JavaScript RegExp {X,Y} Quantifier

What You’ll Learn

The {X,Y} quantifier matches the previous token between X and Y times, inclusive. Use \d{2,4} for two-to-four digits, {8,64} for password length limits, and remember that ? is shorthand for {0,1}.

Introduction

Exact counts ({4}) and open-ended minimums ({3,}) cover many cases. But real-world rules often need both a floor and a ceiling: usernames between 3 and 16 characters, area codes with two to four digits, or hex colors with three to six hex digits. The {X,Y} quantifier sets that bounded range.

Write {n,m} where n is the minimum and m is the maximum number of repetitions. The engine matches at least n and at most m of the preceding token. Combined with anchors, this is the standard way to enforce field length limits in regex validation.

Understanding the {X,Y} Range Quantifier

Place {n,m} immediately after a token. The engine tries to match that token at least n times and no more than m times. By default it is greedy—it prefers the maximum allowed count when possible.

/^\d{2,4}$/.test("12");     // true

/^\d{2,4}$/.test("1234");   // true

/^\d{2,4}$/.test("12345");  // false — exceeds max

/^\d{2,4}$/.test("1");      // false — below min



"12345".match(/\d{2,4}/);   // ["1234"] — greedy max in range

Without anchors, {n,m} finds a qualifying substring anywhere in the input. With ^ and $, the entire value must fall within the range.

How to Use the {X,Y} Quantifier

Attach {n,m} after a character class, metacharacter, dot, or grouped expression:

/\d{2,4}/;                    // 2 to 4 digits

/^.{8,64}$/;                  // 8–64 chars (password)

/(ha){2,3}/;                  // 2–3 ha units

/colou?r/;                    // same as /colou{0,1}r/

/#[0-9a-fA-F]{3,6}/;          // hex color length

Use test() for validation, match() to extract the bounded run, and {n,m}? when you need the shortest match that still satisfies the range.

📝 Syntax

token{n,m}         // between n and m repetitions (inclusive)

{0,1}              // zero or one (same as ?)

{n,n}              // exactly n (same as {n})

{n,}               // at least n (no max)

\d{2,4}            // 2–4 digits

.{3,16}            // 3–16 any characters

Common patterns

• /^\d{2,4}$/ — whole field is two to four digits.
• /^[\w]{3,16}$/ — username between 3 and 16 word characters.
• /#[0-9a-fA-F]{3,6}/ — CSS hex color with 3–6 hex digits.
• /colou{0,1}r/ — optional u for colour/color (same as colou?r).
• /(ab){2,4}/ — two to four repetitions of the ab group.

Examples Gallery

Open DevTools Console (F12) or use Try-it links. Examples cover digit range validation, greedy matching within bounds, grouped repetition, password length rules, and hex color patterns.

const rule = /^\d{2,4}$/;



["12", "123", "1234", "12345", "1"].forEach((s) => {

  console.log(s, rule.test(s));

});

// 12    true

// 123   true

// 1234  true

// 12345 false

// 1     false

12 true

123 true

1234 true

12345 false

1 false

console.log("12345".match(/\d{2,4}/));  // ["1234"]

console.log("99".match(/\d{2,4}/));      // ["99"]

console.log("1".match(/\d{2,4}/));       // null



console.log("aaaa".match(/a{1,3}/g));    // ["aaa", "a"]

["1234"]

["99"]

null

["aaa", "a"]

const words = ["ha", "haha", "hahaha", "hahahaha"];



words.forEach((w) => {

  console.log(w, /(ha){2,3}/.test(w));

});

// ha        false — only one unit

// haha      true  — exactly two

// hahaha    true  — exactly three

// hahahaha  true  — contains hahaha (3 units)

ha false

haha true

hahaha true

hahahaha true

const rule = /^.{8,64}$/;



console.log(rule.test("short"));       // false — too short

console.log(rule.test("longenough"));  // true

console.log(rule.test("a".repeat(64))); // true — at max

console.log(rule.test("a".repeat(65))); // false — over max

false

true

true

false

const colors = ["#abc", "#abcdef", "#ab", "#ghijkl"];



colors.forEach((c) => {

  console.log(c, /#[0-9a-fA-F]{3,6}/.test(c));

});

// #abc      true

// #abcdef   true

// #ab       false — too short

// #ghijkl   false — g is not hex

#abc true

#abcdef true

#ab false

#ghijkl false

🚀 Common Use Cases

• Field length limits — usernames, passwords, and comments with min/max character counts.
• Numeric codes — product codes or PINs that must be within a digit range.
• Hex and binary formats — color codes, hashes, or encoded values with variable but bounded width.
• Optional suffixes — {0,1} or ? for optional letters like British/American spelling.
• Repeated units — grouped patterns that may repeat a limited number of times.
• Input sanitization — flag values that exceed expected repetition bounds in log data.

Important Considerations

• Min ≤ max — {4,2} is invalid; JavaScript throws SyntaxError when creating the RegExp.
• Greedy default — {n,m} prefers the maximum count; use {n,m}? for minimal matching.
• Group precedence — ab{2,4} repeats only b; use (ab){2,4} for the full pair.
• Substring vs whole field — add ^…$ when the entire input must satisfy the range.
• Not semantic validation — length-range regex does not verify content quality or meaning.
• Prefer ? for optional — {0,1} and ? are equivalent; ? is usually more readable.

📝 Notes

• ? is shorthand for {0,1}; see the ? quantifier page.
• Previous topic: {X,} at-least quantifier.
• Exact count: {X} and {n,n} equivalence.
• Lazy variant: {n,m}? matches as few repetitions as possible.
• Pair with ^ and $ for whole-field range validation.
• This completes the brace quantifier family: {n}, {n,}, and {n,m}.

💡 Best Practices