Terminal-first guides, real shell scripts, and field notes from years of sysadmin work.
Base64-encode and decode a file from the terminal with the built-in base64 command. The macOS-vs-GNU flag gotcha (-D vs -d), the line-wrapping difference, and building a data URI from an image.
Print a saved Wi-Fi password from the macOS Terminal with the built-in security command: no third-party tool, no install. Reads your own login keychain, with the auth prompt that is supposed to appear.
Toggle Bluetooth on or off from the macOS terminal with blueutil: blueutil -p 1 / -p 0 / -p toggle, read the current state, list paired devices, and connect or disconnect by address. The reliable route now that Apple removed the old defaults hacks.
Take a photo with the Mac camera from the Terminal using imagesnap: install it, list devices, pick one, add a warm-up delay, and fix the Camera-permission gap that makes a CLI capture fail silently. Plus the ffmpeg avfoundation alternative.
Toggle macOS dark mode from the terminal with one osascript line: instant, no restart. Force it on or off, read the current state, and skip the dead _HIEnableThemeSwitchHotKey trick.
Add a custom right-click action to macOS Finder with Automator. Build a Quick Action that runs a shell script on the files you select, with the PATH gotcha that makes it silently do nothing.
Set the system clock from the macOS command line the right way. The BSD date set form is MMDDhhmm[[CC]YY], not the GNU date -I flag that gets copied around. Turn off network time first or macOS resyncs.
Set the macOS system volume from the terminal with osascript: the modern 0 to 100 scale, mute and unmute, reading the current level, input volume, and a one-line alias. No sudo needed.
The macOS open command launches apps, files, folders, and URLs from the Terminal: open a file in its default app, reveal it in Finder, open a URL in a specific browser, and the zsh quoting gotcha that breaks URLs.
Copy command output to the clipboard from the terminal with pbcopy and pbpaste on macOS, plus the Linux (xclip, xsel, wl-copy) and Windows (clip, Set-Clipboard) equivalents, and the trailing-newline gotcha.
Set the macOS desktop wallpaper from the terminal with one osascript line that covers every display at once, plus the modern caching gotcha and how to script a random wallpaper.
Verify a file's SHA-256 checksum on macOS from the command line: compute it with shasum -a 256, check it against a published hash with -c, and know why SHA-256 (not MD5 or SHA-1) is the right choice in 2026.
Blur a fixed region in a video with ffmpeg using crop, boxblur, and overlay, and blur moving faces automatically with deface. The honest note: ffmpeg alone has no face tracking.
Speed up or slow down an animated GIF from the command line: set a uniform per-frame delay with gifsicle, re-time it with ffmpeg's setpts filter, and avoid the browser delay floor that quietly caps how fast a GIF can play.
Convert SVG to PNG from the command line with rsvg-convert, Inkscape, or ImageMagick. Set the output size explicitly, keep transparency, and avoid the blurry low-density trap.
Make a contact sheet from a video with one ffmpeg command: sample a frame every N seconds, scale it, and tile the frames into a single thumbnail-grid image with the tile filter. Keyframe sampling, padding, and multi-sheet output included.
Convert a video to grayscale with ffmpeg two ways: hue=s=0 to desaturate, or format=gray for a true single-channel gray file. Plus a custom black-and-white mix and a sepia tone with colorchannelmixer, and why this re-encodes.
Combine a silent video with an audio file, or swap out an existing soundtrack, using ffmpeg. The -map and -shortest flags that make it work, plus how to fix audio that drifts out of sync.
Remove audio from a video with ffmpeg in one command: -an drops the track, -c:v copy keeps the video lossless and instant. Plus muting only part of a clip and dropping one track from a multi-track file.
Reverse a video with ffmpeg using the reverse filter for picture and areverse for sound. Why you must write to a new output file, and why you trim before you reverse.
Control how many times an animated GIF loops from the command line with gifsicle: play once, repeat a fixed number of times, or loop forever, plus the off-by-one count that trips everyone up and the inverse loop numbering in ffmpeg.
Get an image's width and height from the terminal: ImageMagick's identify, the built-in sips on macOS (no install), file for a quick guess, ffprobe for video, plus a batch loop over a whole folder.
