Sign inDemoInstall


Package Overview
File Explorer

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies



Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

Version published
Weekly downloads
decreased by-16.56%
Weekly downloads

Package description

What is picomatch?

The picomatch npm package is a minimal matching utility that uses glob patterns to test, match, or parse strings. It is designed to be a faster and lighter alternative to other pattern matching libraries, with a focus on performance and accuracy.

What are picomatch's main functionalities?

Glob matching

Use picomatch to create a matcher function for glob patterns, which can then be used to test if strings match the pattern.

const picomatch = require('picomatch');
const isMatch = picomatch('*.js');
console.log(isMatch('file.js')); // true
console.log(isMatch('file.txt')); // false

Multiple patterns

Create a matcher function that can handle multiple patterns, including negation patterns, to match against strings.

const picomatch = require('picomatch');
const isMatch = picomatch(['*.js', '!foo.js']);
console.log(isMatch('file.js')); // true
console.log(isMatch('foo.js')); // false

Parse glob patterns

Parse glob patterns to analyze their structure and components, which can be useful for understanding the pattern or for further processing.

const picomatch = require('picomatch');
const result = picomatch.parse('*.js');

Other packages similar to picomatch





  • Support stars in negation extglobs with expression after closing parenthesis #102, thanks to @mrmlnc




version test status coverage status downloads

Blazing fast and accurate glob matcher written in JavaScript.
No dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

Why picomatch?

  • Lightweight - No dependencies
  • Minimal - Tiny API surface. Main export is a function that takes a glob pattern and returns a matcher function.
  • Fast - Loads in about 2ms (that's several times faster than a single frame of a HD movie at 60fps)
  • Performant - Use the returned matcher function to speed up repeat matching (like when watching files)
  • Accurate matching - Using wildcards (* and ?), globstars (**) for nested directories, advanced globbing with extglobs, braces, and POSIX brackets, and support for escaping special characters with \ or quotes.
  • Well tested - Thousands of unit tests

See the library comparison to other libraries.

Table of Contents

Click to expand

(TOC generated by verb using markdown-toc)


Install with npm:

npm install --save picomatch


The main export is a function that takes a glob pattern and an options object and returns a function for matching strings.

const pm = require('picomatch');
const isMatch = pm('*.js');

console.log(isMatch('abcd')); //=> false
console.log(isMatch('a.js')); //=> true
console.log(isMatch('')); //=> false
console.log(isMatch('a/b.js')); //=> false



Creates a matcher function from one or more glob patterns. The returned function takes a string to match as its first argument, and returns true if the string is a match. The returned matcher function also takes a boolean as the second argument that, when true, returns an object with additional information.


  • globs {String|Array}: One or more glob patterns.
  • options {Object=}
  • returns {Function=}: Returns a matcher function.


By default, picomatch uses os.platform() to detect the operating system.

const picomatch = require('picomatch');
// picomatch(glob[, options]);

const isMatch = picomatch('*.!(*a)');
console.log(isMatch('a.a')); //=> false
console.log(isMatch('a.b')); //=> true

Example without node.js

For environments without node.js, picomatch/posix provides you a dependency-free matcher, without automatic OS detection.

const picomatch = require('picomatch/posix');
// the same API, defaulting to posix paths
const isMatch = picomatch('a/*');
console.log(isMatch('a\\b')); //=> false
console.log(isMatch('a/b')); //=> true

// you can still configure the matcher function to accept windows paths
const isMatch = picomatch('a/*', { options: windows });
console.log(isMatch('a\\b')); //=> true
console.log(isMatch('a/b')); //=> true


Test input with the given regex. This is used by the main picomatch() function to test the input string.


  • input {String}: String to test.
  • regex {RegExp}
  • returns {Object}: Returns an object with matching info.


const picomatch = require('picomatch');
// picomatch.test(input, regex[, options]);

console.log(picomatch.test('foo/bar', /^(?:([^/]*?)\/([^/]*?))$/));
// { isMatch: true, match: [ 'foo/', 'foo', 'bar' ], output: 'foo/bar' }


Match the basename of a filepath.


  • input {String}: String to test.
  • glob {RegExp|String}: Glob pattern or regex created by .makeRe.
  • returns {Boolean}


const picomatch = require('picomatch');
// picomatch.matchBase(input, glob[, options]);
console.log(picomatch.matchBase('foo/bar.js', '*.js'); // true


Returns true if any of the given glob patterns match the specified string.


