DEV Community: Mahir Faysal

How to Verify a File Checksum (SHA-256) on Windows, Mac and Linux

Mahir Faysal — Sat, 24 Oct 2026 03:58:25 +0000

To verify a file checksum, calculate the file's SHA-256 hash on your own computer and compare it with the value the publisher lists on its download page. On Windows run Get-FileHash in PowerShell or certutil -hashfile in Command Prompt, on a Mac run shasum -a 256, and on Linux run sha256sum. If the two values match exactly, your copy is identical to the one the publisher hashed. If they differ by a single character, don't open or install the file.

That short string of letters and numbers next to a download button is easy to scroll past. It's worth thirty seconds, because it's the simplest way to prove the file on your disk is the one the developer released.

Below are the exact commands for each system, a way to let the computer compare for you, GPG signature basics and what to do when the numbers don't match.

In this guide:

What a checksum is and what it proves
Which hash algorithm should you use?
How to verify a SHA-256 checksum on Windows with PowerShell
How to check a hash with certutil in Command Prompt
How to verify a checksum on a Mac with shasum
How to verify a checksum on Linux with sha256sum
Let the computer compare the hash for you
GPG signatures: the step that proves who published the file
What a checksum mismatch means and what to do
Common mistakes when checking file hashes
Quick reference: checksum commands for every system
Frequently asked questions

What a checksum is and what it proves

A checksum (also called a hash or digest) is a fixed-length fingerprint worked out from every byte of a file. Feed the same file into SHA-256 and you get the same 64-character answer every time. Change one byte, even a single full stop in a text file, and the answer changes completely.

So it answers one question: is my copy byte-for-byte identical to the one this value was made from? It catches:

downloads that were cut short or corrupted on the way;
the wrong file, such as the ARM build when you wanted x64;
a file that was swapped or altered on a mirror or in transit.

It doesn't tell you the software is safe or that the person who published the hash is trustworthy. If an attacker can change the file on a website, they may be able to change the hash printed beside it too. Signatures solve that, as you'll see below.

Hashes are almost always written in hexadecimal (0-9 and a-f) because it's easy to compare by eye. If you've wondered how that differs from other text encodings, my guide to what Base64 encoding is compares hex and Base64 side by side.

Which hash algorithm should you use?

Use whatever the publisher lists, and prefer SHA-256 or SHA-512 when there's a choice. You can usually tell the algorithm from the length of the value:

Algorithm	Length in hex	Status for download checks
MD5	32 characters	Broken against deliberate tampering; only spots accidental corruption
SHA-1	40 characters	Deprecated; collisions have been shown in practice
SHA-256	64 characters	Recommended, and the most common on download pages
SHA-384	96 characters	Strong; less common
SHA-512	128 characters	Strong; used by some projects such as Apache

The US National Institute of Standards and Technology keeps the official list of approved algorithms on its hash functions project page, including its plan to retire SHA-1 by the end of 2030. An MD5 match only rules out accidental corruption.

How to verify a SHA-256 checksum on Windows with PowerShell

PowerShell is built into Windows 10 and Windows 11, and its Get-FileHash cmdlet uses SHA-256 unless you ask for something else.

Open the folder that holds your download in File Explorer.
Right-click an empty space in the folder and choose Open in Terminal (on Windows 10, hold Shift while you right-click and choose Open PowerShell window here).
Type the command below, replacing the file name with yours. Pressing Tab after the first few letters fills the name in for you.
Press Enter and wait.
Compare the value in the Hash column with the one on the download page.

Get-FileHash .\installer.exe

Algorithm       Hash                                                                   Path
---------       ----                                                                   ----
SHA256          5891B5B522D5DF086D0FF0B110FBD9D21BB4FC7163AF34D08286A2E846F6BE03       C:\Users\you\Downloads\installer.exe

PowerShell prints the hash in capital letters, while most websites use lower case. That's fine: hex isn't case-sensitive, so 5891B5 and 5891b5 are the same value.

For another algorithm, add -Algorithm followed by SHA1, SHA384, SHA512 or MD5. Microsoft's Get-FileHash reference lists every option, including how to hash a whole folder of files at once.

How to check a hash with certutil in Command Prompt

If you prefer Command Prompt, certutil does the same job and ships with every current version of Windows.

Press the Windows key, type cmd and open Command Prompt.
Move to your Downloads folder with cd %USERPROFILE%\Downloads.
Run certutil -hashfile with the file name and the algorithm.
Read the hash on the second line of the output.

certutil -hashfile installer.exe SHA256

SHA256 hash of installer.exe:
5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03
CertUtil: -hashfile command completed successfully.

Don't leave off the algorithm name. Without it, certutil falls back to SHA-1, which won't match a SHA-256 value however correct your file is. It also accepts MD5, SHA384 and SHA512. The full syntax is in Microsoft's certutil documentation.

How to verify a checksum on a Mac with shasum

macOS includes shasum, a Perl-based tool that handles the whole SHA family. You choose the algorithm with -a.

Open Terminal from Applications > Utilities, or search for it with Spotlight (Command + Space).
Type shasum -a 256 followed by a space.
Drag the downloaded file from Finder into the Terminal window. macOS types its full path for you.
Press Return and compare the result with the published value.

shasum -a 256 ~/Downloads/installer.dmg
5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03  /Users/you/Downloads/installer.dmg

The output is the hash, two spaces, then the file name. Use -a 512 for SHA-512 or -a 1 for SHA-1. For an MD5 value, macOS has a separate md5 command.

If you've downloaded a checksum file as well (often called SHA256SUMS or installer.dmg.sha256), put it in the same folder and run shasum -a 256 -c SHA256SUMS. You'll see OK or FAILED next to each file it can find.

How to verify a checksum on Linux with sha256sum

Every mainstream Linux distribution ships GNU coreutils, which includes sha256sum, sha512sum, sha1sum and md5sum. They all work the same way.

Open a terminal and move to your download folder with cd ~/Downloads.
Run sha256sum followed by the file name.
Compare the 64-character result with the publisher's value.

sha256sum ubuntu.iso
5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03  ubuntu.iso

The real strength on Linux is check mode. Many projects publish one SHA256SUMS file listing a hash for every download. Save it next to your file and run:

sha256sum -c SHA256SUMS --ignore-missing
ubuntu.iso: OK

The --ignore-missing flag tells it to skip files in the list that you didn't download, so you only see results for the ones you have. Without it, you'll get a "No such file or directory" warning for every other entry. The sha256sum manual page covers the remaining options, including --strict and --quiet.

Let the computer compare the hash for you

Comparing 64 characters by eye is where mistakes creep in. People check the first and last few characters and assume the middle matches. Copy the published value from the website and let the system do the comparison instead.

System	One-line comparison	Result if it matches
Windows PowerShell	`(Get-FileHash .\installer.exe).Hash -eq "paste-hash-here"`	`True`
Mac Terminal	`echo "paste-hash-here installer.dmg"	shasum -a 256 -c`
Linux terminal	`echo "paste-hash-here ubuntu.iso"	sha256sum -c`

On Mac and Linux, put two spaces between the hash and the file name. In PowerShell, -eq ignores case, so capital-letter output still matches a lower-case value.

If you get False or FAILED, check for a stray space copied from the web page first.

GPG signatures: the step that proves who published the file

A checksum proves your file matches a value. A digital signature proves who produced that value. Serious projects (Linux distributions, Tor, password managers, many open-source tools) sign their checksum file with a GPG key, so an attacker would need the developer's private key to fake it.

The usual process looks like this, using Ubuntu's file names as an example:

Download the file, the SHA256SUMS file and its signature, SHA256SUMS.gpg, from the official site.
Install GnuPG if you don't have it: it's preinstalled on most Linux systems, available as Gpg4win on Windows and as GPG Suite or via Homebrew (brew install gnupg) on a Mac.
Import the project's public signing key using the key ID or fingerprint the project publishes, for example gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys KEY-ID.
Check the fingerprint against the one on the project's website.
Verify the signature with gpg --verify SHA256SUMS.gpg SHA256SUMS.
If it reports a good signature, run the checksum check from the previous sections against that signed file.

You're looking for Good signature from followed by the project's name. If you see BAD signature, stop. GnuPG will often add a warning that the key "is not certified with a trusted signature". That's normal on a personal machine; it means you haven't personally vouched for the key, which is why step 4 matters. Ubuntu's own guide to verifying an Ubuntu download walks through this with real key IDs.

Windows and macOS apps also carry code signatures. In PowerShell, Get-AuthenticodeSignature .\installer.exe shows whether a Windows installer is validly signed and by whom. On a Mac, Gatekeeper checks signatures and notarisation automatically when you open an app.

What a checksum mismatch means and what to do

A mismatch tells you the file isn't the one the value was made from, but not why. These are the usual causes, most common first:

Cause	How to spot it	What to do
Incomplete or corrupted download	File size is smaller than listed, or the browser showed an error	Delete it and download again, ideally on a stable connection
Wrong file or version	Name differs slightly (arm64 vs x64, or an older version number)	Match the exact file name next to the published hash
Wrong algorithm	Your hash is 40 characters but the published one is 64	Rerun with SHA-256, or add the algorithm to certutil
Copy-and-paste error	Extra space or missing character in the pasted value	Copy the published value again, or use the checksum file
Tampered file or mirror	Still wrong after a fresh download from the official site	Don't run it; report it to the project

If a second download from the project's own website still doesn't match, don't open the file, and don't "just try it in case". Delete it, check you're on the genuine site (look-alike domains are common), and let the developers know through their official support or issue tracker.

Common mistakes when checking file hashes

Getting the hash from the same untrusted place as the file. If you downloaded from a mirror, take the hash from the project's official HTTPS site, or better, a signed checksum file.
Hashing the extracted contents instead of the download. The published value is for the ZIP, ISO or installer exactly as downloaded. Check it before unzipping.
Checking a file you've already run. Verify before opening an installer, not after.
Confusing file checksums with password hashes. A file checksum is meant to be fast and repeatable. Password storage needs slow, salted hashing, which is a different job entirely; my PHP password_hash example shows how that works.

