How this tester works
The pattern you type is compiled with the browser's own RegExp engine, so what you see here is exactly what your JavaScript, TypeScript or Node code will do - the same engine, the same flags, the same quirks. Type the pattern without the surrounding slashes; pick flags with the checkboxes. Matches are highlighted in the test text, listed in a table with their character offset and every capture group, and counted at the top. The result updates as you type, so you can watch a pattern tighten or fall apart one character at a time.
The five flags do this: g finds every match instead of only the first, i ignores case, m makes ^ and $ match at each line break instead of only at the ends of the whole string, s lets . match a newline, and u turns on full Unicode mode, which is required for \u{1F600} escapes and \p{Letter} property classes. A zero-width pattern with the g flag would loop forever, so the tester advances one character whenever a match is empty, and stops after 2000 matches.
Greedy, lazy and the classic mistakes
Quantifiers are greedy by default: <.*> against <b>hi</b> matches the whole string, not just the first tag, because .* takes everything then backtracks. Add a question mark to make it lazy - <.*?> - or better, exclude the delimiter: <[^>]*>, which needs no backtracking at all and is much faster.
Three mistakes account for most broken patterns. First, an unescaped dot: example.com matches "examplexcom" too, so write example\.com. Second, forgetting that a character class is one character - [cat] matches a single c, a or t, not the word. Third, anchors: ^ and $ without the m flag apply to the entire string, so a multi-line paste will match once at most. When a pattern works on a regex site but not in your code, check whether your language needed the backslashes doubled inside a string literal - "\\d+" in JavaScript and Java, or a raw string r"\d+" in Python.
Replacement syntax and performance
In the replacement box, $1 through $9 insert capture groups, $& inserts the whole match, $` and $' insert the text before and after it, $<name> inserts a named group, and $$ inserts a literal dollar sign. Without the g flag, only the first match is replaced - the preview says so explicitly when that happens. The replaced text can be copied with the button under the form.
One safety note: nested quantifiers over the same characters, such as (a+)+b or (\s*,\s*)*, can take exponential time on input that almost matches. This is catastrophic backtracking, and it is a real denial-of-service vector in servers that compile user-supplied patterns. If a pattern makes this page freeze, that is the reason - simplify the nesting or use a possessive alternative. Everything here runs locally in your browser; the pattern and the test text are never uploaded.