You’ve probably written a regex that worked perfectly on your first try. Then you added one more case, then another, and suddenly your pattern looked like a cat walked across the keyboard. If that sounds familiar, you’re not alone—and you’re also not the problem. The problem is that we’ve been lying to ourselves about what regular expressions actually are.
Here’s the truth that will make you both awestruck and terrified: Regular expressions are not just a search-and-replace utility. They are a Turing-complete programming language. That means they can (in theory) run Doom. And they can also (in practice) turn a one-line fix into a multi-month debugging nightmare.
Some people, when confronted with a problem, think, ‘I know, I’ll use regular expressions.’ Now they have three problems. That famous line from the Hacker News comments isn’t a joke—it’s a prophecy. The very power that makes regex capable of parsing any formal language is the same power that makes it a liability in production codebases. You are essentially writing a tiny, unreadable, unmaintainable program and calling it a ‘configuration.’
Let me show you what I mean. The original article from 2012 by Nikita Popov demonstrated that Perl-compatible regex (PCRE) can implement a universal Turing machine. That means you can simulate any computation with a regex. If you write a regex with backreferences, lookaheads, and recursion, you are no longer pattern matching—you are programming. And programming without version control, unit tests, or code review is a recipe for disaster.
Yet most developers still treat regex as a glorified find-and-replace. They throw a pattern together, test it on three examples, and ship it. Then six months later, someone discovers that the regex fails on a valid email address, or that it crashes on a specific input, or that it accidentally matches something it shouldn’t. The fix is a four-hour spelunking session through a layer of syntactic sludge.
This is the paradox of regex: Its theoretical boundlessness is directly proportional to its practical destructiveness. The more you can do with it, the harder it is to read, debug, and change. That’s why the smartest engineers I know use regex only for the simplest patterns—and then reach for a proper parser for anything more complex.
I learned this lesson the hard way. I once inherited a codebase where the previous developer had used a single regex to parse a configuration file. It was 200 characters long, contained nested groups and conditional lookaheads, and worked—until we added a new feature. The regex broke. We spent two weeks trying to fix it, then finally scrapped the whole thing and wrote a simple state machine. The state machine was three times longer, but it was also readable, testable, and wish-I-did-this-sooner obvious.
So here’s the rule of thumb: If your regex can’t be explained in a single line of a code comment, it’s too complex. Use regex for what it’s good at—matching fixed patterns, validating simple formats, extracting known fields. For anything that resembles a language, hire a parser. Your future self (and your teammates) will thank you.
Don’t let the Turing-complete monster ruin your codebase. Acknowledge its power, respect its limits, and use it sparingly. Because the next time you’re tempted to write a clever regex, remember: Doom can run on it. But so can your career.
FAQ
Q: But regex is just for pattern matching, how can it be Turing-complete?
A: Modern regex engines support backreferences, lookaheads, and recursion, which allow them to simulate a Turing machine. In theory, you can compute anything with them—including running Doom. In practice, that power makes them unreadable and unmaintainable.
Q: So should I never use regex?
A: No, regex is excellent for simple, fixed patterns—like validating a phone number or extracting a known substring. The problem is when you use it for complex parsing tasks that should be handled by a proper parser or state machine. Keep it simple, and you'll be fine.
Q: What about the argument that complex regex is elegant and powerful?
A: Elegance is subjective, but maintainability is not. A regex that takes 10 minutes to write can take 10 hours to debug. If you can't read it at a glance, it's not elegant—it's dangerous. The most elegant code is the code that your teammates can understand and modify without fear.