explain_regex

Explain a regular expression in plain English and detect the failure modes that make patterns dangerous rather than merely wrong.

Use this whenever a regex needs to be read, reviewed, or verified — and ALWAYS before putting a pattern somewhere it will run against untrusted input. The critical check is catastrophic backtracking: a pattern like (a+)+$ is three characters longer than a safe equivalent, looks harmless, and takes minutes of CPU on a 30-character input that almost matches. That makes it a denial-of-service vector. Whether a pattern is vulnerable depends on whether nested quantifiers can match the same characters in more than one way, which is a structural property that is unreliable to judge by reading.

It also flags: missing anchors (an unanchored validator accepts any string that merely CONTAINS a valid value), unescaped dots, character ranges like [A-z] that span punctuation, alternation precedence mistakes where an anchor applies to only one branch, and constructs JavaScript does not support.

Input: pattern accepts either a bare pattern or a full /pattern/flags literal. JavaScript syntax; PCRE-only constructs are reported as unsupported rather than guessed at.

Returns: summary (one sentence), steps (an ordered walkthrough), warnings (each with a code, severity, detail, and fix), flagNotes, capture group counts and names, and hasBlockingIssue — check that flag first. If the pattern cannot be parsed it returns an error naming the position, rather than a plausible-looking explanation of something else.