JavaScript Regex & the RegExp Object

Creating a regular expression

// Literal — compiled at parse time. Use this when the pattern is fixed.
const phone = /^\d{3}-\d{4}$/;

// Constructor — use when the pattern is assembled at runtime.
const term = escapeRegExp(userInput);
const search = new RegExp(term, "gi");

// The constructor takes a *string*, so every backslash must be doubled:
new RegExp("\\d+")   // equivalent to /\d+/
new RegExp("\d+")    // WRONG — "\d" is just "d" after string parsing

Prefer the literal. It reads better, needs no double-escaping, and is validated when the file is parsed rather than when the line first runs. Reach for the constructor only when part of the pattern is a variable — and escape that variable first:

function escapeRegExp(str) {
  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
}

const re = new RegExp(`\\b${escapeRegExp(query)}\\b`, "i");

The methods, and which to use

The decision is usually one of four:

• Just need a boolean? re.test(str) — without the g flag.
• Need every match plus its groups? [...str.matchAll(re)] with the g flag.
• Need one match with its groups? str.match(re) without g.
• Rewriting text? str.replaceAll(re, fn).

The lastIndex trap

This is the single most common JavaScript-specific regex bug, and it is worth understanding rather than memorising a workaround.

const re = /\d+/g;

re.test("abc 123");   // true   — lastIndex is now 7
re.test("abc 123");   // false  — resumes from index 7, finds nothing
re.test("abc 123");   // true   — lastIndex reset to 0 by the failure

// Same problem inside a loop over an array:
const isNumeric = /^\d+$/g;
["1", "2", "3"].filter((s) => isNumeric.test(s));   // ['1', '3'] — wrong

Three fixes, in order of preference:

1. Drop the g flag if you are only testing. A boolean check never needs it.
2. Create the regex where you use it. A literal inside the callback is a fresh object each call — modern engines cache the compilation, so the cost is negligible.
3. Reset explicitly: re.lastIndex = 0 before each use. Necessary when the regex must be a shared module constant.

Note that String.prototype.match, matchAll, and search do not have this problem — match with g resets internally, andmatchAll operates on a clone.

Capture groups and matchAll

const log = "GET /a 200\nPOST /b 404";
const line = /(?<method>GET|POST) (?<path>\S+) (?<status>\d{3})/g;

for (const m of log.matchAll(line)) {
  console.log(m.groups.method, m.groups.status, m.index);
}

// Straight into objects
const rows = [...log.matchAll(line)].map((m) => ({ ...m.groups }));

// Destructuring named groups reads especially well
const { groups: { year, month } = {} } =
  "2026-03-14".match(/(?<year>\d{4})-(?<month>\d{2})/) ?? {};

Compare that with match under the global flag, which throws the structure away:

"GET /a 200".match(/(GET|POST) (\S+)/g);
// ['GET /a']            ← groups gone

"GET /a 200".match(/(GET|POST) (\S+)/);
// ['GET /a', 'GET', '/a', index: 0, input: '...', groups: undefined]

A group inside an alternation that did not participate is undefined, not an empty string — guard before calling string methods on it. With the ES2022 d flag you also get match.indices, giving the start and end offset of every group, which is what you need to build a syntax highlighter or an editor decoration.

replace and replaceAll

// $1, $2 for numbered groups; $<name> for named ones
"2026-03-14".replace(/(\d{4})-(\d{2})-(\d{2})/, "$3/$2/$1");
// '14/03/2026'

"Ada Lovelace".replace(/(?<first>\w+) (?<last>\w+)/, "$<last>, $<first>");
// 'Lovelace, Ada'

// $& is the whole match, $` before it, $' after it, $$ a literal dollar
"cost: 40".replace(/\d+/, "$&.00");   // 'cost: 40.00'

// A function replacement receives (match, ...groups, offset, string, groups)
text.replaceAll(/(?<user>[\w.+-]+)@(?<domain>[\w.-]+)/g, (...args) => {
  const { user, domain } = args.at(-1);
  return `${user[0]}***@${domain}`;
});

replaceAll throws a TypeError if the regex lacks the gflag. That looks unhelpful but is a feature: it turns "I forgot the g flag and only replaced the first one" from a silent data bug into an immediate error.

