📝 Input Regex
📋 History
No history yet
No history yet
The Regex Fuzzer is a free online tool for developers that validates regular expression correctness and security by generating random matching strings and edge-case test inputs. It automatically detects ReDoS (Regular Expression Denial of Service) vulnerabilities, helping developers write safer, more robust regex patterns.
1. Enter a regular expression in the input field, e.g. ^(a+)+$
2. Select regex flags and generation count
3. Click "Fuzz Test" for a full test, or individually click "Generate Matches" / "ReDoS Check"
4. View results: match statistics, ReDoS risk, generated matching strings
5. Enter specific strings in the custom test area for validation
6. Use Ctrl+Enter as a shortcut to run tests quickly
Security engineers use this tool during code audits to check if user-submitted regex patterns pose ReDoS risks, preventing malicious users from submitting dangerous patterns that could crash services.
Developers writing complex regexes use fuzz testing to discover unexpected matches or missed matches, ensuring regex behavior matches expectations.
Test engineers use generated matching strings as unit test data, covering various edge cases of regular expressions.
Instructors teaching regex security use this tool to visually demonstrate ReDoS attack principles and how to identify dangerous patterns.
ReDoS is a common web security vulnerability that exploits regex engine backtracking. When a regex contains nested quantifiers (like (a+)+) or alternation groups (like (a|a)+), certain inputs can cause exponential backtracking. Defense methods include: avoiding nested quantifiers, using atomic groups, setting match timeouts, and using non-backtracking engines. This tool uses both static analysis and dynamic testing for dual detection, helping developers identify and fix ReDoS risks.
Regex fuzzing is a technique that tests regular expressions by generating random or edge-case input strings, helping discover unexpected matches, missed matches, and ReDoS security vulnerabilities.
ReDoS (Regular Expression Denial of Service) is an attack that exploits regex backtracking by crafting special inputs that cause exponential matching time, exhausting server CPU resources.
The tool analyzes dangerous patterns like nested quantifiers and alternation groups in the regex, and uses timeout mechanisms to test actual matching time — dual detection for ReDoS risk.
Generated matching strings can verify that a regex correctly matches expected formats, test edge cases, and serve as test data for unit tests.
All JavaScript regex flags: g (global), i (case-insensitive), m (multiline), s (dotAll), u (Unicode), y (sticky).
No. All testing logic runs locally in your browser. Your regex patterns and test data never leave your device.
Yes. You can paste multiple regex patterns (one per line) in the input area, and the tool will test each one and aggregate results.