  • {String|Array}: str The string to test.
  • {String|Array}: patterns One or more glob patterns to use for matching.
  • {Object}: See available options.
  • returns {Boolean}: Returns true if any patterns match str


const picomatch = require('picomatch');
// picomatch.isMatch(string, patterns[, options]);

console.log(picomatch.isMatch('a.a', ['b.*', '*.a'])); //=> true
console.log(picomatch.isMatch('a.a', 'b.*')); //=> false


Parse a glob pattern to create the source string for a regular expression.


  • pattern {String}
  • options {Object}
  • returns {Object}: Returns an object with useful properties and output to be used as a regex source string.


const picomatch = require('picomatch');
const result = picomatch.parse(pattern[, options]);


Scan a glob pattern to separate the pattern into segments.


  • input {String}: Glob pattern to scan.
  • options {Object}
  • returns {Object}: Returns an object with


const picomatch = require('picomatch');
// picomatch.scan(input[, options]);

const result = picomatch.scan('!./foo/*.js');
{ prefix: '!./',
  input: '!./foo/*.js',
  start: 3,
  base: 'foo',
  glob: '*.js',
  isBrace: false,
  isBracket: false,
  isGlob: true,
  isExtglob: false,
  isGlobstar: false,
  negated: true }


Compile a regular expression from the state object returned by the parse() method.


  • state {Object}
  • options {Object}
  • returnOutput {Boolean}: Intended for implementors, this argument allows you to return the raw output from the parser.
  • returnState {Boolean}: Adds the state to a state property on the returned regex. Useful for implementors and debugging.
  • returns {RegExp}


Create a regular expression from a parsed glob pattern.


  • state {String}: The object returned from the .parse method.
  • options {Object}
  • returnOutput {Boolean}: Implementors may use this argument to return the compiled output, instead of a regular expression. This is not exposed on the options to prevent end-users from mutating the result.
  • returnState {Boolean}: Implementors may use this argument to return the state from the parsed glob with the returned regular expression.
  • returns {RegExp}: Returns a regex created from the given pattern.


const picomatch = require('picomatch');
const state = picomatch.parse('*.js');
// picomatch.compileRe(state[, options]);

//=> /^(?:(?!\.)(?=.)[^/]*?\.js)$/


Create a regular expression from the given regex source string.


  • source {String}: Regular expression source string.
  • options {Object}
  • returns {RegExp}


const picomatch = require('picomatch');
// picomatch.toRegex(source[, options]);

const { output } = picomatch.parse('*.js');
//=> /^(?:(?!\.)(?=.)[^/]*?\.js)$/


Picomatch options

The following options may be used with the main picomatch() function or any of the methods on the picomatch API.

