Linux Commands Cheat Sheet — 200+ Commands by Task

-P

print the physical path with symlinks resolved

-L

print the logical path, symlinks kept (default)

pwd

pwd -P

-l

long format: permissions, owner, size, date

-a

include hidden dotfiles

-h

human-readable sizes (with -l): 4.0K, 12M

-t

sort by modification time, newest first

-r

reverse the sort

-S

sort by size, largest first

-d

list a directory itself, not its contents

-1

one name per line

-R

recurse into subdirectories

ls -lah

ls -ltr

ls -lS | head

ls -ld */

macOS/BSD: The flags above work on macOS. Colour is -G there (recent macOS also accepts --color).

-L N

descend at most N levels

-a

include hidden files

-d

directories only

-I pattern

skip names matching the pattern

tree -L 2 -I 'node_modules|.git'

Not installed by default on most distributions: apt install tree / dnf install tree.

-p

create parent directories as needed; no error if it exists

-m mode

set permissions, e.g. -m 700

-v

print each directory created

mkdir -p project/src/components

mkdir -p app/{src,tests,docs}

-p

also remove empty parent directories

rmdir old-folder

-c

do not create the file if it does not exist

-t stamp

set a specific time

-r ref

copy another file's timestamps

touch notes.txt

touch -t 202601011200 file

macOS/BSD: GNU touch -d accepts free text like -d '2 days ago'; macOS -d only takes YYYY-MM-DDThh:mm:SS.

-r, -R

copy directories recursively

-a

archive: recursive, keeps permissions, times, symlinks

-i

ask before overwriting

-n

never overwrite an existing file

-u

copy only when the source is newer (GNU)

-v

print each file copied

cp report.pdf ~/backup/

cp -a site/ /srv/site-backup

cp -i *.conf /etc/myapp/

macOS/BSD: macOS cp has -a, -R, -i, -n but no -u. On BSD cp a trailing slash on the source (cp -R src/ dst) copies the contents of src, not src itself.

-i

ask before overwriting

-n

never overwrite

-v

print each move

-t dir

move into dir (GNU; handy with xargs)

mv draft.txt final.txt

mv *.jpg photos/

mv -n new.conf /etc/app/app.conf

mv silently replaces an existing destination file unless you pass -i or -n.

-i

ask before each removal

-I

ask once before removing more than three files or recursing (GNU)

-r

remove directories and their contents

-f

ignore missing files, never prompt

-v

print each file removed

rm old.log

rm -i *.bak

rm -- -weird-name.txt

There is no trash or undo on the command line. Deleted means gone.

rm -rf build/

rm -rf -- "${BUILD_DIR:?}/"

Danger: No prompt, no undo. A stray space (rm -rf / tmp) or an empty variable (rm -rf "$DIR/"*) deletes far more than intended. GNU rm refuses to remove / itself (--preserve-root is the default), but nothing protects /home or /etc. Run ls on the exact path first.

-s

symbolic link (without it you get a hard link)

-f

replace an existing link

-n

treat an existing link to a directory as a plain file (use with -f)

ln -s /opt/app/bin/app /usr/local/bin/app

ln -sfn releases/v2 current

Order is target first, then the new link name, the same order as cp.

realpath ../config.yml

readlink -f /usr/bin/python3

macOS/BSD: Current macOS has both realpath and readlink -f; very old releases had neither.

-i

print the MIME type (Linux)

-b

brief: omit the file name

file download.bin

file -i notes.txt

macOS/BSD: On macOS the MIME flag is -I (capital); lowercase -i means something else there.

-c FORMAT

GNU custom output: %s size, %y mtime, %U owner, %a octal perms, %n name

stat file.txt

stat -c '%a %U %s %n' *

macOS/BSD: macOS uses -f, not -c, with different letters: stat -f '%Lp %Su %z %N' file.

-d

make a directory instead of a file

tmp=$(mktemp -d) && trap 'rm -rf "$tmp"' EXIT

-n

number all lines

-A

show tabs as ^I and line ends as $ (GNU); reveals CRLF line endings

cat /etc/os-release

cat part1.txt part2.txt > whole.txt

cat -A script.sh | head

macOS/BSD: macOS cat has no -A; use cat -vet for the same view.

tac access.log | head

macOS/BSD: Not on macOS; use tail -r file.

