# Regex Tester

A live regex playground, with a library of common DFIR patterns.

A regex tester earns its keep in two places: hunting a raw log paste for a known shape before you reach for a real extractor, and checking a pattern before it ships in a detection rule.

## How to read it

Add one or more patterns, or pick one from the library, and paste test text. Matches are marked in place and listed with their index and groups.

It runs on JavaScript's own RegExp engine, the same one the Sigma tester uses for the |re modifier. A pattern that works here behaves the same way in a rule there. PCRE-only syntax, such as possessive quantifiers, will not work.

The library patterns are general heuristics, not perfect grammars. The Base64 pattern, for example, cannot tell a real blob from a long run of letters.

## Related

- [Sigma Tester](https://www.cyberkit.win/tools/sigma-tester/)
- [Regex Cheat Sheet](https://www.cyberkit.win/reference/regex-cheatsheet/)
- [RegEx Range](https://www.cyberkit.win/drills/regex/)

Canonical: https://www.cyberkit.win/tools/regex-tester/

This runs in the browser. Nothing you enter is uploaded.