Quick reference: checksum commands for every system

Task	Windows	Mac	Linux
SHA-256 of a file	`Get-FileHash file`	`shasum -a 256 file`	`sha256sum file`
SHA-512 of a file	`Get-FileHash file -Algorithm SHA512`	`shasum -a 512 file`	`sha512sum file`
Command Prompt alternative	`certutil -hashfile file SHA256`	n/a	n/a
Check against a SHA256SUMS file	Compare manually or with `-eq`	`shasum -a 256 -c SHA256SUMS`	`sha256sum -c SHA256SUMS --ignore-missing`
Verify a GPG signature	`gpg --verify SHA256SUMS.gpg SHA256SUMS` (Gpg4win)	Same command (GPG Suite or Homebrew)	Same command

Bookmark this table for the next download page that lists a SHA-256 value.

Frequently asked questions

What is a SHA-256 checksum?

It's a 64-character fingerprint calculated from every byte of a file using the SHA-256 algorithm. The same file always gives the same value, and any change to the file gives a completely different one, so comparing values shows whether two files are identical.

How do I check a SHA-256 hash in Windows 11?

Open Terminal or PowerShell in the folder with your file and run Get-FileHash followed by the file name. It uses SHA-256 by default. In Command Prompt, run certutil -hashfile followed by the file name and SHA256.

Is the hash case-sensitive?

No. Hexadecimal hashes aren't case-sensitive, so a value in capital letters from PowerShell matches the same value in lower case on a website. Every character still has to be the same.

Why doesn't my checksum match?

The most common reasons are an incomplete download, comparing against the hash for a different file or version, or using the wrong algorithm, such as SHA-1 instead of SHA-256. Download the file again from the official site and recheck before assuming tampering.

Is MD5 still OK for checking downloads?

MD5 can still spot accidental corruption, but it's broken against deliberate tampering because different files can be made to share the same MD5 value. Use SHA-256 or SHA-512 when the publisher offers them.

Does a matching checksum mean the file is safe?

Not by itself. It proves your file is identical to the one the published value came from. If that value came from a compromised page, both could be malicious, so check signatures where available and only download from official sources.

What's the difference between a checksum and a GPG signature?

A checksum checks that the file wasn't changed. A GPG signature checks who produced the checksum file, using the developer's private key, so an attacker can't fake it without that key. Use both when a project provides them.

Do I need to install anything to check a hash?

No. Windows has Get-FileHash and certutil, macOS has shasum, and Linux has sha256sum built in. You only need extra software, such as GnuPG, if you also want to verify a signature.

Last checked: 22 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.

Originally published on mfaysal.com.

I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.

How to Check Open Ports on Windows, Mac and Linux (and Close the Ones You Don't Need)

Mahir Faysal — Fri, 23 Oct 2026 04:01:18 +0000

To check open ports on your computer, list the ports that programs are listening on and see which program owns each one. On Windows, run netstat -ano | findstr LISTENING in Command Prompt or Get-NetTCPConnection -State Listen in PowerShell. On a Mac, run sudo lsof -iTCP -sTCP:LISTEN -n -P. On Linux, run sudo ss -tulpn. Anything listening on 0.0.0.0 or [::] accepts connections from other devices, so stop the program or block the port in your firewall if you don't need it.

Every service that accepts network connections opens a port: file sharing, remote desktop, a database you installed for a course and forgot. An open port isn't automatically a problem. One you don't know about is.

This guide sticks to your own computer and each system's built-in tools: reading the output, spotting exposed services, checking what's reachable and closing what you don't need.

In this guide:

Open, listening and established: what the terms mean
Local only or reachable? How to read the address column
How to check open ports on Windows with netstat
How to check open ports in PowerShell with Get-NetTCPConnection
What's normally listening on a Windows PC
How to check open ports on a Mac
How to check open ports on Linux with ss
How to check which ports are reachable from outside
How to close or block a port you don't need
Firewall commands to block a port on each system
A five-minute monthly port check
Frequently asked questions

Open, listening and established: what the terms mean

Tools use slightly different words, so here's what they mean.

Term	What it means	Should you worry?
LISTENING / LISTEN	A program is waiting for incoming TCP connections on this port	Check it if it listens on all addresses
ESTABLISHED	An active connection, usually one your computer started, such as a browser tab	Usually not
TIME_WAIT / CLOSE_WAIT	A connection that's closing down	No, these clear on their own
UDP (no state)	UDP has no connections, so a bound UDP port is shown without LISTEN	Check it the same way as a TCP listener

When people say "open port", they almost always mean a listening port that something else could connect to. That's what we'll focus on.

Local only or reachable? How to read the address column

The address a program listens on matters more than the port number. It decides who can reach it.

Address shown	Who can connect
`127.0.0.1` or `[::1]` (also `localhost`)	Only programs on this computer
`0.0.0.0`, `[::]` or `*`	Any network interface: other devices on your Wi-Fi, and possibly the internet if a firewall or router allows it
A specific address, such as `192.168.1.20`	Devices that can reach that one network interface

A database or dev server bound to 127.0.0.1 is fairly harmless. The same service bound to 0.0.0.0 on a laptop you take to coffee shops is worth a second look.

How to check open ports on Windows with netstat

netstat has been part of Windows for decades and works in any Command Prompt. Run it as administrator so you can see every process.

Press the Windows key, type cmd, right-click Command Prompt and choose Run as administrator.
Run netstat -ano | findstr LISTENING to list TCP listeners with the process ID (PID) in the last column.
Note any PID you don't recognise.
Look it up with tasklist /fi "PID eq 1234", replacing 1234 with the PID.
To check a single port, run netstat -ano | findstr :3389.

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       1092
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    127.0.0.1:5432         0.0.0.0:0              LISTENING       6120

The flags mean: -a all connections and listening ports, -n numbers instead of names, and -o the owning PID. Adding -b shows the program name directly, but it's slower and needs an elevated window. UDP ports appear in the full netstat -ano output without a state. The netstat reference on Microsoft Learn lists every switch.

How to check open ports in PowerShell with Get-NetTCPConnection

PowerShell gives tidier output you can filter and sort.

Right-click the Start button and open Terminal (Admin) or Windows PowerShell (Admin).
List TCP listeners with their owning process:

Get-NetTCPConnection -State Listen |
  Select-Object LocalAddress, LocalPort, OwningProcess,
    @{n='Process';e={(Get-Process -Id $_.OwningProcess).ProcessName}} |
  Sort-Object LocalPort

For UDP, run Get-NetUDPEndpoint | Sort-Object LocalPort.
To see who's using one port, run Get-NetTCPConnection -LocalPort 3389.

The calculated Process column saves you looking up each PID by hand. Microsoft documents every parameter in the Get-NetTCPConnection reference.

Prefer a window to a command line? Press Windows + R, type resmon and open the Network tab of Resource Monitor. The Listening Ports section shows each program, its PID, address, port, protocol and whether Windows Firewall allows it.

What's normally listening on a Windows PC

A clean Windows 10 or 11 PC isn't silent. Know the usual entries before you stop anything.

Port	Usually	Notes
135 (TCP)	RPC Endpoint Mapper (svchost)	Core Windows service; leave it alone
139, 445 (TCP)	NetBIOS and SMB file sharing (System, PID 4)	Keep it off public networks; block from the internet
3389 (TCP)	Remote Desktop	Only there if Remote Desktop is turned on
5040 (TCP)	Connected Devices Platform service	Normal on Windows 10 and 11
5353, 5355 (UDP)	mDNS and LLMNR name discovery	Local network name lookups
49152-65535 (TCP)	Dynamic RPC ports used by Windows services	Several entries here are normal

Apps such as Steam, Docker, VPN clients and database servers add their own. If you see an elevation prompt while running these commands, my explainer on what UAC is in Windows covers why admin rights are needed to see other users' processes.

How to check open ports on a Mac

macOS uses the BSD version of netstat, which can't show process names, so lsof is the better tool.

Open Terminal (Applications > Utilities).
List TCP listeners with their program and PID: sudo lsof -iTCP -sTCP:LISTEN -n -P.
Enter your Mac password when asked. Nothing appears as you type; that's normal.
List UDP ports with sudo lsof -iUDP -n -P.
Check one port with sudo lsof -i :5000 -n -P.

COMMAND     PID   USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
ControlCe   512   you    9u  IPv4  0x...      0t0  TCP *:7000 (LISTEN)
ControlCe   512   you   10u  IPv4  0x...      0t0  TCP *:5000 (LISTEN)
postgres   1840   you    7u  IPv4  0x...      0t0  TCP 127.0.0.1:5432 (LISTEN)

-n and -P stop lsof translating addresses and ports into names, which makes it much faster and the output easier to read. Without sudo you only see your own processes. For a quick port list without process names, netstat -an -p tcp | grep LISTEN works too. The lsof manual page explains every selection flag.

A common surprise: ports 5000 and 7000 owned by ControlCenter. That's AirPlay Receiver. If you don't stream to your Mac, turn it off in System Settings > General > AirDrop & Handoff.

How to check open ports on Linux with ss

ss is the modern replacement for netstat on Linux and comes with the iproute2 package on virtually every distribution.

Open a terminal.
Run sudo ss -tulpn to list TCP and UDP listeners with their process.
Read the Local Address:Port column and the users:(("name",pid=...)) part at the end.
Check one port with sudo ss -tlnp 'sport = :22', or use sudo lsof -i :22.

Netid State  Local Address:Port  Peer Address:Port Process
udp   UNCONN 127.0.0.53%lo:53         0.0.0.0:*     users:(("systemd-resolve",pid=612,fd=13))
tcp   LISTEN       0.0.0.0:22         0.0.0.0:*     users:(("sshd",pid=901,fd=3))
tcp   LISTEN     127.0.0.1:3306       0.0.0.0:*     users:(("mysqld",pid=1220,fd=21))

The letters stand for -t TCP, -u UDP, -l listening only, -p process and -n numeric. Without sudo, the process column is blank for services owned by other users. The ss manual page covers its powerful filter syntax.

sshd on 0.0.0.0:22 is expected on a server, but on a desktop you never log in to remotely, switch it off.

How to check which ports are reachable from outside

A local listener isn't necessarily reachable. Your firewall, and at home your router, sit in between. To see what another device actually sees, test from a second machine you own.

Find your computer's local IP address: ipconfig on Windows, ipconfig getifaddr en0 on a Mac, or ip addr on Linux.
From another device on the same network, test a port. On Windows: Test-NetConnection 192.168.1.20 -Port 445. On Mac or Linux: nc -zv 192.168.1.20 445.
TcpTestSucceeded : True or succeeded means the port is reachable on the local network.
For internet exposure, check your router's port forwarding, DMZ and UPnP settings. On a typical home connection, nothing is reachable from the internet unless one of those opens it.