Convert an image to grayscale from the command line with ImageMagick: the one-line magick command, the difference between perceptual Gray and linear gray, batching a folder with mogrify, sepia, and a built-in macOS alternative.
Turn any image into ASCII art from the terminal: jp2a for the classic monospace look (with ANSI color and an invert flag for dark terminals), and chafa for truecolor, Unicode-detail, and even animated GIFs.
Inspect an animated GIF from the command line: read its dimensions, frame count, loop count, and per-frame delays with gifsicle, count frames and detect whether it animates with ImageMagick, extract the first frame, and total its duration.
Combine animated GIFs into one from the command line with gifsicle. Merging is the default mode, the loop quirk that makes it look broken, plus matching sizes, the 256-color ceiling, and the ffmpeg alternative.
Normalize MP3 and audio volume from the command line: ffmpeg's loudnorm filter for EBU R128 loudness (one-pass and the accurate two-pass), rsgain for ReplayGain tags across a whole library, and why loudness beats peak normalization.
Reverse an animated GIF from the command line with ImageMagick or ffmpeg. The -coalesce step is mandatory (GIF frames are diffs), plus a boomerang that plays forward then backward.
Convert JPG, PNG, and animated GIF to WebP from the command line with Google's cwebp and gif2webp, batch a whole folder, and go further with AVIF via avifenc. ImageMagick's magick as the fallback.
Change a video's speed from the command line with ffmpeg: setpts for the video, atempo for the audio, why you still chain atempo in steps of 2.0 even though it now accepts up to 100, and keeping both tracks in sync.
A scannable ffmpeg reference: convert containers, stream-copy without re-encoding, trim and cut, resize and crop, extract or replace audio, high-quality GIFs with palettegen, x264/x265/AV1 quality with -crf and -preset, change speed, concat, subtitles, and the fixes for the errors you actually hit.
Crop a video with ffmpeg's crop filter: crop=w:h:x:y from the top-left origin, centered crops with in_w/in_h expressions, square crops for social, and cropdetect to strip black bars automatically.
Pull the audio out of a video with ffmpeg: copy the stream untouched when you just want to demux (fast, lossless), or re-encode to MP3, AAC, or WAV when you need a different format. Plus how to check the source codec first and grab a single segment.
Trim or cut a video from the command line with ffmpeg: the fast lossless -c copy way, the keyframe gotcha that makes your cut land early, and the frame-accurate re-encode. With -ss and -to/-t explained.
Grab a thumbnail or a single frame from a video with ffmpeg: pull a frame at a timestamp, let the thumbnail filter pick a representative one, sample one every N seconds, and control JPEG quality with -q:v.
Compress and optimize an animated GIF from the command line with gifsicle: -O3 optimization, the --lossy flag most guides miss, --colors reduction, and resizing. Plus the honest truth about when to ditch GIF for MP4/WebM.
Download a Facebook video free from the command line with yt-dlp: public watch links and fb.watch shorts need no cookies, private and group videos use --cookies-from-browser firefox, and you pick the resolution yourself.
Download an Instagram Reel or video free from the command line with yt-dlp. Instagram needs you logged in, so cookies are mandatory: how to pass them, keep them fresh, and grab reels, feed videos, IGTV, or just the audio.
Download all TikTok videos from a user free with yt-dlp: point it at the profile URL, pass browser cookies (TikTok needs them for the full listing), and use a download archive so re-runs only grab new clips. The natural way to back up your own TikTok. For the photo slideshows yt-dlp skips, back up the images with gallery-dl.
Download a TikTok video free from the command line with yt-dlp: no app, no sketchy site. yt-dlp pulls the source MP4 TikTok serves, follows short links, extracts audio, and uses your cookies for gated clips. For the photo slideshows yt-dlp can't fetch, grab the images with gallery-dl.
Download YouTube audio free with yt-dlp: extract to M4A or Opus with no quality-losing re-encode, tag it with cover art, or convert YouTube to MP3 for older players. The free, maintained youtube-dl successor.
