Anchors, boundaries & lookaround

Positions, not characters

A regular expression, or regex, is a pattern for finding text. Most regex parts match characters. For example, \d matches one digit, and cat matches the three letters c, a, t.

This lesson is about a different kind of part. These parts don't match a character. They check a position: a gap between two characters, or the gap at the start or end of the text.

While a regex runs, JavaScript moves through the text from left to right. The program that does this is called the regex engine. A position check asks: "Is the engine standing in the right gap?"

This lesson is only about position checks. Other lessons cover the rest of regex:

• How to write a regex and its flags: Patterns & flags.
• Sets of characters like \d and [a-z]: Character classes.
• Repeat marks like + and {3}: Quantifiers.
• Round-bracket groups: Groups & backreferences.

This table lists the tools in this lesson. Read each row from left to right: the tool, the question it asks, and whether it uses up text.

^ and $ are the anchors you will meet most often. A flag is a letter after the closing slash that changes how the regex works. The m flag turns on multiline mode.

• Without m: ^ means only the start of the whole text, and $ means only the end of the whole text.
• With m: ^ also means the start of each line, and $ also means the end of each line.

In the code below, \n is a line break: one character that starts a new line. Step through it with and without m.

1const text = "alpha\nbeta\n";Run2const pattern = /^beta$/m;3const match = pattern.exec(text);4 5console.log(match ? match.index : null);6console.log(match ? match[0] : "no match");

This table compares the two modes. Read each row from left to right: what you compare, what happens without m, and what happens with m.

Some text ends with one last line break. Other regex languages, like Python and Perl, let $ match just before that last line break. JavaScript does not.

In JavaScript, $ without m matches only the very end. So if the text ends with \n, you have two choices:

• Put the \n in your pattern.
• Turn on m, if line ends are what you want.

1console.log(/end$/.test("end\n"));2console.log(/end\n$/.test("end\n"));3console.log(/end$/m.test("end\n"));

Anchors also decide whether a regex finds text or checks the whole text:

• /admin/ finds admin anywhere inside the text.
• /^admin$/ passes only if the whole text is exactly admin.

Checking that the whole text follows a rule is called validation. For example, you validate a form field before you save it.

1const value = "say admin now";2console.log(/admin/.test(value));3console.log(/^admin$/.test(value));4console.log(/^admin$/.test("admin"));5 6const lines = "admin\nsay admin now";7console.log(/^admin$/.test(lines));8console.log(/^admin$/m.test(lines));

Look at the last two logs. The text lines has two lines, and the first line is admin.

• Line 7 has no m, so the whole text must be admin. It is not, so the result is false.
• Line 8 has m, so one matching line is enough. The result is true.

So leave m off when you validate a form field. A user could type admin on one line and anything else on the next line, and it would pass. Turn m on only when each line is its own record, like the lines of a log file.

\b is a word boundary. It matches a gap where a word character is on one side and a non-word character (or the start or end of the text) is on the other side.

For \b, a word character is only one of these:

• a letter from A to Z or a to z
• a digit from 0 to 9
• the underscore, _

The opposite is \B. It matches every gap that is not a word boundary. Try both in the playground below.

1const text = "hi\ncafé cat\nend\n";2console.log([...text.matchAll(/^/gm)].map((m) => m.index));3console.log([...text.matchAll(/$/gm)].map((m) => m.index));4console.log([...text.matchAll(/\b/g)].map((m) => m.index));

The short list of word characters causes trouble with real names. A person reads café as one word. But é is not on the list, so \b sees a word edge between f and é. The u flag does not change this.

For words in any language, use lookarounds with \p{L}. With the u flag, \p{L} means "any letter in any language". You met it in the Character classes lesson. Lookarounds are explained later in this lesson.

1console.log(/\bcat\b/.test("concatenate"));2console.log(/\bcat\b/.test("a cat"));3console.log(/\bcafé\b/u.test("café"));4console.log(/(?<!\p{L})café(?!\p{L})/u.test("café"));5console.log(/\Bend/.test("weekend"));

Here is what each log shows:

• Line 1 gives false. Inside concatenate, the letters cat have letters on both sides, so there is no word edge.
• Line 2 gives true. In a cat, the word cat stands on its own.
• Line 3 gives false. \b does not count é as a word character.
• Line 4 gives true. The lookarounds check that no letter of any language comes before or after café.
• Line 5 gives true. In weekend, the gap before end has letters on both sides, so it is not a word edge, and \B matches it.

1// Planned syntax: Node 22 and Chrome 154 can't run this yet.2const log = "status: ok\n";3console.log(/\Astatus: ok\Z/u.test(log)); // would allow one last line break4console.log(/\Astatus: ok\z/u.test(log)); // would need the very end

Here is what works today:

• For most whole-text checks, use ^ and $ without m.
• If you need an anchor that no flag can change, use the lookarounds on lines 5 and 6 below. [\s\S] means "any character". So "no character before" means the start, and "no character after" means the very end.

1const exact = "status: ok";2const withFinalNewline = "status: ok\n";3 4console.log(/^status: ok$/.test(exact));5console.log(/(?<![\s\S])status: ok(?![\s\S])/.test(exact));6console.log(/(?<![\s\S])status: ok(?![\s\S])/.test(withFinalNewline));

A lookahead checks the text just after the current gap. It comes in two kinds:

• Positive lookahead, (?=...): the next text must match the pattern inside.
• Negative lookahead, (?!...): the next text must not match the pattern inside.

After the check passes, the engine stays in the same gap. It has not moved past any characters.