Space / b

page down / up

/text

search forward; n next, N previous

g / G

jump to start / end

F

follow the file like tail -f; Ctrl+C to stop

q

quit

-N

show line numbers

-S

do not wrap long lines (scroll sideways)

less /var/log/syslog

journalctl -u nginx | less -S

-n N

first N lines (default 10)

-c N

first N bytes

-n -N

everything except the last N lines (GNU)

head -n 20 data.csv

head -c 512 file.bin | xxd

macOS/BSD: macOS head does not accept negative counts.

-n N

last N lines (default 10)

-n +N

start at line N

-f

keep printing as the file grows

-F

follow by name, survives log rotation

tail -n 50 app.log

tail -F /var/log/nginx/access.log

tail -n +2 data.csv

Ctrl+O

save

Ctrl+X

exit

Ctrl+W

search

Ctrl+K / Ctrl+U

cut line / paste

Alt+U

undo

sudo nano /etc/hosts

The shortcut bar at the bottom of the screen shows the keys; ^ means Ctrl and M- means Alt.

i

insert mode (type text)

Esc

back to normal mode

:w / :q / :wq

save / quit / save and quit

:q!

quit without saving

/text

search; n for next

dd / yy / p

delete line / copy line / paste

u / Ctrl+R

undo / redo

vim +42 app.py

-u

unified format (what patch and git use)

-r

compare directories recursively

-q

only say whether files differ

-w

ignore all whitespace

-y

side by side

diff -u old.conf new.conf

diff -rq dir1/ dir2/

diff <(sort a.txt) <(sort b.txt)

Compare text side by side in the browser →

-a

append instead of overwrite

make 2>&1 | tee build.log

echo 'vm.swappiness=10' | sudo tee -a /etc/sysctl.conf

printf '%s\n' "$var"

printf '%-12s %6.2f\n' disk 93.5

echo -e and echo -n behave differently between shells; printf behaves the same everywhere.

xxd image.png | head

hexdump -C file.bin | head

xxd is part of the vim packages; hexdump is in util-linux (bsdextrautils on newer Debian/Ubuntu).

-n N

only strings at least N characters long (default 4)

strings -n 8 firmware.bin | less

Part of binutils on Linux.

ls -l deploy.sh

First character is the type (- file, d directory, l symlink). Then three triplets: owner, group, everyone else. r=4, w=2, x=1, so rwxr-x--- is 750.

Convert rwx to octal with the chmod calculator →

-R

apply to a directory and everything inside

-v

report each change

chmod 644 index.html

chmod 755 deploy.sh

chmod 600 ~/.ssh/id_ed25519

Work out the octal mode in the chmod calculator →

chmod +x script.sh

chmod go-w file

chmod -R u=rwX,go=rX site/

Build symbolic and octal modes in the chmod calculator →

find site/ -type d -exec chmod 755 {} +

find site/ -type f -exec chmod 644 {} +

Danger: Gives every user and every compromised service on the machine write access to the whole tree, marks all files executable, and makes OpenSSH refuse keys under a 777 ~/.ssh. Applied to /etc or /usr it can break sudo and the system. Fix ownership with chown instead, or use the two find commands.

Pick the least permissive mode that works →

-R

recursive

user:

with a trailing colon and no group, also set the group to the user's login group

sudo chown -R www-data:www-data /var/www/site

sudo chown "$USER": file.txt

Danger: sudo chown -R on /, /usr or /etc wipes setuid bits and ownership that sudo, passwd and services rely on; recovery usually means a reinstall. Double-check the path.

umask

umask 077

The mask removes bits: files start from 666 and directories from 777, so 022 gives 644 and 755.