OptionTypeDefault valueDescription
basenamebooleanfalseIf set, then patterns without slashes will be matched against the basename of the path if it contains slashes. For example, a?b would match the path /xyz/123/acb, but not /xyz/acb/123.
bashbooleanfalseFollow bash matching rules more strictly - disallows backslashes as escape characters, and treats single stars as globstars (**).
capturebooleanundefinedReturn regex matches in supporting methods.
containsbooleanundefinedAllows glob to match any part of the given string(s).
cwdstringprocess.cwd()Current working directory. Used by picomatch.split()
debugbooleanundefinedDebug regular expressions when an error is thrown.
dotbooleanfalseEnable dotfile matching. By default, dotfiles are ignored unless a . is explicitly defined in the pattern, or is true
expandRangefunctionundefinedCustom function for expanding ranges in brace patterns, such as {a..z}. The function receives the range values as two arguments, and it must return a string to be used in the generated regex. It's recommended that returned strings be wrapped in parentheses.
failglobbooleanfalseThrows an error if no matches are found. Based on the bash option of the same name.
fastpathsbooleantrueTo speed up processing, full parsing is skipped for a handful common glob patterns. Disable this behavior by setting this option to false.
flagsstringundefinedRegex flags to use in the generated regex. If defined, the nocase option will be overridden.
formatfunctionundefinedCustom function for formatting the returned string. This is useful for removing leading slashes, converting Windows paths to Posix paths, etc.
ignorearray|stringundefinedOne or more glob patterns for excluding strings that should not be matched from the result.
keepQuotesbooleanfalseRetain quotes in the generated regex, since quotes may also be used as an alternative to backslashes.
literalBracketsbooleanundefinedWhen true, brackets in the glob pattern will be escaped so that only literal brackets will be matched.
matchBasebooleanfalseAlias for basename
maxLengthboolean65536Limit the max length of the input string. An error is thrown if the input string is longer than this value.
nobracebooleanfalseDisable brace matching, so that {a,b} and {1..3} would be treated as literal characters.
nobracketbooleanundefinedDisable matching with regex brackets.
nocasebooleanfalseMake matching case-insensitive. Equivalent to the regex i flag. Note that this option is overridden by the flags option.
nodupesbooleantrueDeprecated, use nounique instead. This option will be removed in a future major release. By default duplicates are removed. Disable uniquification by setting this option to false.
noextbooleanfalseAlias for noextglob
noextglobbooleanfalseDisable support for matching with extglobs (like +(a|b))
noglobstarbooleanfalseDisable support for matching nested directories with globstars (**)
nonegatebooleanfalseDisable support for negating with leading !
noquantifiersbooleanfalseDisable support for regex quantifiers (like a{1,2}) and treat them as brace patterns to be expanded.
onIgnorefunctionundefinedFunction to be called on ignored items.
onMatchfunctionundefinedFunction to be called on matched items.
onResultfunctionundefinedFunction to be called on all items, regardless of whether or not they are matched or ignored.
posixbooleanfalseSupport POSIX character classes ("posix brackets").
posixSlashesbooleanundefinedConvert all slashes in file paths to forward slashes. This does not convert slashes in the glob pattern itself
prependbooleanundefinedString to prepend to the generated regex used for matching.
regexbooleanfalseUse regular expression rules for + (instead of matching literal +), and for stars that follow closing parentheses or brackets (as in )* and ]*).
strictBracketsbooleanundefinedThrow an error if brackets, braces, or parens are imbalanced.
strictSlashesbooleanundefinedWhen true, picomatch won't match trailing slashes with single stars.
unescapebooleanundefinedRemove backslashes preceding escaped characters in the glob pattern. By default, backslashes are retained.
unixifybooleanundefinedAlias for posixSlashes, for backwards compatibility.
windowsbooleanfalseAlso accept backslashes as the path separator.

picomatch has automatic detection for regex positive and negative lookbehinds. If the pattern contains a negative lookbehind, you must be using Node.js >= 8.10 or else picomatch will throw an error.

Scan Options

In addition to the main picomatch options, the following options may also be used with the .scan method.

OptionTypeDefault valueDescription
tokensbooleanfalseWhen true, the returned object will include an array of tokens (objects), representing each path "segment" in the scanned glob pattern
partsbooleanfalseWhen true, the returned object will include an array of strings representing each path "segment" in the scanned glob pattern. This is automatically enabled when options.tokens is true


const picomatch = require('picomatch');
const result = picomatch.scan('!./foo/*.js', { tokens: true });
// {
//   prefix: '!./',
//   input: '!./foo/*.js',
//   start: 3,
//   base: 'foo',
//   glob: '*.js',
//   isBrace: false,
//   isBracket: false,
//   isGlob: true,
//   isExtglob: false,
//   isGlobstar: false,
//   negated: true,
//   maxDepth: 2,
//   tokens: [
//     { value: '!./', depth: 0, isGlob: false, negated: true, isPrefix: true },
//     { value: 'foo', depth: 1, isGlob: false },
//     { value: '*.js', depth: 1, isGlob: true }
//   ],
//   slashes: [ 2, 6 ],
//   parts: [ 'foo', '*.js' ]
// }

Options Examples


Type: function

Default: undefined

Custom function for expanding ranges in brace patterns. The fill-range library is ideal for this purpose, or you can use custom code to do whatever you need.


The following example shows how to create a glob that matches a folder

const fill = require('fill-range');
const regex = pm.makeRe('foo/{01..25}/bar', {
  expandRange(a, b) {
    return `(${fill(a, b, { toRegex: true })})`;

//=> /^(?:foo\/((?:0[1-9]|1[0-9]|2[0-5]))\/bar)$/

console.log(regex.test('foo/00/bar'))  // false
console.log(regex.test('foo/01/bar'))  // true
console.log(regex.test('foo/10/bar')) // true
console.log(regex.test('foo/22/bar')) // true
console.log(regex.test('foo/25/bar')) // true
console.log(regex.test('foo/26/bar')) // false

Type: function

Default: undefined

Custom function for formatting strings before they're matched.