Only test devices and networks you own or have permission to test. Scanning other people's systems can break acceptable use policies and, in the UK, potentially the Computer Misuse Act. If your router has port forwards you don't recognise, my guide to securing your home Wi-Fi router shows where to find and remove them. Network scanners such as Nmap give a fuller picture when you're ready for them.

How to close or block a port you don't need

A port is open because a program is listening, so the cleanest fix is to stop that program rather than hide it behind a firewall. In order:

Identify the program from the PID using the commands above.
Turn the feature off in its own settings if it's something like Remote Desktop, file sharing, AirPlay Receiver or a game's host server.
Stop and disable the service if it's a background service you never use.
Uninstall software you no longer need, such as an old database server.
Block the port in the firewall if you need the program locally but don't want other devices reaching it.
Run the check again to confirm the port has gone or is now local only.

If a service sounds unfamiliar, search its exact name before disabling it. Many Windows services have odd names but are essential; my guide to what msconfig does explains how to switch services off safely and undo it.

Firewall commands to block a port on each system

System	Check firewall	Block or close an inbound port	Stop a service
Windows	`Get-NetFirewallProfile	Select Name, Enabled`	`New-NetFirewallRule -DisplayName "Block TCP 5432" -Direction Inbound -Protocol TCP -LocalPort 5432 -Action Block`
Mac	System Settings > Network > Firewall	Turn on the firewall, then Options > set the app to Block incoming connections	Turn off the matching item in System Settings > General > Sharing
Ubuntu/Debian (ufw)	`sudo ufw status verbose`	`sudo ufw deny 5432/tcp`	`sudo systemctl disable --now name`
Fedora/RHEL (firewalld)	`sudo firewall-cmd --list-all`	`sudo firewall-cmd --permanent --remove-port=5432/tcp` then `sudo firewall-cmd --reload`	`sudo systemctl disable --now name`

On a Mac, the built-in firewall works per app rather than per port, so you allow or block a program, not a number. Apple explains the options in its guide to blocking connections with the Mac firewall.

A warning for Linux servers: if you're connected over SSH, run sudo ufw allow OpenSSH (or sudo ufw allow 22/tcp) before sudo ufw enable, or you can lock yourself out. On firewalld, removing a port only closes it if it was opened with --add-port; services opened with --add-service are removed with --remove-service.

A five-minute monthly port check

Run the listening-ports command for your system and save the output to a text file.
Compare it with last month's list. New entries deserve a look.
Anything on 0.0.0.0 or [::] that you can't explain: identify it, then decide whether to stop it.
Check that your firewall is switched on for public networks.

Saving the output makes comparison easy. On Windows, netstat -ano > ports.txt does it. On Mac and Linux, add > ports.txt to the end of the command. An unexplained new listener is a useful early warning sign.

Frequently asked questions

How do I see which program is using a port?

On Windows, run netstat -ano and look up the PID with tasklist, or use Get-NetTCPConnection with Get-Process. On a Mac, run sudo lsof -i :PORT -n -P. On Linux, run sudo ss -tulpn or sudo lsof -i :PORT and read the process column.

What does 0.0.0.0 mean in netstat?

It means the program is listening on every network interface on the computer, so other devices that can reach it may be able to connect. 127.0.0.1 means only programs on the same computer can connect.

Is it bad to have open ports?

Not necessarily. Your operating system and many legitimate apps listen on ports. The risk comes from services you don't need, services exposed to networks you don't trust, and software that's out of date. Close what you don't use and keep the rest updated.

Why does netstat show so many ports on Windows?

Windows runs many services that use the network, including RPC on port 135, file sharing on 445 and several dynamic ports between 49152 and 65535. Most of these are normal. Focus on listeners you can't match to a program you recognise.

How do I close port 445 on Windows?

If you don't share files or printers, turn off file and printer sharing for your network profile and make sure Windows Firewall is on, especially on public networks. Block it with a firewall rule rather than disabling core services you aren't sure about.

Does closing a port in the firewall stop the program?

No. A firewall rule blocks connections to the port, but the program keeps running and listening locally. To fully close the port, stop or uninstall the program or turn off the feature that opened it.

Do I need admin rights to check open ports?

You can list ports without admin rights on all three systems, but you won't see the program name for services run by other users or the system. Run the command as administrator on Windows or with sudo on Mac and Linux for the full picture.

Can a website tell me which ports are open on my computer?

An online port checker can only test your public IP address, which at home is usually your router, not your computer. To check your computer itself, use the built-in commands in this guide or test from another device you own on the same network.

Last checked: 22 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.

Originally published on mfaysal.com.

I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.

How to Encrypt Your Laptop: BitLocker, Device Encryption and FileVault Step by Step

Mahir Faysal — Thu, 22 Oct 2026 04:07:17 +0000

To encrypt a Windows laptop, open Settings > Privacy & security > Device encryption (Windows Home) or Manage BitLocker in Control Panel (Pro, Enterprise and Education) and turn it on. On a Mac, open System Settings > Privacy & Security > FileVault and click Turn On. Before you do either, decide where your recovery key will live, because without it a locked drive can't be opened.

If your laptop is lost or stolen, a password on your account doesn't protect the files on its drive. Someone can take the drive out, or boot from a USB stick, and read everything. Full-disk encryption scrambles the whole drive, so the data is useless without your login or recovery key.

The good news is that many laptops sold in the last few years are already encrypted, or nearly so. This guide shows you how to check, how to finish the job, and how to avoid the one mistake that causes real trouble: losing the recovery key.

In this guide:

Which encryption does your laptop have?
Step 1: back up before you change anything
Step 2: check whether Windows is already encrypted
Step 3: turn on Device Encryption (Windows Home)
Step 4: turn on BitLocker (Windows Pro, Enterprise or Education)
Step 5: find and save your BitLocker recovery key
Step 6: turn on FileVault on a Mac
Step 7: check FileVault from Terminal
Encrypting USB sticks and external drives
Mistakes that lock people out
What encryption protects, and what it doesn't
Frequently asked questions

Which encryption does your laptop have?

The tool you use depends on your operating system and, on Windows, your edition. Microsoft explains the difference between the two Windows options on its Device Encryption support page.

Computer	Built-in encryption	Notes
Windows 11 or 10 Home	Device Encryption	Uses BitLocker underneath, with a simple on/off switch, on supported hardware
Windows 11 or 10 Pro, Enterprise, Education	BitLocker Drive Encryption	Full controls, including external drives (BitLocker To Go)
Mac with Apple silicon or a T2 chip	FileVault	Data is encrypted automatically; FileVault makes your password required to unlock it
Older Intel Mac without T2	FileVault	Must be turned on to encrypt the drive
Linux	LUKS (usually chosen at install)	Most installers offer an "encrypt the disk" option

Not sure which Windows edition you have? Open Settings > System > About and read Edition under Windows specifications.

Step 1: back up before you change anything

Encryption rarely goes wrong, but turning it on rewrites every block of your drive, so a fresh backup is cheap insurance.

Copy important files to an external drive or a cloud service such as OneDrive or iCloud Drive.
Plug a laptop into mains power. Encryption runs in the background and uses battery.
Make sure you know your account password, and on Windows, which Microsoft account you sign in with.

You can keep working while the drive encrypts. Time depends on the size of the drive and how much is on it.

Step 2: check whether Windows is already encrypted

There are three quick ways to check. Use whichever you're comfortable with.

Settings: go to Settings > Privacy & security > Device encryption (on Windows 10, Settings > Update & Security > Device encryption). If the switch is on, the drive is encrypted.
Control Panel: search for Manage BitLocker. Each drive shows a status such as BitLocker on or BitLocker off.
Command line: open Terminal or Command Prompt as administrator and run manage-bde -status.

In the command output, look at Conversion Status and Protection Status for drive C:. Microsoft's BitLocker operations guide lists the statuses you might see:

Status	What it means	What to do
On / Protection On	The drive is encrypted and protected	Check your recovery key is saved (Step 5)
Off	The drive isn't encrypted	Turn on Device Encryption or BitLocker
Suspended	Encrypted, but protection is paused	Resume protection
Waiting for Activation	Encrypted with a clear key, so not yet protected	Finish setup by turning protection on

"Waiting for Activation" catches people out. It can appear on new laptops set up with a local account, and it means the data is not yet protected even though encryption has started.

Step 3: turn on Device Encryption (Windows Home)

Sign in with an administrator account. Signing in with a Microsoft account is the easiest route, because Windows backs up the recovery key to it automatically.
Open Settings > Privacy & security > Device encryption.
Turn the switch on and let it finish in the background.

If you don't see Device encryption at all, your hardware may not support it or you may be on a standard account. To find out why, search for System Information, right-click it, choose Run as administrator, and read Device Encryption Support at the bottom of System Summary. Common reasons include no usable TPM chip, Secure Boot switched off in the firmware settings, or the Windows Recovery Environment not being set up.

Windows Home doesn't include the full BitLocker controls. If your hardware doesn't support Device Encryption, the options are upgrading to Windows Pro or using third-party encryption software.

Step 4: turn on BitLocker (Windows Pro, Enterprise or Education)

Search for Manage BitLocker and open it.
Next to the operating system drive (C:), select Turn on BitLocker.
Choose how to back up your recovery key: your Microsoft account, a file, or a printout. You can pick more than one.
Choose how much to encrypt. Used disk space only is quicker and suits a new laptop. Entire drive suits one you've used for a while, because it also covers deleted files still sitting in free space.
Choose the encryption mode. New encryption mode is right for the laptop's internal drive. Compatible mode is for drives that might move to an older version of Windows.
Leave Run BitLocker system check ticked, continue, and restart when asked.

After the restart, encryption carries on in the background. You can check progress at any time with manage-bde -status.

Step 5: find and save your BitLocker recovery key

The recovery key is a 48-digit number. Windows asks for it when it can't unlock the drive automatically, for example after some firmware updates, hardware changes or too many wrong PIN attempts. Microsoft's guide to finding your BitLocker recovery key is clear that its support team can't recover a lost key for you.

If you use a Microsoft account, open aka.ms/myrecoverykey on another device and sign in. Check that your laptop's key is listed now, while everything works.
If the laptop was ever joined to a work or school account, the key may be stored with that organisation instead.
Keep a second copy somewhere separate: a printout with your important papers, or an entry in your password manager.
Never store the only copy on the encrypted laptop itself.