-i

root login shell

-u user

run as that user instead of root

-l

list what you are allowed to run

-k

forget cached credentials

sudo systemctl restart nginx

sudo !!

sudo -u postgres psql

-m

modify (add) an entry

-x

remove an entry

-b

remove all ACL entries

-R

recursive

-d

set default ACL inherited by new files

setfacl -m u:alice:rw report.xlsx

getfacl report.xlsx

setfacl -R -m g:devs:rwX /srv/app

A + at the end of the ls -l permission string means the file has an ACL.

sudo chattr +i /etc/resolv.conf

lsattr /etc/resolv.conf

Supported on ext4, XFS, Btrfs. If "Operation not permitted" appears even as root, check lsattr.

aux

all processes with CPU, memory, user (BSD style)

-ef

all processes with parent PID (System V style)

-o

choose columns

--sort=-%mem

sort by memory, highest first (procps)

ps aux | grep [n]ginx

ps aux --sort=-%mem | head

ps -o pid,ppid,etime,cmd -p 1234

macOS/BSD: macOS ps has no --sort; use ps aux -m (by memory) or ps aux -r (by CPU).

P / M

sort by CPU / memory (Linux top)

1

show each CPU core

k

kill a process by PID

q

quit

-b -n 1

one batch snapshot, for scripts

top -b -n 1 | head -20

macOS/BSD: macOS top is a different program: sort with top -o cpu or top -o mem.

F3 or /

search

F4

filter

F6

choose sort column

F9

send a signal (kill)

t

tree view

htop -u www-data

Install with apt install htop / dnf install htop.

-a

show the full command line (Linux procps)

-f

match against the full command line, not just the name

-u user

only that user's processes

-x

exact name match

pgrep -a nginx

pgrep -f 'python manage.py runserver'

macOS/BSD: On macOS, -a means "include ancestors"; use pgrep -lf to see names and arguments.

pkill -f "node server.js"

pkill -HUP nginx

pgrep -af node

Patterns are regular expressions matched anywhere in the name; pkill node also hits nodejs-helper. Preview with pgrep first.

(none) / -15 / -TERM

ask the process to exit cleanly (default)

-9 / -KILL

force kill; cannot be caught, no cleanup

-1 / -HUP

many daemons reload their config

-l

list signal names

kill 1234

kill -9 1234

kill %1

Try plain kill first and give it a few seconds: -9 skips cleanup, so temp files, locks and half-written data can be left behind.

killall firefox

On Linux this is in the psmisc package.

jobs

bg %1

fg %1

Ctrl+Z suspends the foreground program (it stops running until bg or fg).

nohup ./server > server.log 2>&1 &

For anything long-lived, a systemd service (see Services & logs) or tmux is more robust.

Ctrl+B d

detach (session keeps running)

Ctrl+B c

new window

Ctrl+B % / Ctrl+B "

split left/right / top/bottom

tmux ls

list sessions

tmux new -s deploy

tmux attach -t deploy

Install with your package manager. GNU screen is the older alternative (Ctrl+A d to detach, screen -r to reattach).

nice -n 19 tar -czf backup.tgz /data

sudo renice -n -5 -p 1234

Niceness runs from -20 (highest priority) to 19 (lowest). Only root can go below 0.

timeout 30s curl -s https://example.com/health

timeout -s KILL 5m ./job.sh

Exits with status 124 when the time limit was hit.

sudo fuser -vm /mnt/usb

sudo fuser -v 8080/tcp

Danger: fuser -k kills every process using the target with no prompt; on a mount point that can include your own shell.

-a

everything

-r

kernel release

-m

machine architecture: x86_64, aarch64

uname -r

uname -m

cat /etc/os-release

lsb_release -a

macOS/BSD: macOS: sw_vers.

uptime

Load is the number of processes running or waiting. Compare it to the CPU count (nproc): a load of 4 on 4 cores is fully busy.

free -h

macOS/BSD: macOS: vm_stat, or top -l 1 | grep PhysMem.

Linux uses spare RAM as disk cache, so "free" looks low on a healthy machine. "available" is what programs can still get.

lscpu

make -j"$(nproc)"

macOS/BSD: macOS: sysctl -n hw.ncpu and sysctl -n machdep.cpu.brand_string.

-T

human-readable timestamps

-w

follow new messages

--level=err,warn

only problems

sudo dmesg -T | tail -30

sudo dmesg -T | grep -i 'out of memory'

vmstat 1 5

iostat -xz 1

iostat comes from the sysstat package.

