Regex ReDoS Detector
Scan regular expressions for ReDoS vulnerabilities. Detects nested quantifiers, overlapping alternations, and evil patterns with a safety score. 100% in-browser, no data sent to a server.
Loading tool...
What is Regex ReDoS Detector?
The Regex ReDoS Detector is a client-side security tool that scans regular expressions for patterns prone to catastrophic backtracking (ReDoS). It compiles your pattern, checks it against known dangerous shapes such as nested quantifiers and overlapping alternations, assigns a safety score, and lets you test it against sample input — all without sending data to a server.
Key Benefits
- Catch ReDoS vulnerabilities before they reach production
- Understand exactly why a pattern is dangerous with plain-language explanations
- Get a quick safety score to triage multiple regexes
- Learn the common evil-regex shapes from built-in examples
- Test match behavior and security in the same view
Common Use Cases
- •Auditing regexes in input validation, routing, and search features before release
- •Reviewing third-party or AI-generated patterns for security before pasting them in
- •Teaching developers how nested quantifiers cause exponential backtracking
- •Quick sanity check on a regex from a Stack Overflow answer or tutorial
How to Use the Regex ReDoS Detector
- Enter your pattern: Paste or type a regular expression into the input box. Do not include the surrounding slashes.
- Review the safety score: The tool compiles the regex and assigns a score from 0 to 100 with a Safe, Caution, or Danger label.
- Read the issue list: Each detected risk (nested quantifier, overlapping class, etc.) is listed with its location and an explanation.
- Test with a sample string: Optionally enter a test string to verify whether the pattern matches and confirm expected behavior.
Key Features
- Detects nested quantifiers like (a+)+ that cause exponential backtracking
- Flags overlapping alternations and adjacent quantified character classes
- Safety score from 0 to 100 with Safe / Caution / Danger severity levels
- One-click evil-regex examples to learn the dangerous shapes
- Optional test string to verify match behavior alongside the audit
- 100% client-side — patterns never leave your browser