Download a whole YouTube playlist or entire channel free with yt-dlp: point it at a playlist or @handle, use a download archive so re-runs skip what you already have, organize files with output templates, and rate-limit to dodge the bot wall.
Pull a YouTube video's transcript free from the command line with yt-dlp: list the caption tracks, download the subtitles without the video, convert SRT/VTT to clean plain text, and transcribe with Whisper when no captions exist.
Download a YouTube video free from the command line with yt-dlp: install it, grab the best quality, pick a resolution, handle Shorts, and get past the bot check. youtube-dl's free, maintained successor.
A scannable yt-dlp reference: install and update, format selection, audio extraction, subtitles, playlists and channels, cookies and auth, rate limiting, output templates, and post-processing. The free, maintained youtube-dl successor.
Bash job control reference: suspend with Ctrl-Z, resume in foreground with fg or background with bg, list with jobs, target jobs by %1/%+/%-, and keep a process alive past logout with nohup, disown, or setsid.
bat is a cat command replacement that adds syntax highlighting, line numbers, and Git change markers. Install it, alias cat to it carefully, and know the --plain, --style, and --paging flags that make it behave well in scripts and pipes.
duf is a df replacement that prints grouped, color-coded disk usage tables instead of df's raw columns. Install it, filter to the devices you care about, sort by usage, and pipe --json into scripts.
which vs type vs command -v for finding where a command lives: which is an external program with portability problems, command -v is the POSIX-standard choice for scripts, and type tells you the most.
sudo iftop -i eth0 shows a live, per-connection bandwidth table: which host pairs are moving traffic and at what rate. The interface flag people forget, the -n and -P switches that make the output readable, the 2s/10s/40s columns, the filter syntax, and when nload or iftop is the right tool.
Set up LUKS disk encryption with cryptsetup: format a block device, open it, put a filesystem on it, and mount it. The four commands, plus the header backup nobody warns you about.
Set up LUKS remote unlock over SSH with Dropbear in the initramfs, so an encrypted root server can finish booting after a reboot without a console or KVM.
The nload command draws a live graph of incoming and outgoing bandwidth per interface, right in the terminal. Install it, run nload, switch interfaces with the arrow keys, and read the In/Out, Avg, and Max numbers. The -m multi-interface view, the -u/-U unit flags, the refresh interval, and where iftop and nmap fit instead.
nvtop is an htop-style GPU monitor for Linux. One install (sudo apt install nvtop), one command, and you get live per-GPU utilization, memory, temperature, and a sortable per-process list across NVIDIA, AMD, and Intel cards.
OpenSnitch is an application firewall for Linux that asks per process before any program talks to the network. Install it, answer the prompts, and write rules that stick.
ShellCheck is a static analysis linter for Bash and POSIX sh: install it, run it on a script, read the SC codes, suppress false positives with disable directives, and wire it into CI.
Generate a hardware-backed SSH key on a YubiKey with one ssh-keygen command. How FIDO2/U2F SSH keys work, the difference between ed25519-sk and ecdsa-sk, resident keys, and the firmware and OpenSSH versions you need.
Switch to TCP BBR congestion control with two sysctl lines and a reboot-safe config file. The throughput it buys you on lossy long-haul links, the fq qdisc it needs, the kernel version that ships it, and when CUBIC is still the right default.
Use USBGuard to block USB devices on Linux: generate a policy from the hardware you trust, set the daemon to reject everything else, and allow new devices by hand.
An interactive chmod calculator: tick the read/write/execute boxes for owner, group, and other to get the octal and the exact chmod command, or type 644 to see what it grants.
An interactive crontab builder and explainer: pick a schedule to generate a valid cron expression, or paste an expression like 0 9 * * 1 to read it back in plain English.
Edit sudo rules without locking yourself out: why visudo syntax-checks before saving, drop-in files in /etc/sudoers.d, and the rules you actually need.
Grant sudo by adding a user to the sudo or wheel group, or with a sudoers drop-in, and how to scope it to specific commands instead of full root.
Configure NOPASSWD in a sudoers drop-in for a user or a specific command, the security trade-offs, and how to scope it tightly so it is not a free root shell.
Run a command as a different user with sudo -u or runuser, including as a service account that has no login shell, and the difference between the two.