If the laptop was set up by someone else, such as a family member or a shop, the key may be in their Microsoft account. Sort that out now rather than at the recovery screen.

Step 6: turn on FileVault on a Mac

On macOS Ventura and later, FileVault lives in System Settings. On older versions, look in System Preferences > Security & Privacy > FileVault. Apple's guide to protecting data on your Mac with FileVault covers each version.

Choose Apple menu > System Settings > Privacy & Security, then scroll to FileVault.
Click Turn On and enter your password if asked. You need an administrator account.
Choose a recovery method: let your iCloud account unlock the disk, or create a recovery key and don't use iCloud.
If you create a recovery key, write it down exactly and store it away from the Mac.
If other people use the Mac, enable each user so they can unlock the disk with their own password.

Apple is blunt about the risk: if you forget your login password and also lose the recovery key, your files are gone for good. Once FileVault is on, automatic login is disabled and a password is always needed at startup.

Step 7: check FileVault from Terminal

System Settings shows whether FileVault is on, but Terminal gives a quick, scriptable answer. Open Terminal and run:

fdesetup status

You'll see FileVault is On, FileVault is Off, or a progress message while encryption is running. For a simple yes or no, fdesetup isactive prints true or false. Both are handy when you look after several family Macs and want to confirm each one is protected.

Encrypting USB sticks and external drives

Full-disk encryption only covers the internal drive. Files you copy to a USB stick or external SSD are unprotected unless you encrypt that drive too.

Windows Pro and above: right-click the drive in File Explorer, choose Turn on BitLocker (or use Manage BitLocker) and set a password. This is BitLocker To Go.
Mac: Control-click a Mac-formatted (APFS or Mac OS Extended) drive in Finder and choose Encrypt, or erase it in Disk Utility with an encrypted format. Erasing wipes the drive, so copy its files off first.

Pick a long password you can type from memory, or generate one with our password generator and save it in your password manager. A drive encrypted on Windows with BitLocker isn't natively readable on a Mac, and vice versa, so plan for where you'll open it.

Mistakes that lock people out

Not knowing where the recovery key is. This causes almost every BitLocker horror story. Check it before you need it.
Updating BIOS or UEFI firmware without suspending BitLocker. Some firmware updates trigger recovery mode. Choose Suspend protection in Manage BitLocker first; it resumes after the restart. Some manufacturer updaters do this for you.
Setting up with a local account. On Windows Home, Device Encryption isn't switched on automatically with a local account, and there's no Microsoft account to hold the key.
Selling or recycling a laptop with someone else's key. Reset the laptop properly before it leaves your hands.

What encryption protects, and what it doesn't

Situation	Does full-disk encryption help?
Laptop stolen while switched off	Yes, the data is unreadable without your key or password
Drive removed and plugged into another computer	Yes
Laptop stolen while unlocked	No, so lock your screen when you walk away
Malware or phishing while you're signed in	No, you need updates, antivirus and care with links
Files copied to a USB stick	No, unless that drive is encrypted too
Files in cloud storage	No, that depends on your cloud account's security

File system choice matters here too. Copy a file from your encrypted laptop to a plain exFAT stick and the protection stays behind, which I explain in my guide to NTFS vs FAT32 vs exFAT. Encryption works best alongside a strong account password, a screen that locks quickly, and two-factor authentication on your cloud accounts.

Frequently asked questions

Is my laptop already encrypted?

Possibly. Many Windows 11 laptops set up with a Microsoft account turn on Device Encryption automatically, and Macs with Apple silicon or a T2 chip encrypt their data by default. Check in Settings, Manage BitLocker, manage-bde -status on Windows, or fdesetup status on a Mac.

Does encryption slow down my laptop?

On modern laptops you're unlikely to notice a difference in everyday use, because current processors and drives handle encryption efficiently. The first encryption pass runs in the background and can make the machine feel slightly busier until it finishes.

What is the difference between BitLocker and Device Encryption?

Device Encryption is a simplified version of BitLocker for Windows Home and supported hardware, with a single on/off switch. BitLocker on Pro, Enterprise and Education adds full controls, including startup PINs and encryption for external drives.

What happens if I lose my BitLocker recovery key?

If Windows asks for the key and you can't find it in your Microsoft account, a work account, a printout or a USB drive, the data can't be unlocked. Microsoft can't recreate it, so the only option is to reset the laptop and lose the files on it.

Should I store my FileVault key in iCloud?

For most personal Macs, letting iCloud unlock the disk is convenient and reduces the risk of losing a written key. If you'd rather not link the two, create a recovery key and keep it somewhere safe away from the Mac.

Can I encrypt a laptop running Windows 11 Home without Device Encryption?

Not with built-in tools. If System Information shows your hardware doesn't meet the prerequisites, you can enable a missing setting such as Secure Boot, upgrade to Windows Pro for BitLocker, or use reputable third-party encryption software.

Do I need to turn off encryption before a Windows update?

No, normal Windows updates work with encryption on. For BIOS or UEFI firmware updates, suspend BitLocker protection first unless the manufacturer's updater says it handles this for you.

Last checked: 21 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.

Originally published on mfaysal.com.

I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.

How to Create a Strong Password: Passphrases, Managers and Passkeys

Mahir Faysal — Wed, 21 Oct 2026 04:08:29 +0000

A strong password is long, unique to one account, and hard to guess. The practical way to get there is a password manager that creates and stores a different secret for every site, plus a memorable passphrase for the manager itself and for email. The UK National Cyber Security Centre (NCSC) urges people to use password managers and to keep a strong, separate password for email. Many sites now also offer passkeys, which the NCSC recommends as a first choice where available.

This guide is for readers in the UK and US who want clear steps without myth-busting theatre. You can generate candidate passwords with the free password generator on mfaysal.com, then store the winners in a manager rather than a sticky note.

What makes a password strong

Length and uniqueness matter more than sprinkling punctuation into a short word. Attackers try leaked passwords, common words and automated guesses. If you reuse one password and it appears in a breach, every other account that shares it is at risk.

NIST digital identity guidelines (SP 800-63B) have pushed organisations toward longer secrets, checks against known breached passwords, and away from arbitrary composition rules and forced periodic resets when nothing has gone wrong. You do not need to memorise standard numbers from NIST to benefit: favour length, uniqueness and breach screening over complex rituals.

Approach	Strengths	Watch-outs
Short complex string	Looks complex	Easy to reuse; hard to remember; often guessed
Long random string from a manager	High entropy; unique per site	Needs a manager and a strong primary password
Diceware-style passphrase	Memorable; long	Must be unique; avoid famous quotes
Passkey	Phishing resistant; no typing	Not every site supports them yet

Protect email first. If someone controls your inbox, they can reset passwords elsewhere. The NCSC tip on using a strong and separate password for email is the right starting point.

US and UK readers face the same core threats: credential stuffing from leaked databases, phishing pages that copy bank logins, and malware that steals browser-saved passwords. A unique password stops stuffing from spreading. A manager auto-fill that only runs on the real domain reduces casual phishing success. Passkeys and 2SV close more of the remaining gaps.

Think in accounts, not in clever spellings. One long unique secret per account beats one ornate password shared everywhere.

Passphrases and Diceware-style methods

A passphrase strings several unrelated words together so the secret is long enough to resist guessing but still memorable. Diceware-style methods pick words with dice and a word list so the choice is random rather than a favourite lyric or film title. Randomness is the point: famous example phrases from articles should never be reused as your real password.

Write a process, not a pet name. For example, roll or generate four or five uncommon words, separate them with spaces or a character you will remember, and only then store the result. Avoid birthdays, team names, street addresses and keyboard walks such as qwerty.

Passphrases shine as the primary password for a password manager or for the few secrets you must type often. For dozens of shopping and social accounts, let a manager generate long random strings instead of inventing a new passphrase each time.

Never place your only copy of a passphrase in an unencrypted notes app that syncs everywhere without a lock. If you write it on paper, store the paper like you would store bank documents, as the NCSC discusses when it covers writing passwords down carefully.

Combine words that do not form a common sentence about your life. Attackers know people pick hobby phrases. Random word lists beat autobiographical phrases every time. If you must invent without dice, close your eyes and pick from a large printed word list rather than from memory of your favourite books.

Spaces inside a passphrase are fine on modern sites. If a site rejects spaces, join words with hyphens. If it rejects long secrets entirely, that site is a good candidate for a manager-generated string and for enabling 2SV immediately.

Use a password manager

Password managers create strong unique passwords, fill them on the right site, sync across your devices and warn you about known breaches. The NCSC guidance on managing your passwords explains why managers beat memory for everyday accounts.

You can start with the manager built into your browser or operating system, or install a third-party manager if you need cross-browser sync and richer features. On shared or public computers, never allow the browser to save passwords. On a household PC, decide whether other users should be able to unlock the same profile.

Choose a primary password you can remember under stress: a long passphrase is ideal. Turn on two-step verification for the manager account itself so a stolen primary password is not enough. Update your devices and browsers so auto-fill and vault encryption stay current.

When you migrate, change the most important accounts first: email, banking, work single sign-on, Apple or Google account, and the manager. Use a trusted generator if you need a one-off secret before the vault is ready, then save it into the manager immediately.

Third-party managers often add breach alerts and secure sharing for families. Pick features you will actually use. The best manager is the one you keep open every day. Export a sealed backup only if you understand how to store that file safely.

Turn on two-step verification

Two-step verification adds a second check after the password, such as an authenticator app code, a hardware security key or a prompt on a trusted device. The NCSC treats turning on 2SV as the first and most important step when you clean up password habits, because it blocks many attacks even after a phishing steal.

Prefer authenticator apps or security keys over SMS where you can. SMS still helps if nothing else is offered, but SIM swaps and message interception are known risks. Store backup codes offline in a safe place when a site provides them.

Enable 2SV on email before you reset other accounts. Then enable it on banking, cloud storage and social media. Work accounts may mandate a particular method; follow your organisation standard rather than inventing a parallel setup.

If you lose the phone that holds your authenticator, those backup codes or a registered hardware key are what get you back in. Test recovery once while you still have access. Print codes and put them with other important papers, or store them in an encrypted backup approved by your workplace.

Passkeys: the next step beyond passwords

Passkeys let you sign in with a cryptographic key unlocked by your device PIN, fingerprint or face check. You do not invent a new string, and a lookalike phishing site cannot easily collect a passkey the way it collects a typed password.

