JavaScript RegExp (?!...) Negative Lookahead

What You’ll Learn

The (?!...) syntax is a negative lookahead assertion. It lets you match text only when it is not followed by a specific pattern—without consuming the characters you peek at. It is zero-width, powerful for exclusions, and a stepping stone into advanced regex.

Introduction

Sometimes you need to match part of a string while rejecting certain what-comes-next situations. For example, match foo but not when it is immediately followed by bar. You could try long alternation lists, but negative lookahead expresses the rule directly: /foo(?!bar)/.

Old tutorials often call (?!...) a “quantifier,” but that name is misleading. Quantifiers like + and * repeat tokens. Lookahead is an assertion: a condition on upcoming text that does not become part of the final match. Think of it as peeking ahead and saying “only continue if the next characters are not what I forbid.”

Understanding (?!...) Negative Lookahead

Syntax: (?!pattern) where pattern is any valid regex sub-expression. When the engine reaches this point, it checks whether the text starting at the current position matches pattern. If it does, the assertion fails; if it does not, the assertion succeeds and matching continues.

const samples = ["foobar", "foobaz", "foo"];

samples.forEach((s) => {
  console.log(s, s.match(/foo(?!bar)/));
});
// foobar null
// foobaz ["foo"]
// foo    ["foo"]

In "foobar", foo is followed by bar, so (?!bar) fails. In "foobaz", the next characters are baz, not bar, so the match succeeds and returns only "foo"—the lookahead text is not included.

How to Use Negative Lookahead

Place (?!...) immediately after the text you want to conditionally match, or at the start of a pattern to reject entire strings:

/foo(?!bar)/;                       // foo not followed by bar
/\d+(?! dollars)/g;                 // numbers not followed by " dollars"
/^(?!.*password).{8,}$/i;          // 8+ chars, no "password"
new RegExp("foo(?!bar)");           // constructor form

"http://a.com".match(/http(?!s)/); // ["http"] — not https

Combine with the global flag when you need every qualifying match in a string. Use anchors (^, $) inside lookaheads for whole-string validation rules.

📝 Syntax

(?!pattern)          // negative lookahead — must NOT follow
(?=pattern)          // positive lookahead — MUST follow (contrast)
(?!foo|bar)          // not followed by foo OR bar
^(?!.*badword).+$    // whole string must not contain badword
token(?!suffix)      // token only when suffix absent

Common patterns

• /foo(?!bar)/ — match foo unless bar follows.
• /http(?!s)/ — match http but not https.
• /\d+(?! dollars)/g — numbers not immediately followed by dollars.
• /^(?!.*@spam\.com$).+@.+/ — emails not from blocked domain.

Examples Gallery

Open DevTools Console (F12) or use Try-it links. Examples cover basic exclusion, number filtering, password rules, domain blocking, and side-by-side comparison with plain matching.

const words = ["foobar", "foobaz", "foo"];

words.forEach((w) => {
  console.log(w, w.match(/foo(?!bar)/));
});
// foobar null
// foobaz ["foo"]
// foo    ["foo"]

foobar null
foobaz ["foo"]
foo ["foo"]

const urls = [
  "http://example.com",
  "https://secure.com",
  "http://legacy.org"
];

urls.forEach((url) => {
  console.log(url, url.match(/http(?!s)/));
});
// http://example.com  ["http"]
// https://secure.com  null
// http://legacy.org   ["http"]

http://example.com ["http"]
https://secure.com null
http://legacy.org ["http"]

const rule = /^(?!.*password).{8,}$/i;

console.log(rule.test("MySecret1!"));        // true
console.log(rule.test("short"));             // false — too short
console.log(rule.test("myPassword123"));     // false — contains "password"

true
false
false

const allowed = /^(?!.*@spam\.com$)[^\s@]+@[^\s@]+\.[^\s@]+$/;

console.log(allowed.test("user@example.com"));  // true
console.log(allowed.test("bot@spam.com"));      // false
console.log(allowed.test("not-an-email"));      // false

true
false
false

const text = "5 dollars and 10 coins";

console.log(text.match(/\d+/g));              // ["5", "10"]
console.log(text.match(/\d+(?! dollars)/g));  // ["10"]

["5", "10"]
["10"]

🚀 Common Use Cases

• Protocol checks — match http but exclude https, or similar prefix rules.
• Password / input rules — forbid dictionary words or forbidden substrings anywhere in a value.
• Content filtering — block emails, URLs, or IDs from deny lists with lookahead at ^.
• Parser guards — distinguish similar syntax (e.g., foo vs foobar) without long alternation.
• Search refinement — find numbers, words, or codes that are not part of a larger known pattern.
• Password-free validation — combine multiple lookaheads for complex AND/OR rules on one string.

Important Considerations

• Zero-width — matched text never includes the lookahead portion; only the part before it appears in results.
• Not a quantifier — (?!...) does not repeat characters; it adds a condition on what follows.
• Lookbehind counterpart — JavaScript also has (?<!...) negative lookbehind (ES2018), which checks text before the position instead of after.
• Performance — nested or many lookaheads on huge strings can slow matching; keep patterns focused.
• Anchor placement — ^(?!.*bad) validates the whole string; mid-pattern (?!bad) checks only what comes next.
• Constructor escaping — in new RegExp() strings, backslashes need doubling: "(?!\\\\d)".

📝 Notes

• Positive counterpart: (?=...) (covered on the quantifier-positive page when published).
• Previous topic: $ end anchor.
• Next topic: + one-or-more quantifier.
• Lookahead differs from the $ anchor, which only checks end-of-string/line.
• For “must contain” rules, positive lookahead (?=.*digit) is the usual pattern.
• See (x|y) alternation when you need to list allowed forms instead of forbidding one.

💡 Best Practices