Grant one user access to a file without changing its group, using POSIX ACLs with setfacl, reading them with getfacl, and setting defaults that new files inherit.
Read and set rwx permissions, the octal numbers behind 644 and 755, the difference between files and directories, and symbolic vs numeric chmod.
Make a script runnable with chmod +x, why the shebang line matters, and how to run it with ./ once the execute bit is set.
What the s and t bits do, why /usr/bin/passwd is setuid and /tmp is sticky, how to set them, and how to audit a system for risky setuid binaries.
Disable direct root login over SSH and on the console, lock the root password, and move everyone to a normal account plus sudo, without locking yourself out.
Expire a password with chage -d 0 or passwd -e so the user must set a new one the next time they log in. The difference from locking, and how to undo it.
Set maximum password age, warning days, and an account expiry date with chage, and read the current aging with chage -l. The full password-lifecycle reference.
Add a user to a group with usermod -aG without wiping their existing groups, why the -a matters, and how to confirm membership took effect.
Change a user's default login shell with chsh or usermod, check the valid shells in /etc/shells, and see the current shell from /etc/passwd.
Create a Linux user with useradd or adduser, give it a home directory, shell, and password, and understand the difference between the low-level and friendly commands.
Remove a user with userdel, including the home directory and mail spool with -r, plus what to do about files they owned elsewhere on the system.
List every user and group from /etc/passwd and /etc/group with getent, tell human accounts from system ones by UID, and see which groups a user belongs to.
Paste your SSH public key into GitHub or GitLab, then confirm it works with ssh -T. The whole flow, with no password or token prompts on git push after.
Add, change, or remove the passphrase on an existing SSH key with ssh-keygen -p. No need to regenerate the key or reinstall it on any server.
Lock SSH down to keys only: disable password and root login in sshd_config, the settings that actually matter, and how to apply them without locking yourself out.
Why SSH warns that the remote host identification has changed, when it is safe to clear, and the one command that removes the stale known_hosts entry: ssh-keygen -R.
The ordered checklist for SSH Permission denied (publickey): is the key loaded, is it the right key, is the public half on the server, and are the server-side permissions sane.
SSH refuses your key with WARNING: UNPROTECTED PRIVATE KEY FILE. The one-line fix is chmod 600, plus the full set of ~/.ssh permissions and ownership SSH actually checks. Linux, macOS, Windows.
Create an SSH key in one ssh-keygen command. Which key type to pick in 2026 (Ed25519 vs RSA), whether to set a passphrase, and the file permissions SSH needs, on Linux, macOS and Windows.
find -delete removes every matched file with no confirmation and no undo. The safe pattern is to write the command with -print first, eyeball the list, then swap -print for -delete. Plus the directory-depth-first trap, when to use -exec rm instead, and the find -delete vs xargs rm -f tradeoff.
rsync has no native time filter, so the standard trick is to let find pick the files and feed the list to rsync. The one-liner is find ... -print0 | rsync --files-from=- --from0, and the failure mode is always the same: the paths in the list have to be relative to the rsync source argument. The breakdown, the dry run habit, and when rsync's own filters make find unnecessary.
find locates the files, tar archives them. The safe pairing is find -print0 piped into tar reading a NUL-delimited list from stdin: no breakage on spaces or newlines. The flag breakdown, the macOS BSD tar vs GNU tar difference, the -exec append alternative, archiving by modification time, and the compression choices.
find . -type f -name '*.log' -print0 | xargs -0 -P 4 -n 1 gzip compresses every matched file four at a time. The flags that make it work: -P for parallel workers, -n 1 so each worker gets one job, -0 paired with find's -print0 for safety. When parallelism helps (CPU-bound work) and when it just thrashes the disk.
macOS ships BSD find; Linux ships GNU find. The two share a name and most of an interface, but -printf, -regextype, and the stat format strings diverge hard enough to break scripts shipped between platforms. The full divergence list, the portable subset that works on both, and how to get GNU find on a Mac.
