regex

regex is the official Rust crate for searching text with regular expressions, maintained under the rust-lang organization by Andrew Gallant (BurntSushi). It compiles patterns into finite automata rather than using a traditional backtracking engine, which guarantees worst-case O(m*n) search time regardless of the input — a property most regex libraries in other languages cannot offer, since attacker-controlled patterns can otherwise cause exponential blowup (ReDoS).

The crate exposes a small, ergonomic surface (Regex, RegexSet, Captures, and byte-oriented variants under regex::bytes) while delegating the heavy lifting to two sibling crates in the same workspace: regex-syntax for parsing and regex-automata for constructing and running the actual matching engines (lazy DFA, one-pass DFA, bounded backtracker, and a pike VM, selected automatically based on the pattern). It is one of the most widely depended-upon crates in the Rust ecosystem, with nearly a billion cumulative downloads.

What You Get

• A Regex type for &str searches and a regex::bytes::Regex type for arbitrary &[u8] searches, sharing an identical API surface
• RegexSet for matching many patterns against a haystack in a single pass, reporting which patterns matched
• Named and numbered capture groups via Captures, plus a captures_iter().map(|c| c.extract()) pattern for typed group extraction
• A RegexBuilder for tuning case-insensitivity, verbose mode, Unicode mode, size limits, and other compile-time options
• Granular Cargo features to trim binary size and compile time by disabling Unicode tables or specific performance engines

Common Use Cases

• Validating and extracting structured fields (dates, IDs, log line formats) from user input or log files
• Splitting or replacing text based on pattern matches, including capture-group-aware replacement templates
• Searching untrusted or adversarial input safely, where a backtracking engine’s worst-case blowup would be a denial-of-service risk
• Building higher-level text-processing and lexing tools on top of the lower-level regex-automata and regex-syntax crates

Under The Hood

Architecture — The regex crate (src/lib.rs, src/regex/{string,bytes}.rs, src/regexset/) is a thin, ergonomic wrapper around regex-automata’s meta::Regex, which is a workspace sibling crate vendored via a path dependency. Pattern text first goes through regex-syntax for parsing into an AST/HIR, after which regex-automata selects among several matching strategies at runtime — a lazy (hybrid) DFA, a fully compiled DFA, a one-pass DFA for simple capture patterns, and a bounded backtracker or pike VM as fallbacks — based on the pattern’s shape, so callers get near-optimal performance without choosing an engine themselves. Tech Stack — Pure Rust, edition 2021, MSRV 1.65. Core dependencies are regex-automata (0.4.x) and regex-syntax (0.8.x), both maintained in the same repo/workspace, plus optional aho-corasick and memchr for literal-matching optimizations gated behind the perf-literal feature. The crate is no_std-friendly at the alloc layer through regex-automata, though the top-level regex crate itself currently requires std. Code Quality — Testing is unusually extensive for a crate of any ecosystem: a dedicated regex-test crate plus testdata/ (25 TOML fixture files) drive parameterized conformance suites (tests/suite_string.rs, suite_bytes.rs, suite_string_set.rs, suite_bytes_set.rs) across both the &str and &[u8] APIs, supplemented by regression.rs/regression_fuzz.rs for previously-found bugs and an in-repo fuzz/ target. CI (.github/workflows/ci.yml) runs across multiple Rust versions and feature-flag combinations. API Design — The public API is deliberately small: Regex::new, is_match, find/find_iter, captures/captures_iter, mirrored identically between the &str and regex::bytes modules, so switching between text and byte-oriented matching requires no relearning. Documentation is exceptionally thorough, with runnable doctests embedded directly in src/lib.rs’s 1,300+ line module doc covering syntax, Unicode behavior, performance guidance, and untrusted-input handling.