Linux Commands Cheat Sheet

The Linux and bash commands developers use on servers and laptops — files, search, permissions, processes, logs, networking and SSH. Enter your paths, user and host once and copy ready-to-run lines.

Runs in your browserUpdated Oct 27, 2026

Your valuesEvery example below updates as you type

Folder

File

Search text

User

Host

Port

Service

Process ID

Package

78 commands Hide destructive

Files & folders

ls -lah

List all files, including hidden ones, with human-readable sizes.

cd -

Go back to the previous directory.

mkdir -p /var/www/app/logs

Create a folder and any missing parent folders.

cp -r src /var/www/app/

Copy a folder recursively.

mv app.log /var/www/app/

Move or rename a file.

ln -s /var/www/app/current /srv/app

Create a symbolic link.

du -sh * | sort -h

Size of each item in the current folder, smallest to largest.

df -h

Free disk space per filesystem.

rm -rf /var/www/app/tmp

destructive Delete a folder and everything in it, without asking. Double-check the path.

Read & process text

tail -f app.log

Follow a log file as new lines are written.

less +F app.log

Follow a file and press Ctrl+C to scroll and search it.

head -n 20 app.log

First 20 lines.

wc -l app.log

Count lines.

sort app.log | uniq -c | sort -rn | head

Most frequent lines first.

awk '{print $1}' access.log | sort | uniq -c | sort -rn | head

Top client IPs in a web server access log.

cut -d, -f1,3 data.csv

Pick columns 1 and 3 from a CSV.

diff -u old.conf new.conf

Compare two files in unified diff format.

sed -i 's/old/new/g' app.log

destructive Replace text in a file in place (on macOS use sed -i '').

Search

grep -rn "error" /var/www/app

Search recursively and show file names and line numbers.

grep -ri --include="*.js" "error" .

Case-insensitive search limited to one file type.

grep -v "error" app.log

Show lines that do not match.

find /var/www/app -name "*.log" -mtime +7

Files ending in .log older than 7 days.

find / -type f -size +500M 2>/dev/null

Find files larger than 500 MB.

which node

Show which executable a command runs.

find /var/www/app -name "*.tmp" -delete

destructive Delete every matching file. Run without -delete first to check the list.

Permissions & users

chmod 644 app.log

Owner can read and write, everyone else can read — typical for files.

chmod 755 deploy.sh

Owner can do everything, others can read and execute — typical for scripts and folders.

chmod +x deploy.sh

Make a script executable.

chown -R deploy:deploy /var/www/app

Change owner and group recursively.

sudo usermod -aG docker deploy

Add a user to a group (log out and back in to apply).

sudo -u deploy -i

Open a login shell as another user.

id deploy

Show a user’s UID, GID and groups.

sudo !!

Re-run the previous command with sudo.

Processes

ps aux | grep nginx

Find running processes by name.

htop

Interactive process viewer (install with your package manager).

sudo lsof -i :8080

Which process is using a port.

sudo ss -tulpn

All listening TCP/UDP ports with their processes.

kill 1234

Ask a process to stop (SIGTERM).

pkill -f "node server.js"

Stop processes whose command line matches.

nohup ./long-task.sh > task.log 2>&1 &

Run in the background and keep running after you log out.

watch -n 2 "df -h"

Re-run a command every 2 seconds.

kill -9 1234

destructive Force-kill a process immediately; it gets no chance to clean up.

Services & logs (systemd)

systemctl status nginx

Is the service running, and its latest log lines.

sudo systemctl restart nginx

Restart a service.

sudo systemctl reload nginx

Reload configuration without dropping connections (if the service supports it).

sudo systemctl enable --now nginx

Start now and on every boot.

journalctl -u nginx -f

Follow a service’s logs.

journalctl -u nginx --since "1 hour ago"

Logs from the last hour.

systemctl list-units --failed

Services that failed to start.

Networking

curl -I https://example.com

Fetch only the response headers.

curl -sS -X POST https://example.com/api -H "Content-Type: application/json" -d '{"ok":true}'

Send a JSON POST request.

curl -o /dev/null -s -w "%{http_code} %{time_total}s\n" https://example.com

Status code and total response time.

dig +short example.com

Resolve a domain to its IP addresses.

dig MX example.com +short

Mail servers of a domain.

nc -zv example.com 8080

Check whether a TCP port is open.

ping -c 4 example.com

Send four pings.

ip -brief address

Network interfaces and their IP addresses.