find . -type d -empty lists every empty directory; find . -type f -empty lists every empty file. The catch is what 'empty' means (a hidden file makes a directory not empty) and the -depth trap that lets find -delete collapse whole nested empty trees in one pass. The flag reference, the safe two-pass cleanup, the BSD vs GNU notes, and the mistakes that bite.
find -path './node_modules' -prune -o -type f -print skips a directory subtree instead of walking into it. The pattern looks strange because -prune is an action, not a test, and the trailing -print is mandatory once you write an explicit action. The breakdown, the multi-directory form, the slower -not -path alternative, and when each one is the right call.
find -exec ... {} + and find -print0 | xargs -0 are roughly equivalent for batch operations on matched files. find -exec ... {} \; forks once per match and is much slower. The decision matrix: when -exec is enough, when xargs adds value, and the safety rules for filenames with spaces, newlines, and quotes.
find . -type f -name '*.txt' lists every file with one extension. For many extensions you group -name tests with escaped parens and join them with -o. This covers the single one-liner, the multi-extension OR pattern, why the parens are mandatory, case-insensitive -iname, files with no extension at all, the -regex shortcut, and the BSD vs GNU divergence that bites on macOS.
find -user www-data lists every file owned by a user; -group developers filters by group; -perm matches the mode bits. The subtle part is -perm -mode (all of these bits set) versus -perm /mode (any of these bits set). Plus the security-audit recipes for world-writable files and SUID/SGID binaries, the BSD vs GNU divergences, and the orphaned-file checks.
find ... -print0 | xargs -0 grep -l 'PATTERN' finds every file containing a piece of text. The combo handles weird filenames, scales to huge trees, and replaces three other common but broken pipelines. When to use grep -r alone, when to add find as a pre-filter, and the BSD vs GNU pitfalls.
find . -size +100M lists every file larger than 100 megabytes. The unit suffixes (c, k, M, G), the +/- sign convention, how to combine with sort to find the biggest files on disk, the BSD vs GNU divergence for printing sizes, and the wc -c trick for byte-exact thresholds.
find -mtime -7 lists every file modified in the last 7 days. The catch is the off-by-one: -7 means less than 7 days ago, +7 means more than 7 days ago, and exact-7 almost never matches what people expect. The flag reference, worked variations for hours and minutes, the BSD vs GNU rounding difference, and the safe cleanup patterns.
find . -type f -mtime +30 lists every file NOT modified in the last 30 days. The +N sign means older than N days, the exact inverse of -N. The full reference for -mtime, -mmin, -newer markers, the -atime vs -mtime distinction and the noatime trap, plus the safe stale-file cleanup pattern.
find / -xdev -type f -printf '%s %p\n' | sort -rn | head -20 gives you a ranked list of the biggest files on a full disk. The GNU one-liner, the BSD/macOS stat variant, why -xdev matters, human-readable output with numfmt, when to switch to du or ncdu for per-directory totals, and the mistakes that send a scan into /proc.
find -name takes a shell glob and matches the basename; find -regex takes a full regular expression and matches the whole path. That whole-path detail is the number one surprise: -regex '.*\.txt' works but -regex '.txt' matches nothing. The flag reference, -regextype flavors, the GNU vs BSD default-flavor drift, and when -name is the better tool.
find walks the live filesystem every time it runs: always current, sometimes slow. locate queries a prebuilt database: instant, but stale until the next updatedb. This breaks down the locate family (mlocate, plocate, slocate), the macOS situation, and exactly when to reach for each one.
grep filters lines, awk extracts fields. The classic pipe is grep 'pattern' file | awk '{print $2}'. This covers awk field basics ($1, $NF), custom separators with -F, multi-column output, the cases grep -o and cut cover on their own, and the fact that awk's own pattern match makes the grep half optional.
grep -i 'pattern' file matches regardless of case. The flag pairs with -r, -w, -v, and -c the way you would expect, but -i only folds ASCII case reliably. Non-ASCII case folding (accented characters, the Turkish dotted-i) depends on your locale. The combinations, the locale caveat, the PCRE per-pattern (?i) flag, and the BSD vs GNU differences.
grep -C 3 'pattern' file prints the matching line plus 3 lines on each side. The three context flags (-A after, -B before, -C both), how the -- group separator works between match blocks, asymmetric context, recursive context search, and the macOS BSD vs GNU differences that bite.
grep -c counts matching LINES, not occurrences. A line with three hits still counts as 1. The fix is grep -o piped into wc -l, which puts every match on its own line first. Per-file counts, filtering out the :0 noise, counting non-matching lines, and the BSD vs GNU differences.