The NCSC recommends making passkeys your first choice where a site offers them, and keeping strong unique passwords plus 2SV everywhere else meanwhile. We explain the security model in plain language in Are passkeys safe?.

Register passkeys on more than one device or use a syncing platform you trust so you are not locked out when a phone is lost. Keep a recovery path documented. Passkeys reduce password burden; they do not remove the need for device security and account recovery planning.

Until every site supports passkeys, you will still need a manager. Treat passkeys as the preferred door on modern services and passwords as the fallback on older ones. When a site offers both, register the passkey and keep the password entry in your vault as a backup until you are confident recovery works.

What to stop doing

Reusing passwords across email, shopping and social media.
Changing passwords on a fixed calendar when nothing suggests a compromise, which modern guidance such as NIST SP 800-63B has discouraged in favour of change-after-breach.
Saving passwords on public or shared machines.
Using common substitutions that attackers lists already include.
Ignoring breach emails. If a provider says your password leaked, change that password and any reuse elsewhere immediately.

Security questions are often weak because answers are public or shared within families. Where a site forces them, treat answers like additional passwords: long, unique and stored in your manager rather than truthful trivia.

Do not email passwords to yourself. Do not paste them into chat apps. Do not screenshot your vault. Do not share primary passwords with support callers who contact you first; real support will not need your full password in clear text.

A simple setup plan for this week

Install or enable a password manager and create a long primary passphrase.
Turn on 2SV for the manager and for email.
Change the email password to a unique strong secret and store it only in the manager.
Replace reused passwords on banking, work and social accounts, one batch per evening.
Register a passkey on sites that offer it, starting with major platforms or your bank if supported.
Generate any remaining one-off secrets with a trusted generator and save them to the vault at once.

You do not need a perfect score on day one. Unique email and banking credentials plus a manager already remove most of the everyday risk that comes from password reuse.

Families can share a short household checklist: who owns the manager subscription, where backup codes live, and which devices hold passkeys. Small businesses should separate personal and work vaults and follow any supplier requirements for multi-factor authentication.

If you already suffered account takeover, start with email recovery through the provider official help pages, then rotate passwords on every important site while logged in from a clean device. Scan for malware if the password was stolen from your computer rather than from a remote breach.

Teaching a relative? Sit with them while you install a manager and save the email password together. A thirty-minute setup beats another year of sticky notes on the monitor.

This article draws on NCSC top tips and widely discussed NIST SP 800-63B ideas without inventing numeric thresholds. Product interfaces change, so follow each provider current enrolment screens when you enable 2SV or passkeys.

Revisit the plan every few months when you get a new phone or laptop, and confirm passkeys and authenticator apps moved with you before you wipe the old device.

Frequently asked questions

How do I create a strong password?

Make it long and unique. Use a password manager to generate a random password for each site, and a memorable multi-word passphrase for the manager and email.

Are passphrases better than complex short passwords?

A long random or Diceware-style passphrase is usually easier to remember and harder to guess than a short string with a few symbols.

Should I use a password manager?

Yes. The NCSC recommends password managers so you can use a different strong password on every account without memorising each one.

What password should I protect first?

Your email password, because inbox access lets attackers reset other accounts. Keep it strong, unique and covered by 2SV.

Are passkeys safer than passwords?

Passkeys are designed to resist phishing and reuse problems that plague passwords. The NCSC recommends using them where they are offered.

Is it safe to write passwords down?

It can be, if the paper is stored securely and you still use strong unique secrets. The NCSC notes this option for some situations, with clear cautions about access and phishing.

How often should I change passwords?

Change a password when there is a breach, reuse problem or suspected compromise. Forced regular changes without cause are no longer best practice in modern guidance such as NIST SP 800-63B.

Where can I generate a strong password?

Use a reputable password manager generator, or a trusted tool such as the password generator on mfaysal.com, then store the result in your manager.

Last checked: 18 October 2026. Rates and rules can change, so confirm anything important with the official GOV.UK or NCSC source linked above.

Originally published on mfaysal.com.

I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.

Python Lazy Imports: How the New lazy Keyword Works in Python 3.15

Mahir Faysal — Tue, 20 Oct 2026 04:05:44 +0000

Python 3.15 adds explicit lazy imports: write lazy import json (or lazy from pathlib import Path) and Python won’t load the module until your code first uses that name. You keep all your imports neatly at the top of the file, but you only pay the loading cost for modules a particular run actually needs. In my test, a script that imported a slow module started in 0.50 seconds with a normal import and 0.00 seconds with lazy import, and the module loaded later, only when it was called.

Lazy imports come from PEP 810 and are one of the biggest changes in Python 3.15.0, released on 9 October 2026. I tested everything below on Python 3.15.0rc3 (installed with uv python install 3.15), and pasted the real output, including the error messages. The behaviour matches the final release notes.

Why imports slow Python down

When Python imports a module, the What’s New in Python 3.15 guide explains, it must locate the file, read it from disk, compile it to bytecode and execute all its top-level code. For applications with deep dependency trees, that can take seconds, “even when most of the imported code is never actually used during a particular run.”

Command-line tools feel this most. Typing mytool --help shouldn’t load your database driver, plotting library and HTTP client, but with normal imports at the top of the file, it does.

Developers have worked around this for years:

Moving import statements inside functions.
Using importlib.import_module() on demand.
Restructuring code to avoid importing heavy packages.

They all work, but they scatter imports through the code and make it harder to see what a module depends on. The lazy keyword fixes that without moving anything.

The syntax: lazy import and lazy from … import

lazy goes in front of an ordinary import statement. Both forms work:

lazy import json
lazy from pathlib import Path

lazy is a soft keyword, which means it’s only special at the start of an import statement. Existing code that uses lazy as a variable name keeps working; lazy = 5; print(lazy) printed 5 on 3.15.

Older versions don’t understand the syntax at all. Running the same file on Python 3.14 gives:

  File "./app_lazy.py", line 2
    lazy import heavy
         ^^^^^^
SyntaxError: invalid syntax

So the keyword form is only for code that will run on 3.15 or later. There’s a compatible alternative later in this post.

Measuring the startup difference

To see the effect clearly, I made a fake “heavy” module that sleeps for half a second when it loads, standing in for a big library:

# heavy.py
import time
print("  [heavy] loading...")
time.sleep(0.5)
def report():
    return "report ready"

First, a normal import:

# app_eager.py
import time; t = time.perf_counter()
import heavy
print(f"started in {time.perf_counter() - t:.2f}s")

  [heavy] loading...
started in 0.50s

Now the lazy version, which also checks sys.modules (Python’s registry of loaded modules) before and after first use:

# app_lazy.py
import time; t = time.perf_counter()
lazy import heavy
print(f"started in {time.perf_counter() - t:.2f}s")
import sys
print("in sys.modules?", "heavy" in sys.modules)
print(heavy.report())
print("in sys.modules?", "heavy" in sys.modules)

started in 0.00s
in sys.modules? False
  [heavy] loading...
report ready
in sys.modules? True

The import line cost nothing. The module only loaded at heavy.report(), and from then on it’s a completely normal module. If a run never touches heavy, it never loads at all.

What a lazy import actually creates

Behind the scenes, a lazy import binds the name to a lightweight proxy object. The proxy type is available as types.LazyImportType, and sys.get_lazy_imports() tells you the current global mode:

import types, sys
lazy import heavy
lazy from json import dumps
print(type(globals()["heavy"]).__name__, isinstance(globals()["heavy"], types.LazyImportType))
print(sys.get_lazy_imports())
print(dumps({"ok": True}))
print(type(globals()["dumps"]).__name__)

lazy_import True
normal
{"ok": true}
function

I peeked through globals() on purpose, because simply writing heavy would trigger the load. After dumps() was first called, the name was replaced by the real function. The mode normal is the default: only imports marked lazy are lazy.

Where lazy imports aren’t allowed

The 3.15 documentation lists three restrictions, and each one gives a clear SyntaxError. I tried all of them.

Inside a function (or class body):

def f():
    lazy import json

SyntaxError: lazy import not allowed inside functions

Inside try/except (or finally):

try:
    lazy import json
except ImportError:
    pass

SyntaxError: lazy import not allowed inside try/except blocks

Star imports (and from __future__ imports):

lazy from json import *

SyntaxError: lazy from ... import * is not allowed

The try/except rule makes sense once you think about it: a lazy import doesn’t run at that line, so an except ImportError around it could never catch anything. If you need an optional dependency with a fallback, keep using a normal import inside try.

How errors show up with lazy imports

Because nothing is loaded at the import line, a missing module isn’t reported there. The documentation says the exception is raised at the point of first use, with a traceback that includes both places. Here’s what that looks like:

lazy import does_not_exist
print("import line passed")
does_not_exist.run()

import line passed
Traceback (most recent call last):
  File "./app_missing.py", line 1, in <module>
    lazy import does_not_exist
ImportError: lazy import of 'does_not_exist' raised an exception during resolution

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "./app_missing.py", line 3, in <module>
    does_not_exist.run()
    ^^^^^^^^^^^^^^
ModuleNotFoundError: No module named 'does_not_exist'

The program printed “import line passed” before failing. That’s the main trade-off of lazy imports: typos in module names and missing dependencies surface later, possibly in a code path your tests don’t cover. Run your test suite with good coverage, and consider a quick smoke test that imports everything eagerly (see the global mode below).

Making every import lazy: -X lazy_imports and PYTHON_LAZY_IMPORTS

You can switch the behaviour on for a whole program without editing any source, using either the -X lazy_imports command-line option or the PYTHON_LAZY_IMPORTS environment variable. Both accept all (make all imports lazy by default) or normal (the default, respecting only the keyword).

With this plain file:

# app_all.py
import heavy
print("all-mode: started")
print(heavy.report())

$ python3.15 -X lazy_imports=all app_all.py
all-mode: started
  [heavy] loading...
report ready

$ PYTHON_LAZY_IMPORTS=all python3.15 app_all.py
all-mode: started
  [heavy] loading...
report ready

The ordinary import heavy became lazy: “started” printed before the module loaded. This is a quick way to measure how much your app would gain before you change any code. Some libraries rely on side effects at import time (registering plugins, patching other modules), so test carefully before turning all on in production.

You can also change the mode at runtime with sys.set_lazy_imports() and read it with sys.get_lazy_imports().

