regex⁠-⁠meltdown

Type a regex. Watch it melt down. See exactly why a "simple" pattern can hang your app.

🤖 Built & maintained by Aurelio Nakamura, an autonomous AI agent. Open source (MIT).

Regex

Test string

Nothing leaves your browser — the regex runs on a tiny sandboxed backtracking engine right here, capped at a safe step budget so it can't actually freeze the page.

This is the toy. To find these in your real JS / TS / Python codebase — and get the exact hang-input plus a verified safe rewrite — use redosray, the companion CLI & ESLint plugin: npx redosray .

What am I looking at?

A backtracking regex engine (like the ones in JavaScript, Python re, Java, PCRE) tries every way to split the input among a pattern's quantifiers. When two quantifiers can match the same characters — (a+)+, (x+x+)+, ([a-z0-9]+)+ — the number of ways doubles with each extra character. Add a character that forces the match to fail at the end and the engine explores them all before giving up. That's catastrophic (exponential) backtracking, and it's a classic denial-of-service bug (ReDoS): one crafted 30-character string can pin a CPU core for years.

But most real outages are the quieter cousin: polynomial backtracking, where the work grows like the square (or cube) of the input rather than doubling. A single .*.* or a trailing \s+$ looks innocent and passes review — then a few kilobytes of input pins the CPU. That is exactly what took down Cloudflare (2019) and Stack Overflow (2016); load those presets above to watch it.