Lookaheads in JavaScript Regex

Introduction

Welcome back to Regex Validation, Flags, and Text Processing in JavaScript! You've now completed two lessons, and your regex skills are growing impressively. In the first lesson, you learned to validate complete inputs with the .test() method combined with anchors (^and $), creating username and password validators that check every character from start to finish. In the previous lesson, you mastered regex flags to control pattern behavior: performing case-insensitive searches with the i flag, handling line boundaries with the m flag, and matching across newlines with the s flag. These tools give you tremendous flexibility in how patterns process text. However, there's another challenge that neither validation rules nor flags directly solve: what if you need to match text based on what comes before or after it, but without including that context in the match itself? Imagine extracting dollar amounts, but only when they're followed by the word "USD"; or finding passwords in a configuration file, but excluding any marked as "REDACTED"; or validating that a password contains both uppercase and lowercase letters without caring about their order. These scenarios require checking conditions without consuming the characters being checked. This lesson introduces lookaheads : powerful assertions that let you peek ahead in the text to verify conditions without including those characters in your match. Let's explore how lookaheads enable sophisticated conditional matching.

Understanding Lookaheads and Zero-Width Assertions

Lookaheads are a type of zero-width assertion: they check whether a pattern exists at a specific position without actually consuming any characters. Think of them as looking ahead in the text to verify something is there, then stepping back to continue matching from where you were. This "look but don't consume" behavior is fundamentally different from normal pattern matching, where the regex engine advances through the string as it matches each component. There are two types of lookaheads in JavaScript's regex engine: Positive lookaheads (?=...) succeed if the pattern inside matches at the current position, but they don't advance the matching position. Negative lookaheads (?!...) succeed if the pattern inside does not match at the current position, again without consuming characters. Consider extracting prices from text where some are in USD and others in EUR. A normal pattern like /\d+\.\d{2} USD/ would match "12.50 USD," but it includes " USD" in the captured result. With a positive lookahead /\d+\.\d{2}(?= USD)/, you match the price only if it's followed by " USD," but the lookahead doesn't consume " USD," so your match contains just the numeric amount. Similarly, negative lookaheads let you exclude matches based on what follows. These assertions become especially powerful for validation, where you need to ensure certain characters exist somewhere in the string without caring about their exact position.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Negative Lookaheads to Exclude Patterns

While positive lookaheads check that something is present, negative lookaheads verify that something is not present. This becomes invaluable when you need to exclude certain matches based on context. Let's extract passwords from a configuration file, but skip any explicitly marked as "REDACTED."

JavaScript

function findPasswordsInConfig(text) {
  // Match password values not followed by REDACTED
  const pattern = /password\s*=\s*(?!REDACTED\b)(\S+)/g;
  const results = [];
  let match;
  while ((match = pattern.exec(text)) !== null) {
    results.push(match[1]);
  }
  return results;
}

function findPasswordsInConfig(text) {
  // Match password values not followed by REDACTED
  const pattern = /password\s*=\s*(?!REDACTED\b)(\S+)/g;
  const results = [];
  let match;
  while ((match = pattern.exec(text)) !== null) {
    results.push(match[1]);
  }
  return results;
}

This pattern demonstrates negative lookahead in action:

password\s*=\s* matches "password" followed by optional whitespace, an equals sign, and more optional whitespace.
(?!REDACTED\b) is our negative lookahead, ensuring the next text is not "REDACTED" followed by a word boundary; if "REDACTED" appears at this position, the entire match fails.
(\S+) captures one or more non-whitespace characters as the actual password value.

The word boundary \b after "REDACTED" is critical here: without it, the pattern would reject passwords that merely start with "REDACTED," like "REDACTED_KEY." The boundary ensures we only exclude the exact word "REDACTED," not passwords that contain it as a prefix. The negative lookahead effectively says, "continue matching only if you don't see REDACTED as a complete word here."

Since we're using a capturing group (\S+) to extract just the password value, we need a different approach than .match(). When the g flag is used with capturing groups, .match() only returns the full matches, not the captured groups. Instead, we use the .exec() method in a while loop. The .exec() method returns a match object containing the full match and any captured groups, and when called repeatedly with the g flag, it continues from where it left off in the string. We access the captured password using match[1] (the first capturing group) and collect all results in an array.

Combining Multiple Lookaheads for Validation

Lookaheads become even more powerful when combined. Each lookahead can check a different condition, and all must succeed for the overall pattern to match. This technique is particularly useful for validation, where you need to ensure multiple requirements are met without caring about the order in which they appear. Let's validate passwords that must contain at least one lowercase letter, at least one uppercase letter, and at least one digit, with a minimum length of eight characters.

JavaScript

function validateStrongPassword(p) {
  // Use lookaheads to require at least one lowercase, uppercase, and digit; min length 8
  // Each (?=...) assertion checks the entire string without consuming characters
  const pattern = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$/;
  return pattern.test(p);
}

function validateStrongPassword(p) {
  // Use lookaheads to require at least one lowercase, uppercase, and digit; min length 8
  // Each (?=...) assertion checks the entire string without consuming characters
  const pattern = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$/;
  return pattern.test(p);
}

This pattern employs three positive lookaheads in sequence:

^ anchors the pattern to the start of the string.
(?=.*[a-z]) checks that somewhere in the string there's at least one lowercase letter; the .* matches any characters leading up to it.
(?=.*[A-Z]) similarly checks for at least one uppercase letter anywhere in the string.
(?=.*\d) ensures at least one digit appears somewhere.
.{8,} finally matches the actual password, requiring at least eight characters of any type.
$ anchors the pattern to the end of the string.

The beauty of this approach is that each lookahead starts from the same position at the beginning of the string and scans forward independently. They don't interfere with each other or consume characters, so all three can verify their conditions regardless of where those characters appear in the password. After all lookaheads succeed, the .{8,} does the actual matching to ensure sufficient length. The .test() method returns a boolean directly, making it perfect for validation. This pattern would reject "Password" (no digit), "password1" (no uppercase), "PASSWORD1" (no lowercase), and "Pass1" (too short), while accepting "Password1" or "StrongP4ss."

Introduction

Understanding Lookaheads and Zero-Width Assertions

Join the 1M+ learners on CodeSignal

Positive Lookaheads for Context-Aware Matching

Testing Price Extraction with Lookaheads

Negative Lookaheads to Exclude Patterns

Testing Password Extraction

Combining Multiple Lookaheads for Validation

Testing Strong Password Validation

Conclusion and Next Steps