Choosing which modules are lazy with a filter

For finer control, sys.set_lazy_imports_filter() takes a function that decides per import. It receives the importing module’s name, the imported module’s name and the fromlist, and returns True to allow lazy loading. Here only heavy is allowed to be lazy, and json is forced to load eagerly:

import sys
def only_heavy(importing, imported, fromlist):
    return imported == "heavy"
sys.set_lazy_imports_filter(only_heavy)
sys.set_lazy_imports("all")
import heavy
import json
print("heavy loaded?", "heavy" in sys.modules, "| json loaded?", "json" in sys.modules)

heavy loaded? False | json loaded? True

The documentation suggests a similar pattern for making only your own application’s modules lazy (for example, everything starting with myapp.) while keeping third-party libraries eager.

Supporting Python 3.14 and older: lazy_modules

If your code must still run on older versions, you can’t use the keyword, because it’s a syntax error there. Instead, define __lazy_modules__ at the top of the module: a list of fully qualified module names. On 3.15, normal imports of those modules become lazy; on older versions the variable is just an unused list and the imports run eagerly as before.

__lazy_modules__ = ["heavy"]
import heavy
print("compat: started")
print(heavy.report())

compat: started
  [heavy] loading...
report ready

That’s the best of both worlds for libraries: faster startup on 3.15, no breakage on 3.14.

A real-world example: a command-line tool

Here’s the situation lazy imports were designed for. This small tool has two sub-commands. Only report needs the slow module, but with a normal import, version would pay for it too:

# tool.py
import sys
lazy import heavy

def main(argv):
    if argv[:1] == ["version"]:
        print("tool 1.0")
    elif argv[:1] == ["report"]:
        print(heavy.report())
    else:
        print("usage: tool.py [version|report]")

main(sys.argv[1:])

I timed both commands from the shell:

$ time python3.15 tool.py version
tool 1.0
real 0.01s
$ time python3.15 tool.py report
  [heavy] loading...
report ready
real 0.51s

The version command never loads heavy, so it returns almost instantly. The report command loads it when it’s needed. The import still sits at the top of the file, where anyone reading the code can see every dependency.

Lazy imports vs importing inside a function

The traditional workaround is to put the import inside the function that needs it:

import time, sys
def make_report():
    import heavy          # old trick: import inside the function
    return heavy.report()
t = time.perf_counter()
print("started", f"{time.perf_counter() - t:.2f}s", "heavy" in sys.modules)
print(make_report())

started 0.00s False
  [heavy] loading...
report ready

It works on every Python version and gives the same startup saving, so it’s still a good choice for code that must support 3.14 and earlier. The downsides are readability and repetition: dependencies are hidden inside functions, and if three functions need the module, you write the import three times. With lazy import the dependency is declared once, at the top, and loaded once, on first use.

There’s also importlib.util.LazyLoader, which has existed for years, but it needs several lines of setup code per module. The new keyword replaces that boilerplate for most everyday cases.

How to measure your own import time

Before optimising, find out which imports are actually slow. Python has had a built-in import profiler for years: python -X importtime your_script.py prints how long each module took to import (in microseconds), with nested imports indented. Sort by the cumulative column and the expensive ones stand out. Those are your best candidates for lazy.

A rough checklist I’d follow:

Run python3.15 -X importtime app.py 2> imports.txt and look for the biggest cumulative times.
Try -X lazy_imports=all and time the startup again to see the upper limit of what you can gain.
Mark the slow, rarely used imports with lazy, starting with ones only needed in one command or code path.
Run your tests, and check that import-time side effects (such as plugin registration) still happen when needed.

When lazy imports help (and when they don’t)

They help most in command-line tools with many sub-commands, web apps with rarely used admin features, test suites where each test touches a few modules, and serverless functions where cold-start time costs money.

They don’t help when every run uses every import anyway; you only move the cost later. They also won’t speed up code inside a hot loop, because after first use a lazily imported module is a normal module.

They can surprise you when a module does something important at import time. If import myapp.plugins registers handlers, making it lazy means those handlers don’t exist until something touches myapp.plugins. Keep such imports eager.

For file and path checks at startup, which often go hand in hand with deciding what to load, my guide to checking if a file exists in Python covers pathlib, which itself is a good candidate for lazy from pathlib import Path in small scripts.

FAQ

What is a lazy import in Python?

A lazy import delays loading a module until the imported name is first used. In Python 3.15 you write lazy import module or lazy from module import name, and Python binds a lightweight proxy that loads the real module on first access.

Which Python version supports the lazy keyword?

Python 3.15 and later, released on 9 October 2026 (PEP 810). On Python 3.14 and earlier, lazy import is a SyntaxError. Use __lazy_modules__ if your code must run on both.

Can I use lazy import inside a function?

No. Lazy imports are only allowed at module level. Using lazy inside a function, class body or try/except/finally block raises a SyntaxError. A normal import inside a function is already effectively lazy.

What happens if a lazily imported module doesn’t exist?

The import line succeeds, and the error appears when you first use the name. Python raises an ImportError chained to the original ModuleNotFoundError, with a traceback showing both the import line and the line where you used it.

How do I make all imports lazy?

Run Python with -X lazy_imports=all or set the environment variable PYTHON_LAZY_IMPORTS=all. You can also call sys.set_lazy_imports("all") at runtime, and use sys.set_lazy_imports_filter() to exclude specific modules.

Do lazy imports make my code faster?

They make startup faster when some imports aren’t needed on every run. They don’t speed up code that runs after the module is loaded, and if every import is used on every run, the total time stays about the same.

Is lazy a reserved word now?

No. It’s a soft keyword, only special at the start of an import statement. Variables named lazy still work.

Originally published on mfaysal.com.

I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.

JavaScript Temporal API Tutorial: Replace Date with Tested Examples (2026)

Mahir Faysal — Mon, 19 Oct 2026 04:05:32 +0000

Temporal is JavaScript’s new built-in date and time API, designed to replace the old Date object. Instead of one confusing type, it gives you separate, immutable types for each job: Temporal.PlainDate for a calendar date such as a birthday, Temporal.ZonedDateTime for an exact moment in a named time zone, Temporal.Duration for lengths of time, and Temporal.Instant for a timestamp. Months are numbered 1 to 12, adding a month to 31 January gives 28 February instead of 2 March, and time zones are handled properly.

Temporal is trending because it has finally shipped in mainstream runtimes. Node.js 26.0.0, released on 5 May 2026, turned it on by default, and Node 26 is due to become the long-term support (LTS) release this October. Chrome 144 (13 January 2026) and Firefox 139 (27 May 2025) also support it. I ran every example below on Node.js 26.11.1 on 12 October 2026 and pasted the real output.

Why replace Date?

Date has been in JavaScript since 1995 and has well-known problems:

Months start at 0. new Date(2026, 0, 31) is 31 January, not a mistake you’d guess.
It’s mutable. setMonth() changes the object in place, so passing a date to a function can silently change it for the caller.
Only two time zones. A Date only knows UTC and the computer’s local zone. Showing a meeting time in London and Dhaka needs extra libraries.
Surprising arithmetic. Here’s what happens when you add a month to 31 January with Date:

const old = new Date(2026, 0, 31);
old.setMonth(old.getMonth() + 1);
console.log(old.toISOString().slice(0, 10));

2026-03-02

There’s no 31 February, so Date rolls over into March. Temporal’s answer to the same question is coming up below. If you just need to format an existing Date, my guide to formatting a date as dd/mm/yyyy in JavaScript still works; Temporal is for when you need real date maths.

Check that Temporal is available

Temporal is a global object, like Math. Feature-detect it before relying on it:

console.log(typeof globalThis.Temporal);

On Node.js 26 this printed object. On the box’s older Node.js 20 it printed undefined. Browser support, from the web-features explorer on 12 October 2026, is:

Chrome and Edge: supported from version 144 (January 2026).
Firefox: supported from version 139 (May 2025).
Safari (macOS and iOS): not supported yet, which is why Temporal is still marked “limited availability” rather than Baseline.

For public websites, that Safari gap matters. Use a polyfill such as @js-temporal/polyfill or temporal-polyfill when globalThis.Temporal is missing, or keep Temporal to server-side code on Node 26 for now.

The Temporal types at a glance

Picking the right type is most of the work. Here’s the short version:

Temporal.PlainDate: a calendar date with no time or zone. Birthdays, deadlines, bank holidays.
Temporal.PlainTime: a wall-clock time with no date. Opening hours, alarm times.
Temporal.PlainDateTime: a date and time with no zone. Rarely the right choice for real events, but useful for form inputs before you know the zone.
Temporal.ZonedDateTime: an exact moment plus a time zone such as Europe/London. Meetings, flights, anything that happens at a real moment for people in a place.
Temporal.Instant: an exact moment with no zone, like a timestamp in a database.
Temporal.Duration: a length of time, like “2 months and 2 days”.
Temporal.PlainYearMonth and Temporal.PlainMonthDay: “February 2026” or “25 December” on their own.

PlainDate: working with calendar dates

Create a date from an ISO string (YYYY-MM-DD) and read its parts:

const d = Temporal.PlainDate.from("2026-10-12");
console.log(d.toString(), d.year, d.month, d.day, d.dayOfWeek, d.daysInMonth, d.inLeapYear);

2026-10-12 2026 10 12 1 31 false

October is month 10, not 9. dayOfWeek runs from 1 (Monday) to 7 (Sunday), so 12 October 2026 is a Monday. Useful properties like daysInMonth and inLeapYear are built in.

To get today’s date in the computer’s time zone, use Temporal.Now.plainDateISO(). For the current exact moment, use Temporal.Now.instant().

Start and end of the month

with() returns a copy with some fields replaced:

console.log(d.with({ day: 1 }).toString(), d.with({ day: d.daysInMonth }).toString());

2026-10-01 2026-10-31

Adding days and months (and the 31 January problem)

Temporal objects are immutable: add() and subtract() return a new object and leave the original alone.

const start = Temporal.PlainDate.from("2026-10-12");
const later = start.add({ days: 7 });
console.log(start.toString(), later.toString());

2026-10-12 2026-10-19

Now the same month problem that tripped up Date:

const jan31 = Temporal.PlainDate.from("2026-01-31");
console.log(jan31.add({ months: 1 }).toString());
try {
  jan31.add({ months: 1 }, { overflow: "reject" });
} catch (e) {
  console.log(e.constructor.name + ":", e.message);
}

2026-02-28
RangeError: Temporal error: not a valid ISO date.

