Paste a .gitignore and a list of paths, and see exactly what git will do: ignored or not, decided by which pattern on which line — including the rule everyone trips over, that a !negation can never re-include a file whose parent directory is excluded. Same answers as git check-ignore -v, entirely in your browser.
For each path, the last matching pattern in the file wins; ! in front re-includes instead of ignoring. But before that, git walks the path's parent directories from the top: if any of them is excluded, the path is ignored, full stop — git never looks inside an excluded directory, so no later ! can rescue a file inside one. To carve an exception you must re-include each directory level and exclude its other contents (see the docs example above).
A pattern with a / anywhere except the end is anchored to the .gitignore's directory; otherwise it matches basenames at any depth. A trailing / makes it directories-only. * and ? never cross a slash; ** does, but only standing alone between slashes (elsewhere it degrades to *). Matching is byte-by-byte, so ? matches one byte, not one character: caf? does not match café.
This tool models a single .gitignore at the repository root. Nested .gitignore files, .git/info/exclude, and core.excludesFile stack on top with the same per-file rules. Already-tracked files are unaffected by .gitignore either way.