Flags

Read the flags off an existing regex with re.flags, and clone one with different flags via new RegExp(re.source, "gi"). Since ES2018 you can also scope flags to part of a pattern in engines that support modifier groups, but support is still uneven — set flags on the whole pattern for now.

Unicode

Without the u flag, JavaScript regexes operate on UTF-16 code units, which means emoji and other astral characters are two "characters" as far as the engine is concerned:

const grin = "\u{1F600}";     // a grinning face, one code point

grin.length;                  // 2 — two UTF-16 code units
/^.$/.test(grin);             // false — . matches one code unit
/^.$/u.test(grin);            // true  — u makes . a full code point

// Property escapes need the u (or v) flag
/\p{Lu}/u.test("Ä");          // true  — any uppercase letter, any script
/\p{Script=Greek}/u.test("π"); // true
/\p{Emoji_Presentation}/u.test(grin); // true

// The v flag (ES2024) adds set operations inside classes
/[\p{Letter}--\p{ASCII}]/v.test("é");  // true — letters except ASCII ones

Use u by default on any pattern that touches user-generated text. For counting or splitting user text, remember that even code points are not the same as what a reader calls a character — use Intl.Segmenter for grapheme clusters.

Modern features worth knowing

• Named capture groups (ES2018) — (?<name>...), read viamatch.groups.
• Lookbehind (ES2018) — and uniquely, JavaScript allows it to be variable-length: (?<=\$\d+\s) is valid where Python would reject it.
• Dotall (ES2018) — the s flag, so you no longer need[\s\S] to match across lines.
• String.prototype.matchAll (ES2020) — replaces thewhile ((m = re.exec(s)) !== null) loop entirely.
• Match indices (ES2022) — the d flag populatesmatch.indices and match.indices.groups.
• Unicode sets (ES2024) — the v flag brings set difference (--), intersection (&&), and multi-character string properties inside character classes.

Performance and ReDoS

JavaScript runs on a single thread, so a pathological regex does not just slow a request down — it freezes the whole event loop, or the whole browser tab. That makes ReDoS a genuine availability issue rather than a micro-optimisation concern.

// Exponential: every 'a' doubles the work
const evil = /^(a+)+$/;
evil.test("a".repeat(30) + "!");    // blocks for seconds

// Linear: same intent, no nesting
const safe = /^a+$/;

// Lazy dot vs negated class — the negated class cannot overshoot
/".*?"/       // backtracks on every character
/"[^"]*"/     // one pass

• Never nest quantifiers where the inner and outer can match the same text.
• Prefer negated classes to lazy dots when you know the terminator.
• Anchor patterns so a non-match fails at the first character instead of retrying at every offset.
• Escape user input before it becomes part of a pattern.
• Hoist regexes out of hot loops — a module-level constant avoids re-creating the object, though modern engines cache literal compilation anyway.
• Use a plain string method when one exists — includes, startsWith, and split are faster and clearer.

Recipes

const PATTERNS = {
  email: /^[\w.+-]+@[\w-]+\.[\w.]+$/,
  slug: /^[a-z0-9]+(?:-[a-z0-9]+)*$/,
  hex: /^#(?:[0-9a-f]{3}){1,2}$/i,
  isoDate: /^\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$/,
  ipv4: /^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/,
};

export const isValid = (kind, value) => PATTERNS[kind].test(value);

function highlight(text, query) {
  const re = new RegExp(escapeRegExp(query), "gi");
  const out = [];
  let last = 0;
  for (const m of text.matchAll(re)) {
    out.push(text.slice(last, m.index), { match: m[0] });
    last = m.index + m[0].length;
  }
  out.push(text.slice(last));
  return out;   // render strings as text, objects as <mark>
}

const PAIR = /(?<key>[^&=]+)=(?<value>[^&]*)/g;

const params = Object.fromEntries(
  [...search.matchAll(PAIR)].map((m) => [
    decodeURIComponent(m.groups.key),
    decodeURIComponent(m.groups.value),
  ])
);

Every pattern in the library ships with a JavaScript snippet, and you can try any of them in the regex tester — which runs the same ECMAScript engine your code will. For the syntax itself, see theregular expressions guide, and for the same material in Python, the Python regex guide.