Math Expression Evaluator

What is a math expression evaluator?

A math expression evaluator takes a string like sqrt(2) * pi + log(e) and returns a number. Under the hood it parses the string into a syntax tree, then walks the tree to compute the result — the same two-step process a programming-language interpreter uses, just restricted to arithmetic. It is the moral equivalent of typing the expression into a calculator, except the input is a text field and the output is a number you can copy.

How it works

This evaluator is a small recursive-descent parser, the textbook approach for arithmetic grammars. The pipeline:

1. Tokenise — scan the input into numbers, identifiers, operators and punctuation. 12.5 + sin(x) becomes [NUM 12.5] [+] [IDENT sin] [(] [IDENT x] [)].
2. Parse — apply operator-precedence climbing to build an abstract syntax tree. 2 + 3 * 4 becomes Add(2, Mul(3, 4)), not Mul(Add(2, 3), 4).
3. Evaluate — walk the tree, dispatching identifiers through a fixed lookup table for functions (sin, sqrt, …) and constants (pi, e, tau), and resolving variables from an environment that the user can populate with x = 5; ….
4. Return the final Number.

The critical property: at no point does the evaluator call JavaScript eval() or Function(). Each operator and function name is matched against a closed allow-list of safe implementations. Anything outside the list is a syntax error, not arbitrary code execution.

Why “safe” matters

The shortest possible expression evaluator in JavaScript is x => eval(x) — one line, supports every JS operator, instantly broken from a security perspective. eval will happily run fetch('/api/admin/delete-everything') or read cookies or rewrite the DOM. In a web page that accepts arbitrary user input — for example, a shared calculator embedded in a multi-user app — eval-based evaluation is an XSS vulnerability with extra steps.

A purpose-built parser is a few hundred lines and gives you exactly the surface area you wanted: arithmetic, named functions you chose, nothing else. It is the same reason JSON.parse exists rather than “just eval the JSON”.

Common use cases

• Quick calculations that need named functions: hypot(3, 4), log2(1024), fact(10), atan2(1, 1) * 4 to recover π.
• Formula testing before pasting into application code: “does my conversion c * 9/5 + 32 actually give 98.6 at 37?”
• Teaching arithmetic and precedence — paste expressions live and show the result; the parenthesisation rules become obvious quickly.
• Reproducible expressions in documentation. Write (pi * d^2) / 4 in a tutorial; readers can paste it and verify.
• Lightweight scratchpad for engineers who would otherwise open a Python REPL just to compute one number.

How to use this math evaluator

1. Type an expression into the input box. Whitespace is optional; parentheses bind subexpressions; function calls use familiar name(args) syntax with comma-separated arguments.
2. The result updates live as you type. Syntax errors are flagged with a short message and the position of the problem.
3. To use variables, separate assignments with semicolons: r = 3; area = pi * r ^ 2; area. The last expression’s value is the result; earlier assignments populate the environment.
4. To compute in degrees instead of radians, wrap with rad(): sin(rad(30)) returns 0.5. The trig functions themselves always take radians, matching every standard math library.
5. Copy the result, or copy the full expression to share it.

Supported operators and functions

• Operators: +, - (binary and unary), *, /, %, ^.
• Grouping: ( ) to override precedence.
• Constants: pi, e, tau.
• Power / roots / logs: pow, sqrt, exp, log, ln, log10, log2.
• Rounding: round, floor, ceil, trunc, abs, sign.
• Aggregates: min, max, hypot (Euclidean norm of N args).
• Trig (radians): sin, cos, tan, asin, acos, atan, atan2(y, x).
• Conversions: rad(deg), deg(rad).
• Combinatorics: fact(n) for integer factorial up to ~170 before overflow.

Security considerations

The parser is the security boundary. Every identifier the user types is checked against a fixed table; unknown identifiers raise a parse error. Function arguments are evaluated, type-checked where it matters, and passed to the corresponding JavaScript Math method. There is no string concatenation into eval, no new Function, and no access to the DOM, window, document, or any other host object from inside the expression. The whole evaluator is pure: same input, same output, no side effects.

Privacy

Every keystroke is parsed and evaluated locally in your browser tab. The page makes zero network requests after the initial load — you can verify in the Network panel. No expressions, variables or results are sent anywhere, logged, or used for analytics. Closing the tab discards all state.

Compatibility notes

The evaluator is plain JavaScript that targets every browser released in the last decade. Numbers are IEEE-754 double-precision, identical to JavaScript, Python float, Java double and every modern spreadsheet. The grammar matches mathematical convention: precedence follows PEMDAS, exponentiation is right-associative, function calls use parenthesised arguments. There is no i, no complex numbers, no symbolic algebra, and no plotting — for plotting use a graphing tool; for symbolic computation use a CAS like SymPy or Mathematica.