Calculator Hub

Technology & Computing

Regex ReDoS Catastrophic Backtracking Step Estimator

Estimate the explosive number of backtracking steps a vulnerable nested-quantifier regex could take against a malicious input.

Your inputs

Change any value to update the result instantly.

Technology & Computing

Estimated backtracking steps

2,14,74,83,648

Estimated runtime

2.1475 sec

Input length

30 chars

Nesting levels

2

Nested quantifiers (e.g. (a+)+) can cause exponential-time backtracking on adversarial inputs — this is only an order-of-magnitude estimate.

Formula and working

Worst-case steps ≈ 2^inputLength for nested quantifiers like (a+)+, growing exponentially

  1. 1

    Collect the inputs

    Malicious input length (characters) = 30; Nested quantifier levels = 2; Engine steps per microsecond = 1,000

  2. 2

    Apply the formula

    Worst-case steps ≈ 2^inputLength for nested quantifiers like (a+)+, growing exponentially

  3. 3

    Result

    Estimated backtracking steps = 2,147,483,648

Frequently asked questions

Important limitation

This is an educational estimate based only on the values and formula shown. Verify current rates, rules, units, and professional standards before relying on the result. It is not personalized financial or investment advice.

Report a mistake or request an improvement

Tell us if a formula, unit, explanation, or result needs attention. Your message will include this calculator’s name and page.

Related calculators

Back to Calculator Hub