String.prototype.startsWith()
Tests whether a string begins with the given characters, returning true or false.
startsWith(searchString)
startsWith(searchString, position)- Added in JavaScript ECMAScript 2015
Parameters
| Parameter | Type | Description |
|---|---|---|
$searchString | string | The characters expected at the start of the string. Cannot be a regex; all other values are coerced to strings. |
$positionoptional | number= 0 | The index at which searchString is expected to begin — that is, the position treated as the start of the string. |
Return value
booleantrue if the characters are found at the start of the string (including when searchString is empty); otherwise false.
Errors
Throws a TypeError if searchString is a regular expression.
startsWith() replaces two older idioms — str.indexOf(p) === 0 and str.slice(0, p.length) === p — with something that says what it means and allocates nothing.
The position argument
The second argument moves the anchor point: str.startsWith(x, n) asks whether x begins exactly at index n. It is equivalent to str.slice(n).startsWith(x) but without building the intermediate string, which makes it the efficient choice inside a scanner that walks a long document.
Gotchas
- Case-sensitive. Lowercase both sides for a user-supplied prefix.
- Regexes throw
TypeError. Use/^foo/.test(str)for a pattern anchor. - An empty prefix is always true, even against an empty string.
- It compares code units. Composed and decomposed accents that look identical will not match; run
normalize()on both sides when the text comes from users or different systems.
Security note
Do not use it alone to validate a URL or path. "https://evil.com/?x=https://example.com" fails a naive check, but so does the reverse: prefix tests on a raw path can be defeated by .. segments. Parse with URL and compare the origin instead.
Example
When to use it
- Detect a data: or blob: URL before deciding how to load it
- Filter a list of keys by a namespace prefix
- Skip shebang or comment lines while parsing a file
- Test for a Bearer token scheme on an authorization header
Frequently asked questions
How do I check if a string starts with a prefix in JavaScript?
Use str.startsWith(prefix), which returns a boolean. Pass a second argument to test whether the prefix begins at a specific index instead of at 0.
Is startsWith() case-insensitive?
No, it compares exactly. Lowercase both sides — str.toLowerCase().startsWith(p.toLowerCase()) — or use a case-insensitive anchored regex such as /^foo/i.
Why can't I pass a regex to startsWith()?
The specification throws a TypeError for regex arguments so the method is never mistaken for pattern matching. Use /^pattern/.test(str) instead.
More examples
Anchoring further into the string
The position argument gives the same answer as slicing first, without allocating the substring. Note it must be exact: index 10 is the space, so the test fails.
const line = "2026-08-31 ERROR disk full";
console.log(line.startsWith("ERROR", 11)); // true
console.log(line.slice(11).startsWith("ERROR")); // true — same answer
console.log(line.startsWith("ERROR")); // false — not at index 0
console.log(line.startsWith("ERROR", 10)); // false — off by one
const level = ["ERROR", "WARN", "INFO"].find((l) => line.startsWith(l, 11));
console.log(level); // "ERROR"Why a prefix test is not an origin test
String prefixes ignore host boundaries, so a longer hostname passes the check. Parsing with URL and comparing origins gives the answer the string test only appears to give.
const allowed = "https://example.com";
const hostile = "https://example.com.attacker.net/steal";
console.log(hostile.startsWith(allowed)); // true — but it is a different site
const sameOrigin = (u) => {
try {
return new URL(u).origin === allowed;
} catch {
return false;
}
};
console.log(sameOrigin(hostile)); // false
console.log(sameOrigin("https://example.com/ok")); // true
Discussion