Find and Replace Online — Text Replacement with Regex Support

Catastrophic backtracking happens when a regex with nested quantifiers (the classic `(a?){29}a^29` benchmark Cox uses, or `(a+)+$` against a long string of 'a's followed by 'b') tries every possible split between the inner and outer groups before failing. As input grows, the number of split combinations grows exponentially. Russ Cox's 2007 article 'Regular Expression Matching Can Be Simple And Fast' (swtch.com) demonstrated that backtracking engines (Perl, Python, JavaScript) can take 60+ seconds on a 29-character pathological input that Thompson-NFA engines (the construction Thompson described in CACM 1968) match in 20 microseconds. JavaScript regex uses backtracking, so a malicious or accidental nested-quantifier pattern on a long string would freeze the page. Running the regex inside a Web Worker (defined in the WHATWG HTML Living Standard) means it executes in a separate thread; if the worker doesn't respond before a configured timeout, the main thread terminates it via the WHATWG terminate-a-worker algorithm and surfaces an error.

ECMA-262 specifies that a RegExp constructor string interprets `.`, `*`, `+`, `(`, `)`, `[`, `]`, `?`, `\\`, `^`, `$`, `|`, `{`, `}` as metacharacters with their respective regex meanings. Literal-mode find strings need these to match themselves: `.` should match a period, not any character; `*` should match an asterisk, not act as a quantifier. The escape pass wraps each metacharacter with a backslash before the string is passed to the RegExp constructor, so `(name)` becomes `\\(name\\)` and matches the literal text '(name)'. Without escaping, a literal-mode search for `.com` would match every three-character sequence ending in 'com', which is rarely what the user wants.

ECMA-262's String.prototype.replace defines the replacement-string syntax: `$&` is the entire match, `$\`` (back-tick) is the portion of input before the match, `$'` (apostrophe) is the portion after, and `$1`–`$9` reference numbered capture groups in the regex pattern. In regex mode, a pattern like `(\\w+) (\\w+)` with replacement `$2 $1` swaps every adjacent pair of word tokens. ES2018 added named groups: `(?<first>\\w+) (?<last>\\w+)` with replacement `$<last> $<first>` does the same with names. A literal `$` in the replacement is written `$$`. JavaScript's replace does NOT recognize backslash-style escapes (`\\1`, `\\n`) from POSIX/Perl regex — only the dollar-sign forms.

Yes. The tool uses the JavaScript runtime's RegExp directly, so any feature the browser engine supports is available — lookbehind `(?<=...)` and `(?<!...)` from ES2018, named capture groups `(?<name>...)` and `\\k<name>` references from ES2018, Unicode property escapes `\\p{Letter}` and `\\P{Number}` from ES2018 (with the `u` flag), and the `s` (dotAll) flag from ES2018. Browsers older than ~2023 (notably Safari 16.3 and earlier for lookbehind) surface a clear SyntaxError inline rather than silently producing wrong output. ECMA-262 does NOT support atomic groups `(?>...)` or possessive quantifiers (`*+`, `++`) found in PCRE/Perl/Java; for patterns where atomic groups would be the natural defense against backtracking, the safer approach is to rewrite the pattern to avoid nested quantifiers altogether.

The substitution count and the result region sit inside an aria-live="polite" region, the W3C WCAG Success Criterion 4.1.3 (Status Messages, introduced in WCAG 2.1, Recommendation 5 June 2018; carried unchanged into WCAG 2.2, Recommendation 5 October 2023) pattern. Polite live regions queue announcements after any speech in progress, so editing the find or replace fields announces the new substitution count without interrupting the user mid-sentence. Screen readers (NVDA, JAWS, VoiceOver) consume the live region automatically; the user does not need to do anything else.