π§ͺ Regex Fuzzer
π Input Regex
π History
No history yet
What Can the Regex Fuzzer Do?
The Regex Fuzzer is a free online tool for developers that validates regular expression correctness and security by generating random matching strings and edge-case test inputs. It automatically detects ReDoS (Regular Expression Denial of Service) vulnerabilities, helping developers write safer, more robust regex patterns.
Core Features
- Random Match Generation: Auto-generate random strings matching the regex pattern
- ReDoS Detection: Analyze dangerous patterns and detect potential denial-of-service vulnerabilities
- Edge Case Testing: Auto-generate empty strings, extra-long strings, special characters, and more
- Custom Testing: Support manual input of test strings for validation
- Match Highlighting: Highlight matched portions in test results
- Performance Timing: Measure matching time for each test string
How to Use
1. Enter a regular expression in the input field, e.g. ^(a+)+$
2. Select regex flags and generation count
3. Click "Fuzz Test" for a full test, or individually click "Generate Matches" / "ReDoS Check"
4. View results: match statistics, ReDoS risk, generated matching strings
5. Enter specific strings in the custom test area for validation
6. Use Ctrl+Enter as a shortcut to run tests quickly
Use Cases
Case 1: Security Auditing
Security engineers use this tool during code audits to check if user-submitted regex patterns pose ReDoS risks, preventing malicious users from submitting dangerous patterns that could crash services.
Case 2: Regex Debugging
Developers writing complex regexes use fuzz testing to discover unexpected matches or missed matches, ensuring regex behavior matches expectations.
Case 3: Unit Testing
Test engineers use generated matching strings as unit test data, covering various edge cases of regular expressions.
Case 4: Teaching & Demos
Instructors teaching regex security use this tool to visually demonstrate ReDoS attack principles and how to identify dangerous patterns.
Extended Knowledge
ReDoS is a common web security vulnerability that exploits regex engine backtracking. When a regex contains nested quantifiers (like (a+)+) or alternation groups (like (a|a)+), certain inputs can cause exponential backtracking. Defense methods include: avoiding nested quantifiers, using atomic groups, setting match timeouts, and using non-backtracking engines. This tool uses both static analysis and dynamic testing for dual detection, helping developers identify and fix ReDoS risks.
β What is regex fuzzing?
Regex fuzzing is a technique that tests regular expressions by generating random or edge-case input strings, helping discover unexpected matches, missed matches, and ReDoS security vulnerabilities.
β What is a ReDoS vulnerability?
ReDoS (Regular Expression Denial of Service) is an attack that exploits regex backtracking by crafting special inputs that cause exponential matching time, exhausting server CPU resources.
β How does ReDoS detection work?
The tool analyzes dangerous patterns like nested quantifiers and alternation groups in the regex, and uses timeout mechanisms to test actual matching time β dual detection for ReDoS risk.
β What are generated matching strings used for?
Generated matching strings can verify that a regex correctly matches expected formats, test edge cases, and serve as test data for unit tests.
β Which regex flags are supported?
All JavaScript regex flags: g (global), i (case-insensitive), m (multiline), s (dotAll), u (Unicode), y (sticky).
β Is my data uploaded to a server?
No. All testing logic runs locally in your browser. Your regex patterns and test data never leave your device.
β Can I batch test multiple regexes?
Yes. You can paste multiple regex patterns (one per line) in the input area, and the tool will test each one and aggregate results.