What does the URL Fragment Extraction regex match?

Extracts the fragment identifier (#section) from a URL, returning the fragment without the leading #.

How is the URL Fragment Extraction regex checked for ReDoS risk?

The pattern uses a flat, non-backtracking structure with no nested quantifiers, making catastrophic backtracking impossible. RegexVault runs ReDoS-oriented static analysis and timed stress runs against adversarial inputs before publishing a pattern. That is audit evidence, not a guarantee for every engine and input — test the pattern against your own data before using it on untrusted traffic.

How do I use this regex in javascript?

// No imports required — RegExp is built into JavaScript const regex = /^[^#\s]+#([^\s]*)$/; const isValid = regex.test(input);

Web & Network/URL

ReDoS Checked

URL Fragment Extraction Regex for JavaScript

/^[^#\s]+#([^\s]*)$/

All five implementations are free. Switch engines without signing in.

What this pattern does

This page provides a lightweight, single-purpose regular expression for matching url fragment extraction, ported and verified for JavaScript. A rigorously tested regex reduces debugging time and protects your application from edge-case failures. The snippet below is ready to drop into your JavaScript project — whether you're validating in an Express middleware, a Next.js API route, or a client-side form.

Javascript Implementation

Javascript

// URL Fragment Extraction
// ReDoS-checked | RegexVault — Web & Network > URL

const urlFragmentExtractionRegex = /^[^#\s]+#([^\s]*)$/;

function validateUrlFragmentExtraction(input: string): boolean {
  return urlFragmentExtractionRegex.test(input);
}

// Example
console.log(validateUrlFragmentExtraction("https://example.com/page#section")); // true

Test Cases

Matches (Valid)	Rejects (Invalid)
`https://example.com/page#section`	`https://example.com/page`
`https://example.com#`	`no-url-at-all`
`http://example.com/docs?q=1#heading-2`	`https://example.com`
`https://example.com/path#anchor-with-hyphen`	`https://example.com#frag`
`https://example.com/#top`	—

When to use this pattern

This pattern is drawn from the Web & Network > URL category and has been checked for ReDoS risk. That matters for JavaScript developers because especially critical in long-running Node.js event loops where a ReDoS vulnerability can block the entire process. RegexVault audits patterns against known backtracking attack vectors, ensuring you have the necessary context before using this regex in a high-stakes production environment.

Common Pitfalls

A URL with multiple # characters is invalid per RFC 3986. The first # is the fragment delimiter — everything after is the fragment, including subsequent # characters if present.

Technical Notes

Capture group 1 contains the fragment string (may be empty for bare #). Fragments are client-side only — servers never receive them.

Have a pattern that belongs in the vault?

Submit it for review — community-verified patterns get credited to your GitHub handle. Submissions join the review queue after automated validation.

Submit a Pattern