What is catastrophic backtracking?

It occurs when a regular expression engine evaluates a complex pattern against a near-miss string, causing execution time to grow exponentially and potentially crashing the application.

How does the scanner generate evil inputs?

It analyzes the regex structure to craft specific near-miss strings designed to trigger worst-case backtracking scenarios up to your specified maximum length.

Do I need to include slashes in my regex?

No, paste the raw pattern without the surrounding forward slashes (e.g., (a+)+$ instead of /(a+)+$/).

What do the simulation runs do?

The simulation runs dictate how many times the regex engine attempts to match the generated evil input, providing a reliable benchmark for execution time.

Can this tool fix my vulnerable regex automatically?

The tool provides a safer rewrite suggestion in its JSON output, but you should always test the suggested pattern to ensure it meets your specific validation requirements.

Elysia Tools

Navigation

Security

ReDoS (Regular Expression Denial of Service) Scanner

Scan one or more regex patterns for catastrophic backtracking risk, simulate evil inputs, and suggest safer rewrites

Details

What this tool helps you do

Paste one regular expression per line and optionally set flags, maximum evil-input length, and simulation runs. The scanner uses both static heuristics and near-miss input simulation to estimate whether the pattern can degrade toward catastrophic backtracking.

How to use it:

Regex List: one pattern per line, without surrounding slashes
Flags: optional JavaScript regex flags such as i, m, or u
Max Evil Input Length: longest generated near-miss attack string
Simulation Runs: how many repeated match attempts to use during benchmarking

What it reports:

static anti-pattern findings
worst simulated near-miss execution time
a risk score and risk level
a safer rewrite suggestion

Execution

Run this tool

Fill in the form, run the tool, and review the result in one place.

Result

Ready for a run

Run the tool to preview files, text, structured data, or streamed output here.

Samples

ReDoS (Regular Expression Denial of Service) Scanner

What this tool helps you do

Run this tool

Prepared example runs

Inputs

Result

Examples that match this tool

Continue with connected tools and hubs

Prepared example runs

Inputs

Result

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Overview

When to use

How it works

Use cases

Examples

1. Evaluating a login validation regex

2. Auditing legacy text parsing scripts

FAQ

Risky Regex Patterns

Regex Replace Samples

Common Regex Patterns

Android String Processing Java Samples

Regex Cheat Sheet

Regex Debugger

Regex Railroad Diagram Visualizer

Text File Replacer

Regex Testing, Visualization, and Pattern Debugging Tools