1const text = "ababa";2const starts = [...text.matchAll(/(?=aba)/g)].map((match) => match.index);3console.log(starts.join(","));4console.log(text.replace(/(?=aba)/g, "|"));5 6const captured = /(?=(aba))/.exec(text);7console.log(captured[0].length);8console.log(captured[1]);9 10const noAdmin = /^(?!.*\badmin\b).+$/;11console.log(noAdmin.test("admin user"));12console.log(noAdmin.test("regular user"));

Here is what each part shows:

• Line 3 prints 0,2. The lookahead finds two gaps in ababa where aba comes next: index 0 and index 2.
• Line 4 prints |ab|aba. replace puts a | in each of those gaps. No letters are removed, because the lookahead matched no letters.
• Lines 6 to 8 show that round brackets inside a positive lookahead still save text. The whole match is empty, so its length is 0. But group 1 saved aba.
• Lines 10 to 12 use a negative lookahead as a "must not contain" rule. (?!.*\badmin\b) fails if the word admin appears anywhere. So admin user gives false, and regular user gives true.

In the last example, the lookahead checks from the start first. Only after the check passes does .+ use up the text.

Lookaheads are great for password rules. Several lookaheads can all check the same password from the start, one rule each. Step through it below.

1const strong = /^(?=.{8,}$)(?=.*[A-Z])(?=.*\d)(?!.*\s).+$/;Run2console.log(strong.test("desk-2"));3console.log(strong.test("Desk 2026"));4console.log(strong.test("Desk-2026"));

Lookaheads can also add commas to a long number, like 1,234,567,890. The pattern finds each gap where the digits to the right come in full groups of three:

• \B means "not a word edge". It stops a comma at the very start.
• (?=(\d{3})+ checks that one or more groups of three digits come next.
• (?!\d)) checks that no extra digit comes after those groups, so the groups end exactly at the last digit.

1const value = "1234567890";2console.log(value.replace(/\B(?=(\d{3})+(?!\d))/g, ","));

A lookbehind checks the text just before the current gap. It also comes in two kinds:

• Positive lookbehind, (?<=...): the text before must match the pattern inside.
• Negative lookbehind, (?<!...): the text before must not match the pattern inside.

All current browsers support lookbehind: Chrome, Firefox, Edge, and Safari. Safari added it in version 16.4, so only older Safari versions lack it.

1const receipt = "Tea $3.50, mug $12, tax 0.90";2const prices = [...receipt.matchAll(/(?<=\$)\d+(?:\.\d{2})?/g)].map((match) => match[0]);3console.log(prices.join(", "));

The lookbehind checks the dollar sign but does not use it up. So the match holds only the number. You don't need an extra group to cut the $ off. The number 0.90 has no $ before it, so it is skipped.

1const strong = /^(?=.{8,}$)(?=.*[A-Z])(?=.*\d)(?!.*\s).+$/;2console.log(strong.test("desk-2"));3console.log(strong.test("Desk 2026"));4console.log(strong.test("Desk-2026"));

A flag like i (ignore upper and lower case) usually applies to the whole regex. An inline modifier turns a flag on or off for just one group:

• (?i:...) turns i on inside the group.
• (?-i:...) turns i off inside the group.
• (?m:...) turns m on inside the group.

Inline modifiers were added in ES2025, the 2025 edition of JavaScript. Not every place supports them yet:

• Current Chrome and Firefox support them.
• Safari does not yet, says MDN's browser support table.
• Node 22 stops with the error "Invalid group".

1// ES2025 inline modifiers. Chrome 154 and Firefox can read this; Node 22 and Safari can't.2const route = /^(?i:api)-(?-i:v1)$/i;3console.log(route.test("API-v1"));4console.log(route.test("API-V1"));

The older way below shows why this feature helps. A normal i flag makes the whole pattern ignore case. It can't ignore case for api while keeping v1 exact.

1const route = /^api-v1$/i;2console.log(route.test("API-v1"));3console.log(route.test("API-V1")); // can't keep only v1 exact

You will use these position checks in everyday code:

• to check that a whole value is valid, not just that it contains something
• to leave a prefix like $ out of the text you pull out
• to insert text into gaps, like commas, without removing any characters

This table shows common jobs. Read each row from left to right: the job, the pattern, and why it works.

Common misconceptions

• "$ always matches before a last line break." Not in JavaScript without m. Other regex languages do this, so test advice before you copy it.
• "^...$ always checks the whole value." Only when m is off, and only if your pattern covers every allowed character.
• "\b finds the edge of any word." It only knows the letters A to Z, digits, and _. Words like café need lookarounds with \p{L}.
• "A lookaround uses up the text it checks." It does not. Only the parts after it decide what ends up in the match.
• "New regex syntax is safe if that code never runs." JavaScript reads a regex literal before any code runs, so new syntax can crash the whole file. Keep new syntax in a string and test for support first.

This table lists all four lookarounds. Read each row from left to right: how you write it, its name, what it checks, and a common use.

Key takeaways

• Anchors, word boundaries, and lookarounds are zero-width assertions. They check a gap and use up no text.
• In JavaScript, $ without m matches only the very end, not the gap before a last line break.
• \b only knows A to Z, digits, and _. For words in any language, use lookarounds with \p{L}.
• Lookaheads and lookbehinds use up no text. Round brackets inside a positive lookaround can still save text.
• Inline modifiers are new in ES2025. Test for support first, because Node 22 and Safari can't read them yet.

Up next: Regex performance & safety. It explains backtracking, ReDoS attacks, and the sticky y flag, and why some patterns are safer than others.