By default Temporal constrains the result to the last valid day, 28 February, which is what most people expect for “one month later”. If you’d rather catch the problem, pass { overflow: "reject" } and you get a RangeError instead. The exact error wording comes from Node’s engine and may differ in browsers.

Differences between dates: until() and since()

until() returns a Temporal.Duration. By default the largest unit for dates is days, but you can ask for months or years:

const exam = Temporal.PlainDate.from("2026-12-14");
console.log(start.until(exam).toString(), start.until(exam, { largestUnit: "months" }).toString(), start.until(exam).days);

P63D P2M2D 63

P63D is the ISO 8601 way of writing “63 days”, and P2M2D is “2 months, 2 days”. Read the parts with properties such as .days and .months.

Working out someone’s age

Age calculations are notoriously fiddly with Date. With Temporal, ask for years:

const birth = Temporal.PlainDate.from("2004-02-29");
console.log(birth.until(Temporal.PlainDate.from("2026-10-12"), { largestUnit: "years" }).years);

Even a leap-day birthday works without special-casing.

Comparing and sorting dates

Use Temporal.PlainDate.compare as a sort function and equals() for equality. Don’t use ===, which compares object identity, not dates:

const dates = ["2026-12-01", "2026-01-15", "2026-06-30"].map(s => Temporal.PlainDate.from(s));
console.log(dates.sort(Temporal.PlainDate.compare).map(String).join(", "), start.equals(Temporal.PlainDate.from("2026-10-12")));

2026-01-15, 2026-06-30, 2026-12-01 true

For skipping weekends and bank holidays, the logic in my post on counting UK working days in JavaScript becomes simpler with dayOfWeek and add({ days: 1 }).

ZonedDateTime: time zones done properly

This is where Temporal really shines. Create a moment in a named IANA time zone, then view it in other zones:

const meet = Temporal.ZonedDateTime.from("2026-10-12T15:00[Europe/London]");
console.log(meet.toString());
console.log(meet.withTimeZone("Asia/Dhaka").toString());
console.log(meet.withTimeZone("America/New_York").toPlainTime().toString());

2026-10-12T15:00:00+01:00[Europe/London]
2026-10-12T20:00:00+06:00[Asia/Dhaka]
10:00:00

A 3 pm meeting in London (on British Summer Time, +01:00) is 8 pm in Dhaka and 10 am in New York. The string keeps both the offset and the zone name, so it can be stored and read back without losing information.

Daylight saving time: days vs hours

UK clocks go back on Sunday 25 October 2026. Watch what happens when you add “1 day” versus “24 hours” across that change:

const beforeDst = Temporal.ZonedDateTime.from("2026-10-24T12:00[Europe/London]");
console.log(beforeDst.add({ days: 1 }).toString(), beforeDst.add({ hours: 24 }).toString());

2026-10-25T12:00:00+00:00[Europe/London] 2026-10-25T11:00:00+00:00[Europe/London]

Adding a day keeps the same wall-clock time (noon). Adding 24 hours lands at 11:00, because that particular day was 25 hours long. Temporal makes you choose which one you mean, which is exactly the kind of bug Date hides. The same issue exists on the server side; I covered it for PHP in setting the timezone to Europe/London in PHP.

Durations

Temporal.Duration represents a length of time. It doesn’t automatically “balance” units, but round() and total() will:

const dur = Temporal.Duration.from({ hours: 1, minutes: 90 });
console.log(dur.toString(), dur.round({ largestUnit: "hours" }).toString(), dur.total({ unit: "minutes" }));

PT1H90M PT2H30M 150

PT1H90M is kept exactly as you wrote it, rounding gives PT2H30M (2 hours 30 minutes), and total() converts it to a single number of minutes.

Plain times, date-times and month-days

The other Plain types follow the same pattern:

console.log(Temporal.PlainTime.from("09:15").add({ minutes: 50 }).toString());
console.log(Temporal.PlainDateTime.from("2026-10-12T23:30").add({ hours: 1 }).toString());
console.log(Temporal.PlainYearMonth.from("2026-02").daysInMonth, Temporal.PlainMonthDay.from("12-25").toPlainDate({ year: 2026 }).dayOfWeek);

10:05:00
2026-10-13T00:30:00
28 5

A 50-minute lesson starting at 09:15 ends at 10:05. Adding an hour to 23:30 rolls into the next day. February 2026 has 28 days, and Christmas Day 2026 is a Friday (day 5).

Converting between Temporal and Date

You’ll be mixing old and new code for a while, so conversions matter. An Instant maps cleanly to and from epoch milliseconds, and Date has a new toTemporalInstant() method:

const inst = Temporal.Instant.fromEpochMilliseconds(Date.UTC(2026, 9, 12, 9, 30));
console.log(inst.toString(), inst.epochMilliseconds, new Date(inst.epochMilliseconds).toISOString());
console.log(new Date("2026-10-12T09:30:00Z").toTemporalInstant().toString());

2026-10-12T09:30:00Z 1791797400000 2026-10-12T09:30:00.000Z
2026-10-12T09:30:00Z

Note the old Date.UTC(2026, 9, ...) needs month 9 for October. That’s the zero-based month problem again, and one more reason to move to Temporal.

Formatting dates for people

Every Temporal type has toLocaleString(), which uses the same Intl options you may know from Date:

console.log(d.toLocaleString("en-GB", { dateStyle: "full" }));
console.log(meet.toLocaleString("en-GB", { dateStyle: "medium", timeStyle: "short" }));

Monday, 12 October 2026
12 Oct 2026, 15:00

One gotcha I hit: combining dateStyle or timeStyle with individual options such as timeZoneName throws TypeError: Invalid option. That’s an Intl.DateTimeFormat rule, not a Temporal bug. Use either the style shortcuts or individual fields like { day: "numeric", month: "long", timeZoneName: "short" }.

Validation: rejecting bad dates

Temporal refuses to parse impossible ISO strings and non-ISO formats:

try { Temporal.PlainDate.from("2026-02-30", { overflow: "reject" }); }
catch (e) { console.log(e.constructor.name + ":", e.message); }
try { Temporal.PlainDate.from("12/10/2026"); }
catch (e) { console.log(e.constructor.name + ":", e.message); }

RangeError: Temporal error: Parsed day value not in a valid range.
RangeError: Temporal error: Invalid character while parsing year value.

In my tests, "2026-02-30" was rejected even without the overflow option, because ISO strings are validated strictly. If you build a date from separate fields, though, the default overflow: "constrain" clamps it: Temporal.PlainDate.from({ year: 2026, month: 2, day: 30 }) gave 2026-02-28. For user input from a form, parse the parts yourself and pass { overflow: "reject" } so mistakes are caught rather than silently adjusted.

"12/10/2026" fails outright. That’s a feature: it’s ambiguous (12 October or 10 December?), and Temporal won’t guess.

Two practical examples

Adding working days

Skipping weekends is a loop over dayOfWeek (Saturday is 6, Sunday is 7):

function addWorkingDays(date, n) {
  let d = date;
  while (n > 0) {
    d = d.add({ days: 1 });
    if (d.dayOfWeek <= 5) n--;
  }
  return d;
}
const friday = Temporal.PlainDate.from("2026-10-16");
console.log(friday.dayOfWeek, addWorkingDays(friday, 3).toString());

5 2026-10-21

Three working days after Friday 16 October is Wednesday 21 October. Because add() never mutates, there’s no risk of changing the caller’s friday by accident.

A countdown across time zones

Here’s a countdown from 09:15 in Dhaka to a launch at 18:00 in London. My first attempt threw an error worth knowing about:

RangeError: Temporal error: Timezones must be the same if unit is a day unit.

Days can be 23 or 25 hours long depending on the zone, so Temporal refuses to count days between two different zones. Convert one side first:

function countdown(now, deadline) {
  const left = now.until(deadline.withTimeZone(now.timeZoneId), { largestUnit: "days", smallestUnit: "minutes" });
  return `${left.days}d ${left.hours}h ${left.minutes}m`;
}
const now = Temporal.ZonedDateTime.from("2026-10-12T09:15[Asia/Dhaka]");
const launch = Temporal.ZonedDateTime.from("2026-10-20T18:00[Europe/London]");
console.log(countdown(now, launch));
console.log(JSON.stringify({ launch }));

8d 13h 45m
{"launch":"2026-10-20T18:00:00+01:00[Europe/London]"}

JSON.stringify uses the full string with offset and zone, and Temporal.ZonedDateTime.from() reads it back to an equal value, so storing Temporal values in JSON or a text column is lossless.

Common Temporal mistakes

Using PlainDateTime for real events. Without a zone, “2026-10-25T01:30” is ambiguous on the night the clocks change. Use ZonedDateTime.
Comparing with === or <. Use equals() and compare().
Expecting Duration to balance itself. Call round() or total().
Forgetting Safari. Feature-detect and polyfill for browser code.
Assuming error messages are identical everywhere. Catch RangeError by type, not by message text.
Counting days between two different time zones. Convert one value with withTimeZone() first, as in the countdown example.
Storing a PlainDateTime when you meant an Instant. For logs and database timestamps, store an Instant (or a ZonedDateTime string) so the exact moment is never lost.

FAQ

What is the Temporal API in JavaScript?

Temporal is a built-in global object that provides modern, immutable date and time types, including PlainDate, ZonedDateTime, Instant and Duration. It’s designed to replace the older Date object.

Is Temporal supported in Node.js?

Yes. Node.js 26.0.0, released on 5 May 2026, enables Temporal by default with no flag. Node.js 20 and older don’t have it, so typeof Temporal returns "undefined" there.

Which browsers support Temporal?

As of 12 October 2026, Chrome and Edge 144+ and Firefox 139+ support it. Safari on macOS and iOS doesn’t yet, so use a polyfill for public websites.

What is the difference between PlainDate and ZonedDateTime?

PlainDate is just a calendar date with no time or time zone, like a birthday. ZonedDateTime is an exact moment in a specific time zone, such as a meeting at 15:00 in Europe/London.

How do I add months to a date in JavaScript without bugs?

Use Temporal.PlainDate.from("2026-01-31").add({ months: 1 }), which returns 28 February 2026. Pass { overflow: "reject" } if you’d rather get an error than an adjusted date.

How do I convert a Date to Temporal?

Call date.toTemporalInstant() to get a Temporal.Instant, then instant.toZonedDateTimeISO("Europe/London") if you need a time zone. To go back, use new Date(instant.epochMilliseconds).

Are Temporal objects mutable?

