Balou Tools

🔍 Regex Tester & Debugger

Create and test regular expressions in real time. With interactive cheat sheet, real-time ReDoS protection, and example database. Everything runs 100% locally.

Regex Configurator

/ /
gim
Static analysis
Pattern complexity & ReDoS risk
10 /100

The pattern looks statically unobtrusive. Runtime timeouts still matter for very large inputs.

Quantifiers: 3 Nested: 0 Alternations: 0 Backrefs: 0
Large repeat range

A {n,m} quantifier allows many repetitions or has no upper bound.

Set domain-specific upper bounds and prefer streaming/parser-based validation for large data.

Test Text

0 matches found
Match Preview:
Hallo! Bitte kontaktiere uns unter support@balou-tools.ch oder info@example.com für weitere Fragen.
Email Address Validation

Standard validation for email addresses (RFC 5322).

[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}
URL / Link Validation

Searches web links with http or https protocol.

https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*)
IPv4 Address Validation

Validates IPv4 network addresses (0.0.0.0 to 255.255.255.255).

(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)
IPv6 Address Validation

Checks for standard IPv6 address patterns.

((?:[0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?:(?::[0-9a-fA-F]{1,4}){1,6})|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:))
Phone Number (Int.) Validation

International phone numbers with optional area codes.

\+?[0-9]{1,4}[\s.-]?[0-9]{2,4}[\s.-]?[0-9]{2,4}[\s.-]?[0-9]{2,4}
Date (ISO: YYYY-MM-DD) Validation

ISO 8601 date format for databases.

\d{4}-\d{2}-\d{2}
Date (DE/CH: DD.MM.YYYY) Validation

Standard date format for German-speaking regions.

\b(?:0?[1-9]|[12][0-9]|3[01])\.(?:0?[1-9]|1[0-2])\.(?:19|20)?\d{2}\b
Time (24h HH:MM) Validation

Valid 24-hour time (00:00 to 23:59).

\b(?:[01]?\d|2[0-3]):[0-5]\d\b
Postal Code (CH / DE) Validation

4-digit (CH) or 5-digit (DE) postal codes.

\b\d{4,5}\b
Monetary Amount (CHF / EUR) Formatting

Currency amounts with decimal separator and currency symbol.

(?:€|EUR|CHF|\$)\s?\d+(?:[.,]\d{2})?|\d+(?:[.,]\d{2})?\s?(?:€|EUR|CHF|\$)
Secure Password Validation

Min 8 chars, 1 uppercase, 1 lowercase, 1 number, 1 special character.

^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$
Hex Color Code Formatting

Color codes in web hex format (#3- or #6-digit).

#(?:[0-9a-fA-F]{3}){1,2}\b
Extract HTML Tags Extraction

Finds opening or closing HTML tags.

<\/?[a-zA-Z0-9]+(?:\s+[a-zA-Z0-9-]+(?:=(?:"[^"]*"|'[^']*'|[^\s>]+))?)*\s*\/?>
Letters Only (A-Z, Umlauts) Extraction

Finds pure letter blocks (including German umlauts).

[a-zA-ZäöüÄÖÜß]+
Integers Extraction

Finds pure numbers (with optional sign).

-?\b\d+\b
Decimals Extraction

Decimal numbers with dot or comma separation.

-?\b\d+[.,]\d+\b
Credit Card (VISA/Mastercard) Validation

16-digit credit card numbers (with/without hyphens).

\b(?:\d{4}[-\s]?){3}\d{4}\b
MAC Address Validation

Network MAC addresses (separated by colons/hyphens).

\b(?:[0-9a-fA-F]{2}[:-]){5}[0-9a-fA-F]{2}\b
Leading/Trailing Whitespace Formatting

Finds whitespace at the start or end of lines.

^\s+|\s+$
Username (Alphanumeric) Validation

3 to 16 characters, allows letters, numbers, _ and -.

^[a-zA-Z0-9_-]{3,16}$
UUID v4 Validation

Universally Unique Identifier (version 4).

[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}
JWT (JSON Web Token) Validation

Detects three-part JWTs (header.payload.signature).

eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+
Slug (URL-friendly) Validation

Lowercase letters, numbers and hyphens – e.g. for SEO URLs.

^[a-z0-9]+(?:-[a-z0-9]+)*$
Semantic Version (SemVer) Extraction

Version numbers following the SemVer standard (major.minor.patch).

\bv?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?\b
Domain / Hostname Validation

Valid domain names without protocol.

\b(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}\b
Markdown link (named groups) Extraction

Extracts text and URL via named groups (?<text>) and (?<url>).

\[(?<text>[^\]]+)\]\((?<url>[^)]+)\)
Hashtag Extraction

Social media hashtags including underscore.

#[A-Za-z0-9_]+
Duplicate words (backreference) Extraction

Finds accidentally repeated words via backreference \1.

\b(\w+)\s+\1\b
IBAN (Switzerland) Validation

Swiss IBAN (CH + 19 digits, grouped).

\bCH\d{2}\s?(?:\d{4}\s?){4}\d\b
Emoji (Unicode, flag u) Extraction

Finds emojis – requires the u flag.

\p{Emoji_Presentation}

Guide & best practices

Regex Tester with debugger and ReDoS analysis

Build safer regular expressions with live matches, capture groups, examples, replace mode, token explanations and complexity scoring.

Typical use cases

Use it for validation, extraction, log parsing, pattern refactoring, ReDoS reviews and learning regex tokens.

How Balou debugs regexes

Execution runs in a browser worker with timeout. Balou also statically checks nested quantifiers, alternations and backreferences.

Best practices against ReDoS

Limit input length, avoid constructs like (.*)+, prefer concrete character classes and test worst-case inputs.

Frequently asked questions

What is ReDoS?

Denial of service caused by very slow regex backtracking on crafted input.

Does test text stay local?

Yes, the tester runs in the browser; AI explanations require explicit action.

Why show warnings if matching works?

A pattern can match correctly but become exponentially slow on different input.

Which features are explained?

Tokens, groups, lookarounds, classes, quantifiers, flags and language differences.