Regex Tester
A live regex playground, with a library of common DFIR patterns.
A regex tester earns its keep in two places: hunting a raw log paste for a known shape before you reach for a real extractor, and checking a pattern before it ships in a detection rule.
This runs in your browser. Nothing you type or open is uploaded.
How to read it
Add one or more patterns, or pick one from the library, and paste test text. Matches are marked in place and listed with their index and groups.
It runs on JavaScript's own RegExp engine, the same one the Sigma tester uses for the |re modifier. A pattern that works here behaves the same way in a rule there. PCRE-only syntax, such as possessive quantifiers, will not work.
The library patterns are general heuristics, not perfect grammars. The Base64 pattern, for example, cannot tell a real blob from a long run of letters.
| Pattern | Regex | Notes |
|---|---|---|
| IPv4 Address | \b(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\b | Four dot-separated octets, each range-checked to 0-255 (so it skips out-of-range values like 999.999.999.999). |
| IPv6 Address | (?<![\w:])(?:(?:[A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,7}:|(?:[A-Fa-f0-9]{1,4}:){1,6}:[A-Fa-f0-9]{1,4}|(?:[A-Fa-f0-9]{1,4}:){1,5}(?::[A-Fa-f0-9]{1,4}){1,2}|(?:[A-Fa-f0-9]{1,4}:){1,4}(?::[A-Fa-f0-9]{1,4}){1,3}|(?:[A-Fa-f0-9]{1,4}:){1,3}(?::[A-Fa-f0-9]{1,4}){1,4}|(?:[A-Fa-f0-9]{1,4}:){1,2}(?::[A-Fa-f0-9]{1,4}){1,5}|[A-Fa-f0-9]{1,4}:(?:(?::[A-Fa-f0-9]{1,4}){1,6})|:(?:(?::[A-Fa-f0-9]{1,4}){1,7}|:))(?![\w:]) | Covers full, compressed ("::"), and leading/trailing-compressed IPv6 forms. |
| Windows SID | \bS-1-5-\d+(?:-\d+)*\b | NT Authority security identifiers in S-1-5-… form. From a bare well-known SID (S-1-5-18) to a full domain-relative SID. |
| GUID / UUID | \{?[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\}? | The canonical 8-4-4-4-12 hex-group form, with or without the curly braces Windows wraps around device-class and COM GUIDs. |
| Windows File Path | [A-Za-z]:\\(?:[^\\/:*?"<>|\r\n]+\\)*[^\\/:*?"<>|\r\n]+ | A drive letter and backslash-separated path (e.g. C:\Users\...), excluding characters Windows disallows in file names. |
| Registry Key Path | \b(?:HKEY_LOCAL_MACHINE|HKEY_CURRENT_USER|HKEY_CLASSES_ROOT|HKEY_USERS|HKEY_CURRENT_CONFIG|HKLM|HKCU|HKCR|HKU|HKCC)\b(?:\\[^\\\r\n]+)* | A registry hive (full name or the common abbreviation) followed by its backslash-separated key path. |
| Base64 Blob | \b(?:[A-Za-z0-9+/]{4}){8,}(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)? | A heuristic for a substantial base64 run (32+ characters) with optional trailing padding, not a guarantee the bytes actually decode to anything meaningful. |
| Email Address | \b[a-zA-Z0-9][a-zA-Z0-9._%+-]*@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}\b | A conventional name@example.com address. |
| MD5 / SHA1 / SHA256 Hash | \b(?:[a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{64})\b | A bare hex digest at exactly the MD5 (32), SHA1 (40), or SHA256 (64) character length. Length alone can't fully disambiguate them, same caveat as the Hash Calculator's Identify panel. |
Sources
- MDN JavaScript Reference: Regular expressions. MDN's full JavaScript RegExp reference: every flag, named capturing groups, lookbehind assertions, and Unicode property escapes with their exact flag requirements. The authoritative, actively-maintained source for the regex flavor this site's tools actually run.
Worth using too
- regex101. A full-featured online regex debugger supporting PCRE2, Python, Golang, and JavaScript flavors with live match highlighting, a plain-English breakdown of every capture group, and a substitution/unit-test mode. Worth reaching for when an investigation needs a specific engine's exact behavior or more elaborate testing than this site's single-flavor playground offers.
- CyberChef. GCHQ's browser-based "Cyber Swiss Army Knife" chains regex extraction (via its Find/Replace and Register operations) together with base64/hex decoding, XOR, and hundreds of other transforms: the natural next step when a DFIR pattern match on this site's tester needs to feed into further decoding of obfuscated or encoded artifact data, all still fully client-side.
- iHateRegex. A community-maintained regex cheat sheet with visual railroad-diagram breakdowns and a live testing playground for common general-purpose patterns (IPs, emails, dates, phone numbers): a useful complement to this site's DFIR-specific pattern library (SIDs, GUIDs, Windows paths) when a broader, non-forensics pattern is needed.