// strip leading './' from strings
const format = str => str.replace(/^\.\//, '');
const isMatch = picomatch('foo/*.js', { format });
console.log(isMatch('./foo/bar.js')); //=> true
const onMatch = ({ glob, regex, input, output }) => {
  console.log({ glob, regex, input, output });

const isMatch = picomatch('*', { onMatch });
const onIgnore = ({ glob, regex, input, output }) => {
  console.log({ glob, regex, input, output });

const isMatch = picomatch('*', { onIgnore, ignore: 'f*' });
const onResult = ({ glob, regex, input, output }) => {
  console.log({ glob, regex, input, output });

const isMatch = picomatch('*', { onResult, ignore: 'f*' });

Globbing features

Basic globbing

*Matches any character zero or more times, excluding path separators. Does not match path separators or hidden files or directories ("dotfiles"), unless explicitly enabled by setting the dot option to true.
**Matches any character zero or more times, including path separators. Note that ** will only match path separators (/, and \\ with the windows option) when they are the only characters in a path segment. Thus, foo**/bar is equivalent to foo*/bar, and foo/a**b/bar is equivalent to foo/a*b/bar, and more than two consecutive stars in a glob path segment are regarded as a single star. Thus, foo/***/bar is equivalent to foo/*/bar.
?Matches any character excluding path separators one time. Does not match path separators or leading dots.
[abc]Matches any characters inside the brackets. For example, [abc] would match the characters a, b or c, and nothing else.
Matching behavior vs. Bash

Picomatch's matching features and expected results in unit tests are based on Bash's unit tests and the Bash 4.3 specification, with the following exceptions:

  • Bash will match foo/bar/baz with *. Picomatch only matches nested directories with **.
  • Bash greedily matches with negated extglobs. For example, Bash 4.3 says that !(foo)* should match foo and foobar, since the trailing * bracktracks to match the preceding pattern. This is very memory-inefficient, and IMHO, also incorrect. Picomatch would return false for both foo and foobar.

Advanced globbing

@(pattern)Match only one consecutive occurrence of pattern
*(pattern)Match zero or more consecutive occurrences of pattern
+(pattern)Match one or more consecutive occurrences of pattern
?(pattern)Match zero or one consecutive occurrences of pattern
!(pattern)Match anything but pattern


const pm = require('picomatch');

// *(pattern) matches ZERO or more of "pattern"
console.log(pm.isMatch('a', 'a*(z)')); // true
console.log(pm.isMatch('az', 'a*(z)')); // true
console.log(pm.isMatch('azzz', 'a*(z)')); // true

// +(pattern) matches ONE or more of "pattern"
console.log(pm.isMatch('a', 'a+(z)')); // false
console.log(pm.isMatch('az', 'a+(z)')); // true
console.log(pm.isMatch('azzz', 'a+(z)')); // true

// supports multiple extglobs
console.log(pm.isMatch('', '!(foo).!(bar)')); // false

// supports nested extglobs
console.log(pm.isMatch('', '!(!(foo)).!(!(bar))')); // true
POSIX brackets

POSIX classes are disabled by default. Enable this feature by setting the posix option to true.

Enable POSIX bracket support

console.log(pm.makeRe('[[:word:]]+', { posix: true }));
//=> /^(?:(?=.)[A-Za-z0-9_]+\/?)$/

Supported POSIX classes

The following named POSIX bracket expressions are supported:

  • [:alnum:] - Alphanumeric characters, equ [a-zA-Z0-9]
  • [:alpha:] - Alphabetical characters, equivalent to [a-zA-Z].
  • [:ascii:] - ASCII characters, equivalent to [\\x00-\\x7F].
  • [:blank:] - Space and tab characters, equivalent to [ \\t].
  • [:cntrl:] - Control characters, equivalent to [\\x00-\\x1F\\x7F].
  • [:digit:] - Numerical digits, equivalent to [0-9].
  • [:graph:] - Graph characters, equivalent to [\\x21-\\x7E].
  • [:lower:] - Lowercase letters, equivalent to [a-z].
  • [:print:] - Print characters, equivalent to [\\x20-\\x7E ].
  • [:punct:] - Punctuation and symbols, equivalent to [\\-!"#$%&\'()\\*+,./:;<=>?@[\\]^_{|}~]`.
  • [:space:] - Extended space characters, equivalent to [ \\t\\r\\n\\v\\f].
  • [:upper:] - Uppercase letters, equivalent to [A-Z].
  • [:word:] - Word characters (letters, numbers and underscores), equivalent to [A-Za-z0-9_].
  • [:xdigit:] - Hexadecimal digits, equivalent to [A-Fa-f0-9].