+%F

YYYY-MM-DD

+%s

Unix timestamp (seconds)

-d 'text'

parse a date: tomorrow, 2 days ago, @1700000000 (GNU)

-u

UTC

date '+%Y-%m-%d %H:%M:%S'

date +%s

date -d @1700000000

date -d '2 days ago' +%F

macOS/BSD: macOS date has no -d. Use date -r 1700000000 for a timestamp, date -v-2d for "2 days ago", and date -j -f '%Y-%m-%d' 2026-10-18 +%s to parse.

Convert timestamps in the Unix timestamp converter →

-h

human-readable sizes

-T

show filesystem type (GNU)

-i

inode usage instead of bytes

df -h

df -h .

df -i

macOS/BSD: On macOS, -T filters by type rather than showing it.

-s

one total per argument

-h

human-readable

-d N

depth limit (GNU long form: --max-depth=N)

-x

stay on one filesystem

du -sh /var/log

du -h -d 1 | sort -h

sudo du -xh -d 1 / | sort -h | tail

macOS/BSD: macOS du has -d but not --max-depth.

sudo ncdu -x /

Install with apt install ncdu / dnf install ncdu.

-f

filesystem type, label, UUID, mount point

lsblk

lsblk -f

macOS/BSD: macOS: diskutil list.

sudo umount /mnt/usb

sudo umount -l /mnt/nas

"target is busy" means a process (often your own shell sitting in that directory) is using it: find it with fuser -vm or lsof.

UUID=3f6c...  /data  ext4  defaults,nofail  0  2

sudo mount -a

A typo in fstab can drop the next boot into emergency mode. Always run sudo mount -a (or findmnt --verify) after editing.

sudo fdisk -l

sudo parted /dev/sdb print

Danger: Writing a partition table (w in fdisk, mklabel in parted) makes existing data on that disk unreachable. Confirm the device name with lsblk first; /dev/sda and /dev/sdb swap places easily.

sudo mkfs.ext4 -L data /dev/sdb1

sudo mkfs.vfat -F 32 /dev/sdc1

Danger: Erases the filesystem on the target immediately, with no confirmation if the device is not mounted. Check the device with lsblk -f; formatting /dev/sda instead of /dev/sda1, or the wrong disk, destroys it.

sudo fsck -f /dev/sdb1

Danger: Never run fsck on a mounted read-write filesystem: it can corrupt it. Unmount first, or for the root filesystem boot from rescue media.

if= / of=

input / output file or device

bs=4M

block size; bigger is faster

status=progress

show bytes copied (GNU)

conv=fsync

flush to the device before exiting

sudo dd if=ubuntu.iso of=/dev/sdX bs=4M status=progress conv=fsync

dd if=/dev/zero of=test.img bs=1M count=100

Danger: dd overwrites the of= target without asking. Swapping if= and of=, or picking the wrong /dev/sdX, wipes that disk. Check with lsblk right before running it.

macOS/BSD: macOS: target /dev/rdiskN (from diskutil list) after diskutil unmountDisk, use bs=4m, and press Ctrl+T for progress.

swapon --show

sudo fallocate -l 2G /swapfile && sudo chmod 600 /swapfile && sudo mkswap /swapfile && sudo swapon /swapfile

On Btrfs a swap file needs extra steps (btrfs filesystem mkswapfile on recent btrfs-progs).

shred -u -n 3 secrets.txt

Danger: Irreversible. Also note it is not reliable on SSDs, journaling or copy-on-write filesystems (Btrfs, ZFS) or anything with snapshots; use full-disk encryption for real protection.

ip -br a

ip a show eth0

hostname -I

macOS/BSD: macOS: ifconfig, or ipconfig getifaddr en0.

ip replaces the old ifconfig (net-tools), which many distributions no longer install.

Work out the network range in the subnet calculator →

ip r

ip route get 1.1.1.1

sudo ip route add 10.20.0.0/16 via 192.168.1.1

Check CIDR ranges in the subnet calculator →

ip link

sudo ip link set eth0 down && sudo ip link set eth0 up

Danger: Taking down the interface you are connected through over SSH cuts your session.

-t / -u

TCP / UDP

-l

listening sockets only

-p

show the process (sudo to see other users')

-n

numeric ports, no DNS

-s

summary counts

sudo ss -tulpn

ss -tn state established '( dport = :443 )'

ss -s

macOS/BSD: macOS: lsof -iTCP -sTCP:LISTEN -n -P, or netstat -an.

ss replaces netstat; netstat -tulpn still works where net-tools is installed.

-I

headers only (HEAD request)

-L

follow redirects

-o file / -O

save to a file / save with the remote name

-s / -S

silent / but still show errors

-f

fail (exit 22) on HTTP 4xx/5xx instead of printing the error page

-v

verbose: request and response headers, TLS

curl -I https://example.com

curl -LO https://example.com/file.tar.gz

curl -s -o /dev/null -w '%{http_code}\n' https://example.com

curl -fsSL https://example.com/install.sh -o install.sh

Turn a curl command into Python, JavaScript or Go →

-d data

request body; implies POST

--data-binary @file

send a file as-is

-H header

add a header

-X METHOD

PUT, PATCH, DELETE…

-u user:pass

basic auth

curl -H 'Content-Type: application/json' -d '{"name":"Ada"}' https://api.example.com/users

curl -H "Authorization: Bearer $TOKEN" https://api.example.com/me

curl -X DELETE https://api.example.com/users/42

Look up the status code you got back →

-c

resume a partial download

-O file

save as (use -O- for stdout)

-q

quiet

-r -np

recursive, never ascend to the parent directory

wget -c https://example.com/big.iso

wget -qO- https://example.com/data.json | jq .

macOS/BSD: Not on stock macOS; use curl -LO (curl -C - -LO to resume).

dig +short example.com

dig MX example.com

dig @1.1.1.1 example.com

dig -x 8.8.8.8

dig +trace example.com

Package name: dnsutils (Debian/Ubuntu) or bind-utils (Fedora/RHEL).

resolvectl status

sudo resolvectl flush-caches

macOS/BSD: macOS: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder.

Only on systems using systemd-resolved (Ubuntu, Fedora by default).

-c N

stop after N packets

-i sec

interval between packets

-4 / -6

force IPv4 / IPv6

ping -c 4 example.com

On Linux and macOS ping runs until Ctrl+C unless you pass -c (Windows stops after 4). No reply does not always mean down: many hosts block ICMP.

traceroute -n example.com

tracepath example.com

macOS/BSD: macOS has traceroute but not tracepath.

traceroute may need installing on Linux; tracepath (iputils) usually is there.

mtr -rw -c 100 example.com

Combines ping and traceroute. Loss at one middle hop only is usually that router de-prioritising ICMP; loss that continues to the end is real.

-L 5432:localhost:5432

local port 5432 reaches port 5432 on the server

-R 8080:localhost:3000

server port 8080 reaches your local 3000

-D 1080

SOCKS proxy on local port 1080

-N

no remote command, just the tunnel

ssh -N -L 5432:localhost:5432 alice@db-host

ssh -N -D 1080 alice@host

-r

copy directories

-P port

port (capital P; ssh uses lowercase -p)

-i key

identity file

scp report.pdf alice@host:/tmp/

scp alice@host:/var/log/app.log .

scp -r -P 2222 site/ alice@host:~/

Since OpenSSH 9.0, scp uses the SFTP protocol underneath. For large or repeated copies rsync is faster because it only sends changes.

-a

archive: recursive, keep permissions, times, links

-v

verbose

-z

compress in transit

-P

progress and resume partial files

-n

dry run: show what would happen

--exclude 'pattern'

skip files

-e 'ssh -p 2222'

custom SSH options

rsync -avzP site/ deploy@host:/srv/site/

rsync -av --exclude 'node_modules' ./ /backup/app/

macOS/BSD: Recent macOS ships openrsync instead of rsync; common flags work, some rarer ones do not.

src/ means "the contents of src"; src without a slash means "the folder src". Getting this wrong nests folders (dest/src/…).

rsync -avn --delete site/ /srv/site/

rsync -av --delete site/ /srv/site/

Danger: Deletes everything in dest that is not in source. Swapping source and dest, or an empty/wrong source path, wipes the destination. Always run with -n first.

nc -zv db.internal 5432

nc -l 9000

Flags differ between netcat variants: the traditional one needs nc -l -p 9000.

sudo ufw status verbose

sudo ufw allow 22/tcp

sudo ufw allow from 10.0.0.0/8 to any port 5432

Danger: sudo ufw enable on a remote server without first allowing SSH (ufw allow OpenSSH or 22/tcp) locks you out.

sudo firewall-cmd --list-all

sudo firewall-cmd --permanent --add-service=https && sudo firewall-cmd --reload

sudo firewall-cmd --permanent --add-port=8080/tcp

Without --permanent a rule lasts until the next reload or reboot.

-m

create the home directory (not the default on every distro)

-s /bin/bash

login shell

-G group1,group2

supplementary groups

sudo useradd -m -s /bin/bash alice && sudo passwd alice

On Debian/Ubuntu, adduser alice is the friendlier interactive wrapper that sets up the home directory and password.

sudo usermod -aG docker alice

sudo usermod -aG sudo alice

Danger: Without -a, usermod -G replaces all of the user's supplementary groups, which can remove sudo access. Group changes apply at the next login (or run newgrp docker).

sudo userdel -r olduser

Danger: -r deletes the home directory and its files permanently. Back it up first, or lock the account instead (passwd -l).

sudo visudo -f /etc/sudoers.d/deploy

deploy ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart myapp

visudo checks the syntax before saving. Editing /etc/sudoers with a normal editor and making a typo can lock everyone out of sudo.

-c

create

-z / -j / -J

gzip / bzip2 / xz compression

-f file

archive file name (put it right after f)

-v

list files as they go in

--exclude='pattern'

leave files out

tar -czf site-2026-10-18.tar.gz site/

tar -cJf logs.tar.xz --exclude='*.tmp' logs/

-x

extract

-C dir

extract into dir (must exist)

--strip-components=1

drop the top-level folder

tar -xf archive.tar.gz

tar -xzf app.tar.gz -C /opt/app --strip-components=1

tar --zstd -cf data.tar.zst data/

zstd -d file.zst

Needs GNU tar 1.31+ (or a recent bsdtar) and the zstd program.

-k

keep the original

-d

decompress (same as gunzip)

-9

best compression

gzip -k access.log

zcat access.log.gz | grep 404

zgrep 500 access.log.*.gz

Without -k, gzip replaces the file with the .gz version.

zip -r site.zip site/

zip -r site.zip site/ -x '*.git*' '*/node_modules/*'

zip -e encrypts with the legacy ZipCrypto scheme, which is weak. Use 7z or gpg for real secrecy.

7z x archive.7z

7z a -p backup.7z docs/

7z l archive.rar

Package: p7zip-full / 7zip on Debian/Ubuntu, p7zip or 7zip on Fedora/Arch.

sha256sum ubuntu.iso

sha256sum -c SHA256SUMS --ignore-missing

macOS/BSD: macOS: shasum -a 256 file (and shasum -a 256 -c SUMSFILE).

Hash text or a file in the browser →

-name

case-sensitive glob

-iname

case-insensitive

-path

match the whole path

find . -name '*.log'

find / -iname 'nginx.conf' 2>/dev/null

-mtime -1

modified in the last 24 hours

-mtime +30

more than 30 days ago

-mmin -60

in the last 60 minutes

-newer ref

newer than file ref

find /var/log -type f -mtime +30

find . -type f -mmin -15

find /tmp/app -name '*.tmp' -mtime +7 -print

find /tmp/app -name '*.tmp' -mtime +7 -delete

Danger: Order matters: -delete runs wherever it appears, so find . -delete -name "*.tmp" deletes everything under . before the name test is ever applied. Put -delete last and run with -print first.

locate -i nginx.conf

sudo updatedb

Provided by plocate or mlocate; the index is rebuilt daily, so files created today may be missing until updatedb runs.

-i

ignore case

-n

show line numbers

-v

invert: lines that do not match

-w

whole words only

-c

count matching lines

-o

print only the matched part

-F

fixed string, no regex

grep -n 'ERROR' app.log

grep -v '^#' nginx.conf | grep -v '^$'

grep -c 'Failed password' /var/log/auth.log

-r

recursive

-l

only file names

--include='*.py'

only these files

--exclude-dir=node_modules

skip folders

grep -rn 'TODO' src/

grep -rl --include='*.php' 'mysql_connect' .

grep -rn --exclude-dir={.git,node_modules} 'apiKey' .

grep -E 'error|warn' app.log

grep -Eo '[0-9]{1,3}(\.[0-9]{1,3}){3}' access.log | sort | uniq -c | sort -rn | head

grep -P '\d{4}-\d{2}-\d{2}' file

macOS/BSD: -E works everywhere; -P (PCRE) is a GNU feature and is not available in every macOS release.

Test the pattern in the regex tester →

g

replace every match on the line, not just the first

-E

extended regex (groups without backslashes)

I

case-insensitive match (GNU)

sed 's/http:/https:/g' links.txt

sed 's|/usr/local|/opt|g' paths.txt

sed -E 's/([0-9]+)px/\1rem/g' style.css

sed -i 's/^#Port 22/Port 2222/' /etc/ssh/sshd_config

sed -i.bak 's/foo/bar/g' config.ini

macOS/BSD: macOS sed requires an argument after -i: sed -i '' 's/foo/bar/g' file. GNU sed reads '' as the script, so the only form that works on both is -i.bak.

-F sep

field separator (default: runs of spaces/tabs)

$1 … $NF

fields; $NF is the last, $0 the whole line

NR

line number

awk '{print $1}' access.log

awk -F: '{print $1, $7}' /etc/passwd

awk -F, 'NR>1 {print $2}' data.csv

cut -d, -f1,3 data.csv

cut -d: -f1 /etc/passwd

cut -c1-10 file

cut treats every delimiter as a field break, so two spaces mean an empty field. For space-aligned output use awk.

-n

numeric

-r

reverse

-h

human sizes: 2K < 1M < 3G

-k 2,2

sort by field 2 only

-t ,

field separator

-u

drop duplicates

-V

version order: 1.9 < 1.10

du -sh * | sort -h

sort -t, -k3,3nr data.csv

sort -u emails.txt > unique.txt

-c

prefix each line with its count

-d

only lines that repeat

-u

only lines that appear once

sort ips.txt | uniq -c | sort -rn | head

uniq only collapses adjacent duplicates, so sort first.

wc -l access.log

ls | wc -l

grep -c '' file

Count words and characters in the browser →

tr 'a-z' 'A-Z' < in.txt

tr -d '\r' < windows.txt > unix.txt

tr -s ' ' < file

tr '\n' ',' < list.txt

tr only reads standard input, so redirect the file in with <.

-0

input is NUL-separated (pair with find -print0); safe with spaces

-n N

at most N arguments per command

-P N

run N commands in parallel

-I {}

replace {} with each input line

-r

do not run the command if input is empty (GNU)

find . -name '*.log' -print0 | xargs -0 rm -f

cat urls.txt | xargs -n 1 -P 4 curl -sO

ls *.png | xargs -I {} cp {} /backup/{}

macOS/BSD: GNU xargs runs the command once even with empty input unless you pass -r; macOS xargs skips empty input by default and accepts -r for compatibility.

.

pretty-print

-r

raw strings, no quotes

-c

compact, one line per result

.[]

iterate an array

select(cond)

keep matching items

jq . response.json

jq -r '.items[].name' data.json

jq -r '.[] | select(.active) | .email' users.json

curl -s https://api.github.com/repos/jqlang/jq | jq '.stargazers_count'

Install with apt/dnf install jq. Ships with recent macOS.

Format and validate JSON in the browser →

printf '%s' 'user:pass' | base64

echo dXNlcjpwYXNz | base64 -d

base64 -w 0 image.png > image.b64

macOS/BSD: macOS base64 does not wrap by default and has no -w. Use -d to decode (older macOS used -D).