SSH & file transfer

ssh deploy@example.com

Connect to a server.

ssh-keygen -t ed25519 -C "deploy@laptop"

Create a modern SSH key pair.

ssh-copy-id deploy@example.com

Install your public key on a server for password-less login.

scp app.log deploy@example.com:/var/www/app/

Copy a file to a server.

rsync -avz --progress ./dist/ deploy@example.com:/var/www/app/

Sync a folder to a server, sending only what changed.

ssh -L 5432:localhost:5432 deploy@example.com

Tunnel a remote port (here PostgreSQL) to your machine.

rsync -avz --delete ./dist/ deploy@example.com:/var/www/app/

destructive Mirror a folder, deleting remote files that no longer exist locally.

System & environment

uname -a && cat /etc/os-release

Kernel version and Linux distribution.

free -h

Memory and swap usage.

uptime

Time since boot and load average.

nproc

Number of CPU cores.

env | sort

All environment variables.

export PATH="$HOME/.local/bin:$PATH"

Add a folder to PATH for this shell (put it in ~/.bashrc to keep it).

history | grep error

Search your shell history (or press Ctrl+R).

crontab -e

Edit your scheduled jobs.

sudo apt update && sudo apt install -y htop

Install a package on Debian/Ubuntu (dnf install on Fedora/RHEL, brew install on macOS).

Your data never leaves your computer. All processing happens 100% locally in your browser.

How to use the Linux Commands Cheat Sheet

Type your own values (folder, file, user, host) in the boxes at the top — every example on the page updates instantly.
Search or jump to a section to find the command you need.
Click Copy to copy a ready-to-run line, or Copy section for a commented block.
Commands marked destructive delete or overwrite data — read the note before running them.

Pipes are the superpower

Most Linux tools do one thing and read from standard input, so you combine them with |. grep filters lines, awk and cut pick columns, sort and uniq -c count, head trims. Redirect output with > (overwrite), >> (append) and 2>&1 (include errors).

Be careful with these

rm -rf deletes without a recycle bin. Use ls on the exact path first, and never run it with an unset variable such as rm -rf $DIR/.
sed -i, find -delete and rsync --delete change files in place — run them without the destructive flag first to preview.
kill -9 skips cleanup; try a normal kill first.

Permissions at a glance

Read is 4, write is 2, execute is 1; add them per owner, group and others. So 640 means owner read/write, group read, others nothing. Work out any value with the chmod calculator, generate cron schedules with the cron expression generator, and check open ports remotely with the port checker.

Tools that pair well with the Linux Commands Cheat Sheet

Docker Cheat Sheet — The Docker and Docker Compose commands you reach for every week, explained in one line.
Git Cheat Sheet — Every Git command you use day to day — and the ones you need when something goes wrong — explained in one line.
Nginx Config Generator — Choose what Nginx should do — serve a static site or SPA, proxy to a Node/Python app, or run PHP — and tick the extras.
AI Prompts for Developers — Battle-tested prompts for the coding tasks you do every day — debugging, reviews, tests, refactoring, SQL, commit messages and documentation.

Frequently asked questions

How do I find which process is using a port?

Run sudo lsof -i :8080 or sudo ss -tulpn | grep 8080. Both show the process name and PID.

What do chmod 644 and 755 mean?

Each digit sets permissions for owner, group and others: 4 = read, 2 = write, 1 = execute. 644 means the owner can read/write and others can read; 755 adds execute for everyone. Use the chmod calculator to work out any combination.

How do I keep a command running after I close SSH?

Use nohup command & for a quick job, a terminal multiplexer such as tmux or screen for interactive work, or a systemd service for anything that should run permanently.

Do these commands work on macOS?

Most do. Differences: macOS uses BSD versions of tools, so sed -i needs an empty string argument (sed -i ''), there is no systemd or journalctl, and packages come from Homebrew.

Missing a feature?

Suggest an improvement to the Linux Commands Cheat Sheet or request a new tool — it goes straight to our inbox.

Your tools

Web & SEO

Code & data

Design & media

DevOps & security

Everyday