See the Bash Reference Manual for more information.


Picomatch does not do brace expansion. For brace expansion and advanced matching with braces, use micromatch instead. Picomatch has very basic support for braces.

Matching special characters as literals

If you wish to match the following special characters in a filepath, and you want to use these characters in your glob pattern, they must be escaped with backslashes or quotes:

Special Characters

Some characters that are used for matching in regular expressions are also regarded as valid file path characters on some platforms.

To match any of the following characters as literals: `$^*+?()[]


console.log(pm.makeRe('foo/bar \\(1\\)'));
console.log(pm.makeRe('foo/bar \\(1\\)'));

Library Comparisons

The following table shows which features are supported by minimatch, micromatch, picomatch, nanomatch, extglob, braces, and expand-brackets.

Wildcard matching (*?+)---
Advancing globbing----
Brace matching---
Brace expansion----
Posix brackets----
Regular expression syntax--
File system operations-------


Performance comparison of picomatch and minimatch.

# .makeRe star
  picomatch x 1,993,050 ops/sec ±0.51% (91 runs sampled)
  minimatch x 627,206 ops/sec ±1.96% (87 runs sampled))

# .makeRe star; dot=true
  picomatch x 1,436,640 ops/sec ±0.62% (91 runs sampled)
  minimatch x 525,876 ops/sec ±0.60% (88 runs sampled)

# .makeRe globstar
  picomatch x 1,592,742 ops/sec ±0.42% (90 runs sampled)
  minimatch x 962,043 ops/sec ±1.76% (91 runs sampled)d)

# .makeRe globstars
  picomatch x 1,615,199 ops/sec ±0.35% (94 runs sampled)
  minimatch x 477,179 ops/sec ±1.33% (91 runs sampled)

# .makeRe with leading star
  picomatch x 1,220,856 ops/sec ±0.40% (92 runs sampled)
  minimatch x 453,564 ops/sec ±1.43% (94 runs sampled)

# .makeRe - basic braces
  picomatch x 392,067 ops/sec ±0.70% (90 runs sampled)
  minimatch x 99,532 ops/sec ±2.03% (87 runs sampled))


The goal of this library is to be blazing fast, without compromising on accuracy.


The number one of goal of this library is accuracy. However, it's not unusual for different glob implementations to have different rules for matching behavior, even with simple wildcard matching. It gets increasingly more complicated when combinations of different features are combined, like when extglobs are combined with globstars, braces, slashes, and so on: !(**/{a,b,*/c}).

Thus, given that there is no canonical glob specification to use as a single source of truth when differences of opinion arise regarding behavior, sometimes we have to implement our best judgement and rely on feedback from users to make improvements.


Although this library performs well in benchmarks, and in most cases it's faster than other popular libraries we benchmarked against, we will always choose accuracy over performance. It's not helpful to anyone if our library is faster at returning the wrong answer.



Pull requests and stars are always welcome. For bugs and feature requests, please create an issue.

Please read the contributing guide for advice on opening issues, pull requests, and coding standards.

Running Tests

Running and reviewing unit tests is a great way to get familiarized with a library and its API. You can install dependencies and run tests with the following command:

npm install && npm test
Building docs

(This project's is generated by verb, please don't edit the readme directly. Any changes to the readme must be made in the readme template.)

To generate the readme, run the following command:

npm install -g verbose/verb#dev verb-generate-readme && verb


Jon Schlinkert


Copyright © 2017-present, Jon Schlinkert. Released under the MIT License.



Package last updated on 29 Oct 2023

Did you know?


Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.


Related posts

SocketSocket SOC 2 Logo


  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap


Stay in touch

Get open source security insights delivered straight into your inbox.

  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc