Skip to main content

How to Check if a String Contains Special Characters in JavaScript

A common validation task in JavaScript is to check if a string contains any "special characters." This is often required for password strength validation or for sanitizing input to ensure it doesn't contain unwanted symbols. The most powerful and reliable tool for this job is a regular expression.

This guide will teach you the best-practice method for detecting special characters using a negated regular expression with the .test() method. You will also learn how to modify this pattern to allow certain characters (like spaces) and how to remove all special characters from a string.

Core Problem: Defining a "Special Character"​

The most significant challenge is that the term "special character" is subjective. Trying to create a list of every possible symbol (!@#$%^&*()...) is difficult and error-prone.

A much more robust approach is to define what characters are allowed (e.g., letters and numbers) and then search for any character that falls outside that set. This way, you don't need to know what the special character is, only that it's not a letter or a number.

Core Method: A Negated Regex with RegExp.test()​

The RegExp.prototype.test() method is the best tool for a simple true/false check. It returns true if it finds a match for the pattern anywhere in the string.

Problem: you have a string and need to confirm if it contains any character that is not a letter or a number.

// Problem: How to validate these strings?
const str1 = 'username123';  // No special characters
const str2 = 'user-name!';   // Contains special characters
const str3 = 'User Name';    // Contains a special character (space)

Solution: this function uses a negated regular expression to find any non-alphanumeric character.

function containsSpecialChars(str) {
  // This regex looks for any character that is NOT a letter or a number.
  const specialChars = /[^a-zA-Z0-9]/;
  return specialChars.test(str);
}

// Example Usage:
console.log(containsSpecialChars('username123')); // Output: false
console.log(containsSpecialChars('user-name!'));   // Output: true
console.log(containsSpecialChars('User Name'));    // Output: true

How the Regular Expression Works​

Let's break down the regex /[^a-zA-Z0-9]/:

  • /.../: The forward slashes that enclose the regular expression pattern.
  • [...]: Defines a character set. The pattern will match any single character found inside these brackets.
  • ^: When used as the first character inside a character set, the caret is a special metacharacter that negates the set. It means "match any character that is NOT in this set."
    • a-z: Any lowercase letter.
    • A-Z: Any uppercase letter.
    • 0-9: Any digit.

So, /[^a-zA-Z0-9]/ means "find a character that is not a lowercase letter, not an uppercase letter, and not a digit."

How to Allow Spaces​

If you want to allow spaces and only consider other symbols as "special," you can add the space character to your negated set.

function containsSpecialChars(str) {
  // This regex looks for anything that is NOT a letter, number, or space.
  const specialChars = /[^a-zA-Z0-9 ]/; 
  return specialChars.test(str);
}

console.log(containsSpecialChars('User Name')); // Output: false (now valid)
console.log(containsSpecialChars('User-Name')); // Output: true (still invalid)

How to Remove All Special Characters from a String​

Instead of just detecting special characters, you might want to sanitize a string by removing them. The String.prototype.replace() method is the perfect tool for this.

By adding the global flag (g) to our regex, we can replace all occurrences, not just the first one.

function sanitize(str) {
  // The 'g' flag ensures all matches are replaced.
  return str.replace(/[^a-zA-Z0-9]/g, '');
}

// Example Usage:
const dirtyString = 'My File Name! (final).txt';
const cleanString = sanitize(dirtyString);

console.log(cleanString); // Output: MyFileNamefinaltxt

Practical Example: Password Strength Validation​

A common security rule is to require a password to contain at least one special character. Our containsSpecialChars function is perfect for this.

function validatePassword(password) {
  if (password.length < 8) {
    console.log('[ERROR] Password must be at least 8 characters long.');
    return false;
  }

  // Use our function to check for the presence of a special character.
  if (!containsSpecialChars(password)) {
    console.log('[ERROR] Password must contain at least one special character.');
    return false;
  }

  console.log('[SUCCESS] Password meets the requirements.');
  return true;
}

// Example Usage:
validatePassword('password123');    // Output: [ERROR] Password must contain...
validatePassword('Password!123');   // Output: [SUCCESS] Password meets...

Conclusion​

Using a negated regular expression is the definitive method for working with special characters in JavaScript.

  • To check if a string contains a special character, use the pattern /[^a-zA-Z0-9]/.test(str).
  • To allow specific characters (like spaces), add them to the negated set: /[^a-zA-Z0-9 ]/.
  • To remove all special characters from a string, use the global negated pattern with replace(): str.replace(/[^a-zA-Z0-9]/g, '').

This approach is far more robust and maintainable than trying to manually list every possible special character.

Table of Contents