The grep -o 'pattern' file | sort | uniq -c | sort -rn pipeline is the classic log-analysis one-liner. Why sort must come before uniq, how each stage works, worked examples for top IPs and status codes, the awk one-pass alternative for huge files, and the BSD vs GNU notes.
grep does not read .gitignore, so skipping node_modules, .git, and build output is on you. The flags that do it: --exclude for filename globs, --exclude-dir for whole directories, --include for the inverse, --exclude-from to read the list from a file, plus the find -prune fallback for older macOS grep.
grep -v 'pattern' file prints every line that does NOT match. The flag reference, how to exclude multiple patterns, the strip-comments-and-blank-lines pipeline, the double-negative trap where -v of an OR becomes an AND of negations, and the macOS BSD vs GNU differences.
grep -l prints the name of each file that contains a match and stops reading at the first hit, which makes it the fast answer to 'which files contain this string'. The lowercase -l, the inverted -L for files missing a pattern, the grep -rl one-liner, the NUL-safe xargs pipeline for find-and-replace, and the BSD vs GNU notes.
grep can OR several patterns three ways: -e per pattern, -E with alternation, or -f reading the list from a file. The one-liner is grep -E 'ERROR|WARN|FATAL' file. Here is when to pick each, how -F speeds up literal multi-pattern search, why grep has no single-pass AND, and the BSD vs GNU differences that bite on macOS.
grep -r 'pattern' . searches every file under a directory tree. The catch is the path argument people forget, the -r vs -R symlink difference, and the unfiltered crawl into node_modules and .git. The flag reference, the --include and --exclude-dir filters, the macOS BSD vs GNU gaps, and when to reach for ripgrep or git grep instead.
grep has three regex engines and the default one surprises everyone: in basic regex (BRE) the characters + ? | ( ) { } are literal text until you backslash-escape them. -E switches to extended regex (ERE) where they work bare, and -P unlocks Perl-compatible regex with lookaround and \d. The full BRE vs ERE vs PCRE comparison, the same pattern in all three, and why -P does not exist on macOS.
grep is on every system and searches exactly what you point it at. ripgrep (rg) is the fast Rust-based default for code search: it skips .gitignore'd, hidden, and binary files unless told otherwise. ag (the_silver_searcher) was the older fast-grep, now largely superseded by ripgrep. This breaks down speed, defaults, regex engines, and exactly when to reach for each one.
grep cat also matches category, concatenate, and scatter. grep -w cat matches only the standalone word. The whole-word flag, what grep counts as a word boundary, the regex equivalents with \b and \< \>, the stricter -x whole-line cousin, and the BSD vs GNU differences that bite on macOS.
A scannable find reference: search by name, size, time, type, perms; safe pipelines with -print0 and xargs -0; -exec and -execdir; plus the macOS BSD vs GNU find divergences and Windows PowerShell equivalents.
A scannable grep reference with the flags I actually use, the GNU vs BSD differences that bite on macOS, and the Windows equivalents (Select-String, findstr) for the same patterns.
Use jpegoptim to losslessly or lossy-compress JPEGs from the command line, in bulk, and inside CI pipelines. Includes the install path on macOS/Linux/Windows, mozjpeg / squoosh-cli / sharp comparisons, and the parallel xargs pattern for tens of thousands of images.
Batch compress each folder in a parent directory into its own ZIP, tar.gz, or 7z archive on Linux, macOS, and Windows. Covers the for-loop one-liners, encryption, symlink handling, and the BSD vs Info-ZIP differences.
Install VirtualBox Guest Additions on Ubuntu 22.04, 24.04, and 26.04 LTS guests for shared clipboard, drag and drop, shared folders, and dynamic display resolution. Covers VirtualBox 7.0 and 7.1, both install methods, and the Apple Silicon UTM alternative.