Scan and audit regular expressions for catastrophic polynomial and exponential backtracking risks (ReDoS). Evaluates nested quantifiers, overlapping groups, evil string payloads, and safe DFA rewrites in browser RAM.
Live regular expression tester with real-time match highlighting, capture group extraction, flags toggling (g, i, m, s, u), pattern breakdown explainer, and multi-language code generator.
Automatically detect and mask API keys (OpenAI, AWS, GitHub, Stripe), tokens, database URIs, passwords, emails, phone numbers, and PII before submitting prompts to ChatGPT, Claude, or Gemini.
Decode and inspect RFC 7519 JSON Web Tokens (JWT) client-side in RAM. Live expiration countdown, header/payload JSON formatting, and signature verification with zero server upload.
Compute high-speed SHA-256, SHA-512, SHA-384, SHA-1, and MD5 hashes and HMAC signatures for text or files up to 2GB using the browser's native Web Crypto API with instant checksum verification.
Generate instant, customizable UPI payment QR codes compliant with official NPCI specs. Set custom amounts, payee VPA, transaction notes, and export high-res PNG printables locally.
Format, validate, repair, and diff JSON documents with precise line and column error indicators, 2/4-space indentation, minification, tree structure view, and key sorting.
Detecting polynomial & exponential NFA state space explosion in ECMA-262 and PCRE regular expressions
Regular Expression Denial of Service (ReDoS) occurs when an algorithmic vulnerability in an engine's Non-deterministic Finite Automaton (NFA) causes exponential (O(2^n)) or polynomial (O(n^k)) execution time when processing a maliciously crafted input.
In vulnerable patterns like (a+)+ or (a|a)+, every input character doubles the decision paths the engine must explore during a match failure. A simple 30-character input can force over 1,000,000,000 backtracking evaluations, causing 100% CPU lockup and server outage.
With the widespread adoption of AI code assistants (GitHub Copilot, Cursor, ChatGPT, Claude), developers frequently deploy regex expressions for emails, URLs, slugs, and markdown that appear functional in simple test suites but conceal lethal backtracking traps.
AI models often generate unanchored, overlapping alternations such as ([a-zA-Z0-9]+) or (\w+\s)+. VedKit provides an in-browser static analyzer that checks your patterns for state-explosion vulnerabilities before deploying to production.
To neutralize ReDoS vulnerabilities:
.[a-z]+ with [^a-z][a-z]+).^ and $ to avoid sliding window scan explosion across long lines.How Regex ReDoS Vulnerability & Catastrophic Backtracking Scanner processes files securely inside your device memory
Every byte of your file is loaded directly into browser ArrayBuffers. Data is processed in volatile sandbox memory and flushed immediately when you close or refresh this tab.
Calculations and image matrix transformations leverage client-side GPU / Canvas2D engines for zero-latency output without server queuing or rate limits.
Generated files strictly follow international ISO specifications (JPEG JFIF, PDF 1.7, Web Crypto API) to guarantee acceptance on all official portals and banking systems.
Quick 4-step guide for instant results
Paste any regex pattern and select active flags (g, i, m, s, u) into the analysis input box.
The engine parses nested repetition quantifiers, evaluates group overlaps, and measures state branching.
Review the vulnerability rating (Safe, Polynomial Risk, or Exponential Catastrophic) and test evil payload strings.
Use the safe pattern recommendations to rewrite your expression with linear execution guarantees.
Common questions and verified answers about Regex ReDoS Vulnerability & Catastrophic Backtracking Scanner