Regex Escape Developer
Escape a literal string so it can be dropped into a regular expression safely.
Regex Escape is a free online tool that escape a literal string so it can be dropped into a regular expression safely. It runs entirely in your web browser using plain JavaScript, so files are processed on your own device and never uploaded to a server. There is no sign-up, no file size limit imposed by the site, no watermark and no paid tier.
- Price
- Free — no account, no quota, no watermark
- Category
- Developer
- Where it runs
- In your browser, on your device
- Files uploaded
- None
- Technology
- plain JavaScript
- Settings
- 3
- Works offline
- Yes, after the first visit
About Regex Escape
Building a pattern by concatenating user input is both a bug and a denial-of-service risk. An unescaped opening bracket throws a syntax error, and a crafted input can trigger catastrophic backtracking that hangs the engine on a short string — the ReDoS class of vulnerability. JavaScript still has no built-in escape function; the `RegExp.escape` proposal has been pending for years, which is why every codebase carries the same copied character class.
How to use it
- Paste the text you want to run through regex escape.
- Set direction, wrap as and flags.
The 3 settings
| Setting | What it does | Default |
|---|---|---|
| Direction | Choose from 2: Escape for use in a regex, Unescape back to a literal. | Escape for use in a regex |
| Wrap as | Choose from 4: Just the escaped text, A /regex/ literal, new RegExp(...), With \b word boundaries. | Just the escaped text |
| Flags | Free text. | g |
Under the hood
| Runs on | plain JavaScript — runs the whole thing |
| Controls | Direction, Wrap as, Flags |
Questions
Which characters need escaping?
The twelve the specification treats as syntax: . * + ? ^ $ { } ( ) | [ ] and the backslash itself. The forward slash is escaped too here, since an unescaped one would terminate a `/regex/` literal early.
Is escaping enough to be safe?
It prevents syntax errors and stops input being interpreted as pattern syntax, which is the main thing. It does not bound execution time on a pattern that is itself pathological, so also avoid nested quantifiers and consider a timeout on anything user-driven.
What do the word boundaries do?
They wrap the escaped text in `\b`, so it matches only as a whole word. Searching for "cat" without them also matches "concatenate" — which is the most common surprise in a search-and-replace feature.