Terminal commands you will actually use on a Mac
The Mac terminal is slower than most people realize if you keep trying to remember every flag. I built a reference sheet I keep open in a second tab now. It covers the commands that come up repeatedly when I am troubleshooting, automating small tasks, or trying to get something to behave like it should. A Mac Command Cheat Sheet is not some special software. It is just a compiled list of the commands, their flags, and the common patterns people rely on. You can find lots of them online, but the useful ones are the ones you edit until they match your workflow.
Mac Command Cheat Sheet
Here is the kind of content that belongs in one, based on what I actually type day to day. These are the ones you start with before anything else runs. pwd shows your current directory. Beginners skip it and then waste ten minutes wondering why a command failed because they are in the wrong folder.
ls -la lists everything including hidden files with permissions. The -a flag matters more than people expect. That dotfile you are hunting is hidden by default. cd ~ drops you back in your home directory no matter where you are. cd - jumps to the previous directory. That is the one I reach for most. I once spent about forty minutes trying to rename a file and kept getting permission errors. The file was in /var and required sudo anyway. I had been editing the path in my head wrong the whole time. Now I run pwd immediately when something behaves oddly.
Get the Full Details
File operations
cp source destination copies. Add -r for folders. If you leave off -r on a directory, the command fails silently enough that beginners think it worked until they look in the destination. mv source destination moves or renames. Same rule about -r for directories. rm file deletes. rm -rf folder is dangerous because it removes recursively without asking. I learned that one the hard way early on. Now I keep -i in my habits and alias rm to rm -i.
cat file prints a file to the terminal. Use less file for anything longer than a screen. head and tail are better for logs.
Searching and filtering
find /path -name "*.log" locates files by name. grep "error" file.log searches text inside files. When I combine them, find . -name "*.log" -exec grep -l "timeout" {} \; returns only the log files that contain that string. This saved me roughly two hours on a production debugging run last year. The logs were scattered across three directories and dozens of files. I would have spent the afternoon opening them by hand otherwise. ps aux | grep process finds running processes. pgrep -fl process is cleaner for scripting because it gives PID and command in one line.
Permissions and ownership
chmod 755 script.sh sets executable permissions. chown user:group file changes ownership. These come up constantly when a setup script refuses to run. The sudo prefix runs a command as root. Use it sparingly. I have broken installations by running installers with sudo that were not written to expect it. Homebrew for example does not like it and can create permission mismatches that take an hour to repair.
Process management
kill PID sends the default termination signal. kill -9 PID forces termination. killall name kills every process with that name. I use killall when an app freezes and the UI will not quit it. top and htop show live resource usage. ps aux | sort -k 4 -r sorts by memory usage. Useful when something is leaking memory and you need to identify which process.
Network commands
ping host tests connectivity. curl -I https://site.com checks response headers. netstat -an | grep 443 shows connections on a port. lsof -i :8080 tells you exactly what is listening or using a port, which is faster than guessing. I ran into a case once where a local dev server would not start because another process held port 3000. lsof -i :3000 showed it was a leftover Node process from yesterday. Killed it and the server started immediately.
Archive and compression
tar -czvf archive.tar.gz folder creates a gzipped tarball. tar -xzvf archive.tar.gz extracts it. zip -r archive.zip folder and unzip archive.zip handle ZIP files. macOS creates ZIP files automatically when you double-click archives in Finder, which is convenient but not scripted-friendly. sw_vers shows macOS version. system_profiler SPHardwareDataType reports hardware details. df -h checks disk space in human readable format. free -m shows memory, though macOS reports it differently than Linux, so the numbers can look strange if you are coming from another OS. uptime tells you how long the system has been running and the load averages. High load averages on a Mac usually mean a CPU-bound task, not a disk issue.
Aliases and shortcuts you should set up
Add these to your .zshrc or .bash_profile and they persist across sessions. alias ll='ls -la' alias gs='git status'
alias ..='cd ..' alias rm='rm -i' The .. alias is tiny but cuts down on repetitive typing more than you would expect. It takes about three days to stop reaching for cd .. manually.
Package management basics
brew install package installs with Homebrew. brew upgrade updates everything. brew cleanup removes old cached downloads and can free several gigabytes if you have not run it in a while. You do not need to download anything special. Most of the commands above are built into the system already. Printable versions and quick-reference cards are widely available from macOS communities and developer sites. I prefer a local text file I can open anytime without browsing. Keep it in your home folder and add to it as you learn new patterns. A cheat sheet will not fix bad habits. If you type commands without checking what they do first, you will still break things. The list above covers everyday cases. It does not replace reading the manual pages when a command has unfamiliar behavior.
Some commands behave differently on older macOS versions. mdutil flags changed between Catalina and Monterey. networksetup options vary by build. Always verify flags against your version with man command when the behavior looks wrong. The terminal will not warn you before destructive actions unless you have set up safeguards yourself. Aliasing rm to rm -i helps, but it does not protect against rm -rf when someone writes a script that includes those flags explicitly. I have seen that cause data loss in shared environments. Use separate accounts for testing and production work whenever possible. If you need a quick reference, save the most common commands into a single text file on your desktop or in a notes app. Update it when you discover something new. That is the version that actually gets used.