Encode or decode Base64 in the browser →

sudo systemctl restart nginx

sudo systemctl reload nginx

Test config before restarting where possible, e.g. sudo nginx -t, so a typo does not take the site down.

-u unit

one service

-f

follow

-n N

last N lines

--since '1 hour ago'

also: today, yesterday, 2026-10-18 09:00

-p err

priority err and worse

-b / -b -1

this boot / previous boot

-e

jump to the end

journalctl -u nginx -f

journalctl -u myapp --since '10 min ago'

journalctl -b -1 -p err

journalctl --disk-usage

sudo journalctl --vacuum-size=500M

sudo journalctl --vacuum-time=14d

For a permanent limit set SystemMaxUse= in /etc/systemd/journald.conf.

sudo tail -f /var/log/syslog

sudo tail -f /var/log/auth.log

Some distributions (Fedora, Arch) keep logs only in the journal unless rsyslog is installed.

crontab -e

crontab -l

crontab -l > crontab.bak

Build and explain the schedule in the cron expression generator →

30 2 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1

*/15 * * * * /usr/local/bin/check.sh

0 9 * * 1-5 /usr/local/bin/report.sh

@reboot /usr/local/bin/startup.sh

Cron runs with a minimal PATH and no shell profile: use absolute paths. A % in the command must be escaped as \%.

Check what a cron expression means →

crontab -l > ~/crontab.bak && crontab -r

crontab ~/crontab.bak

Danger: Deletes every one of your cron jobs with no prompt, and r sits right next to e on the keyboard. Some cron implementations offer -i to ask first (crontab -ri).

0 3 * * * root /usr/local/bin/cleanup.sh

ls /etc/cron.daily/

On Debian and Ubuntu, files in /etc/cron.d whose names contain a dot are ignored, so name it backup, not backup.cron.

echo 'systemctl restart myapp' | sudo at 02:00

echo './report.sh' | at now + 30 minutes

atq

atrm 3

Needs the at package and the atd service running.

ls -l > listing.txt

echo 'done' >> progress.log

set -o noclobber

The shell truncates the file before the command runs, so sort file > file leaves you with an empty file. Write to a new name, then mv.

echo "Today is $(date +%A)"

echo $(( 1024 * 4 ))

diff <(ls dir1) <(ls dir2)

Backticks `command` are the old form of $(command); $( ) nests and reads better.

ls *.jpg

rm photo-??.png

cp config.{yml,yml.bak}

shopt -s globstar; ls **/*.md

Globs do not match dotfiles by default (shopt -s dotglob changes that). If nothing matches, bash passes the pattern literally unless shopt -s nullglob is set.

export NODE_ENV=production

DEBUG=1 ./app

printenv | sort

unset DEBUG

Lost when the shell exits. Put exports in ~/.bashrc (interactive shells) or ~/.profile (login shells) to keep them.

sudo !!

cd !$

!42

^foo^bar

With HISTCONTROL=ignorespace (default on Ubuntu as part of ignoreboth), a command typed with a leading space is not saved: useful for commands with secrets.

Ctrl+R

search history backwards; press again for older matches

Ctrl+A / Ctrl+E

start / end of line

Ctrl+U / Ctrl+K

cut to start / to end of line

Ctrl+W

cut the previous word

Ctrl+Y

paste what you cut

Alt+B / Alt+F

back / forward one word

Alt+.

insert the last argument of the previous command

Ctrl+L

clear the screen

Ctrl+C

cancel the running command

Ctrl+D

end of input; exits the shell on an empty line

Tab Tab

show completions

bind -P | less

Mac keyboard shortcuts cheat sheet →

#!/usr/bin/env bash
set -euo pipefail
name="${1:-world}"
if [[ -f "$name.txt" ]]; then
  echo "found $name.txt"
fi
for f in *.log; do
  echo "$f"
done

chmod +x script.sh && ./script.sh Ada

bash -x script.sh

$1 … $9 are arguments, "$@" is all of them, $# is how many. [[ ]] is bash; use [ ] in POSIX sh scripts.

Bash loops and conditionals next to CMD and PowerShell →