ReDoS / Catastrophic Backtracking Checker
Detect regex patterns vulnerable to exponential backtracking (ReDoS) before they crash.
What is ReDoS Checker?
ReDoS (Regular Expression Denial of Service) attacks exploit regex patterns that cause exponential backtracking on crafted inputs — freezing browsers or crashing servers. This checker identifies dangerous patterns.
How it works
We statically analyze the regex for known dangerous patterns (nested quantifiers like (a+)+$, overlapping alternations, unanchored greedy stars) and optionally run a time-bounded match test to detect catastrophic backtracking live.
- Enter your input. Type or paste your input into the field above — the tool responds instantly.
- Review the result. Output updates live as you type. Everything runs entirely in your browser.
- Copy or download. Use the Copy button to grab the result, or Download to save it as a file.
Examples
Auditing for ReDoS
Scan a pattern for catastrophic-backtracking risk — nested quantifiers like (a+)+ are the usual culprit.
Common mistakes
Heuristic results
Risk detection is a heuristic — a clean report reduces risk but isn't a formal proof of safety.
Frequently asked questions
What patterns are most dangerous?
Nested quantifiers like (a+)+ or (a*)*, alternations with shared prefixes (a|ab|abc), and unanchored patterns with optional groups are the most common sources of catastrophic backtracking.
Can this prevent all ReDoS issues?
It catches the most common patterns but can't guarantee safety for all possible inputs. Use it as a first-pass linting step, not a formal verification.