of your test text, and prints every match with its position and groups. Positions count UTF-16 units in JavaScript, Java and C#, code points in Python, and bytes in PHP, Go and Rust. Where an engine will not accept the pattern (Go and Rust have no lookaround or backreferences, .NET no possessive quantifiers, Java needs a bounded lookbehind), or reads it differently ($, \d, \s, the dot), a note under the language says so. The programs were run in each language to check that they compile and find the same matches.

Sources

• ECMAScript: RegExp objects and MDN: regular expressions
• Python: the re module
• Java: java.util.regex.Pattern
• .NET: regular expression language
• PCRE2: pattern syntax
• Go: regexp/syntax
• Rust: the regex crate
• OWASP: Regular expression Denial of Service

Limitations

• Two engines run here: your browser’s JavaScript engine and CPython’s re module. For PHP, Java, Go, C# and Rust the page writes the program and warns what will not compile, but does not run it.
• The step debugger follows JavaScript’s engine on the first match within the first 5,000 characters (fewer when a loop runs over a very long stretch of text; the page then says how many); it does not model lookbehind, atomic groups, possessive quantifiers, Unicode properties or v-mode sets, and then shows only the real engine’s matches.
• Python here is the standard re module, not the third-party regex module. Conditional groups such as (?(1)…|…) are not parsed.
• JavaScript syntax the explainer does not read (duplicate named groups in different alternatives, v-mode \q{…} string literals) still runs in the browser’s engine, but without the explanation, step debugger, ReDoS check, Python comparison and programs.
• Python runs on the first 50,000 characters of the text and lists up to 1,000 matches; JavaScript lists up to 1,000 matches too.
• A pattern that runs longer than 3 seconds in JavaScript (15 in Python) is stopped and reported as catastrophic backtracking.

Privacy

On this device; its files download once

Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot. JavaScript matching needs nothing. The first time you run a pattern in Python, Python itself (about 13.5 MB: the CPython interpreter and its standard library, compiled to WebAssembly) is downloaded from a separate, isolated MySmartCoPilot address; your browser keeps it for later visits. Your pattern and text are handed to it inside your browser and never uploaded.