No. Every Temporal object is immutable. Methods such as add(), subtract() and with() return a new object and leave the original unchanged.

Originally published on mfaysal.com.

I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.

Why Is My Hard Drive Smaller Than Advertised? GB vs GiB Explained

Mahir Faysal — Sun, 18 Oct 2026 04:05:14 +0000

A drive sold as 1TB shows as about 931GB in Windows because the two use different units. Drive makers count 1TB as 1,000,000,000,000 bytes (powers of 1,000). Windows divides by powers of 1,024 and still labels the result "GB", when it is really gibibytes (GiB). No space has gone missing; the same number of bytes is being described two ways. A small extra amount also goes to partitions and the file system.

Below you will find the maths, a table for common drive sizes, and how to check your own drive. For quick conversions, use the GB to TB converter.

Decimal vs binary units explained

Computers work in binary, so early software measured memory in powers of 2. A "kilobyte" came to mean 1,024 bytes because 2 to the power of 10 is 1,024, which is close to 1,000. The gap is small at that size but grows with each step.

To end the confusion, the International Electrotechnical Commission created binary prefixes in 1998: kibibyte (KiB), mebibyte (MiB), gibibyte (GiB) and tebibyte (TiB). The US National Institute of Standards and Technology explains these prefixes. Drive makers use the standard SI meaning, so 1GB is 1,000,000,000 bytes.

Decimal (SI)	Bytes	Binary (IEC)	Bytes
1 KB	1,000	1 KiB	1,024
1 MB	1,000,000	1 MiB	1,048,576
1 GB	1,000,000,000	1 GiB	1,073,741,824
1 TB	1,000,000,000,000	1 TiB	1,099,511,627,776

The maths: why 1TB becomes 931GB

Take a 1TB drive with 1,000,000,000,000 bytes. Windows divides by 1,024 three times to get "GB":

1,000,000,000,000 ÷ 1,073,741,824 = 931.32

So Windows reports about 931GB. The difference is roughly 6.9% at the terabyte level, and it grows to about 9.1% at the tebibyte level for larger drives.

Advertised vs shown size for common drives

Advertised	Bytes	Shown in Windows
128GB	128,000,000,000	119.2 GB
256GB	256,000,000,000	238.4 GB
512GB	512,000,000,000	476.8 GB
1TB	1,000,000,000,000	931.3 GB
2TB	2,000,000,000,000	1.82 TB
4TB	4,000,000,000,000	3.64 TB
8TB	8,000,000,000,000	7.28 TB

Real drives often hold slightly more bytes than the round number, so your figure may be a little higher than this table.

Other reasons you see less free space

Recovery and system partitions: Windows and laptop makers often create hidden partitions of a few hundred megabytes up to several gigabytes.
File system overhead: NTFS, exFAT and other formats need space for their own tables. Our guide to NTFS vs FAT32 vs exFAT covers the trade-offs.
The operating system: a fresh Windows install, updates, the page file and hibernation file can take tens of gigabytes.
SSD over-provisioning: some SSDs reserve spare space to manage wear, and the labelled capacity already excludes it.

Do Mac and phones show the same thing?

No. Since Mac OS X 10.6 Snow Leopard, macOS reports storage in decimal units, so a 1TB drive shows as about 1TB. Windows is the main system that still divides by 1,024 while labelling the result GB. Phones vary by maker, and the operating system itself takes a large share of internal storage.

How to check your drive's real size

Open File Explorer, right-click the drive and choose Properties.
Look at Capacity. Windows shows the exact number of bytes next to the rounded GB figure.
Divide the bytes by 1,000,000,000 to get the decimal GB figure the maker used.

If the byte count is far below the label, for example a "1TB" USB stick showing 32GB worth of bytes, the drive may be fake. Test it before you trust it with data. For other conversions, the bytes to MB converter gives exact values.

Frequently asked questions

Why does my 1TB drive show 931GB?

Drive makers count 1TB as one trillion bytes. Windows divides by 1,024 instead of 1,000 and labels the result GB, so the same space appears as about 931GB.

Is GB 1,000 or 1,024 megabytes?

Under the SI standard, 1GB is 1,000MB. The binary unit, 1GiB, is 1,024MiB. Windows uses the binary value but writes GB.

What is a GiB?

A gibibyte is 1,073,741,824 bytes (1,024 to the power of 3). It was defined by the IEC to separate binary sizes from decimal ones.

Am I being cheated by the drive maker?

No. The maker labels capacity in standard decimal units, and the bytes are all there. The difference comes from how Windows displays the number.

Why does my 256GB phone show so little free space?

The decimal-to-binary gap is part of it, but the operating system and preinstalled apps take most of the difference.

Does macOS show the full capacity?

Yes. macOS has used decimal units since version 10.6, so a 1TB drive shows as roughly 1TB.

Last checked: 16 October 2026. Rules and dates can change, so confirm anything important with the official source linked above.

Originally published on mfaysal.com.

I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.

Python frozendict: The New Immutable Dictionary in Python 3.15 (Tested)

Mahir Faysal — Sat, 17 Oct 2026 04:02:06 +0000

frozendict is a new built-in type in Python 3.15: a dictionary that can’t be changed after you create it. You make one just like a dict, for example frozendict(host="localhost", port=5432), and read from it the same way, but any attempt to add, change or delete a key raises an error. Because it can’t change, a frozendict is hashable (as long as its keys and values are), so you can use it as a dictionary key or put it in a set, which a normal dict can never do.

Python 3.15.0 was released on 9 October 2026, and frozendict (PEP 814) is one of its headline features alongside lazy imports. I ran every example below on Python 3.15.0rc3, the final release candidate, installed with uv python install 3.15, and pasted the real output under each one. The behaviour matches the What’s New in Python 3.15 documentation for the final release.

Why Python added frozendict

Python has always had an immutable version of list (tuple) and of set (frozenset), but not of dict. Developers worked around that with types.MappingProxyType, with third-party packages, or by converting dicts to sorted tuples of pairs whenever they needed something hashable. None of those options were built in and obvious.

An immutable dictionary is useful whenever data should not change after it’s created:

Configuration that’s loaded once and read everywhere.
Default arguments for functions, where a mutable {} default is a classic bug.
Cache keys made of several named values, such as (city, unit) lookups.
Constants shared between modules, where an accidental write would cause a hard-to-find bug.
Thread-safe sharing, because nobody can mutate an object that can’t be mutated.

How to create a frozendict

You don’t import anything; frozendict is a built-in, just like dict. It accepts the same kinds of input as dict(): keyword arguments, an existing mapping, or an iterable of key–value pairs.

a = frozendict(x=1, y=2)
print(a)
print(frozendict({"host": "localhost", "port": 5432}))
print(frozendict([("a", 1), ("b", 2)]))

frozendict({'x': 1, 'y': 2})
frozendict({'host': 'localhost', 'port': 5432})
frozendict({'a': 1, 'b': 2})

frozendict.fromkeys() works too, which is handy for building a fixed set of counters or flags:

print(frozendict.fromkeys(["a", "b"], 0))

frozendict({'a': 0, 'b': 0})

There’s no literal syntax like {...} for a frozendict. You always call frozendict(...).

What you can’t do: frozendict is read-only

Every operation that would change the mapping fails. I tried the usual suspects:

for stmt in ["a['z'] = 3", "del a['x']", "a.update(z=3)", "a.pop('x')", "a.clear()"]:
    try:
        exec(stmt, {"a": a})
    except (TypeError, AttributeError) as e:
        print(stmt, "->", type(e).__name__ + ":", e)

a['z'] = 3 -> TypeError: 'frozendict' object does not support item assignment
del a['x'] -> TypeError: 'frozendict' object does not support item deletion
a.update(z=3) -> AttributeError: 'frozendict' object has no attribute 'update'
a.pop('x') -> AttributeError: 'frozendict' object has no attribute 'pop'
a.clear() -> AttributeError: 'frozendict' object has no attribute 'clear'

Notice the two kinds of error. Assigning or deleting with square brackets raises TypeError. Mutating methods such as update(), pop(), clear() and setdefault() simply don’t exist, so you get AttributeError. In fact, the public methods on frozendict in my 3.15 build were just these:

['copy', 'fromkeys', 'get', 'items', 'keys', 'values']

What you can do: reading works like a dict

All the read operations you already know from dictionaries work the same way:

print(a["x"], a.get("z", "missing"), list(a.keys()), list(a.items()), len(a), "x" in a)

1 missing ['x', 'y'] [('x', 1), ('y', 2)] 2 True

You can loop over it, unpack it with **, pass it to dict() and use comprehensions on it. If you’re used to looping with .items(), my Python list comprehension examples all work on a frozendict as the source, as long as you’re building a new object rather than editing the old one.

Why frozendict is hashable (and why that matters)

A value is hashable if Python can compute a fixed number for it with hash(). Only hashable values can be dictionary keys or set members. A normal dict isn’t hashable because it can change; if it changed after being used as a key, the lookup would break.

frozendict can’t change, so Python lets you hash it. The documentation also notes that a frozendict preserves insertion order, but comparison doesn’t take order into account:

b = frozendict(y=2, x=1)
print(hash(a) == hash(b), a == b, a == {"x": 1, "y": 2})

True True True

So two frozendicts with the same pairs in a different order are equal and hash the same, and a frozendict compares equal to a normal dict with the same contents. The order is still kept for display and iteration:

print(frozendict(b=1, a=2), list(frozendict(b=1, a=2)))

frozendict({'b': 1, 'a': 2}) ['b', 'a']

Using a frozendict as a dictionary key

This is the feature that makes it genuinely new. Here’s a tiny cache keyed by a set of named options:

cache = {frozendict(city="Leeds", unit="C"): 14}
print(cache[frozendict(unit="C", city="Leeds")])

The lookup key is written in a different order, but it still finds the entry. Before 3.15, you’d typically write tuple(sorted(options.items())) to get the same effect, which is harder to read and easy to get wrong.

Removing duplicate dicts with a set

Because frozendicts can live in a set, you can de-duplicate records:

print(len({a, b}))

a and b are equal, so the set keeps just one. For de-duplicating lists of simple values, the techniques in my guide to removing duplicates from a list in Python still apply; frozendict simply extends the same idea to records.

The catch: values must be hashable too

A frozendict is only hashable if all its keys and values are. A list inside it breaks hashing, even though the frozendict itself still can’t be modified:

c = frozendict(tags=["php", "sql"])
try:
    hash(c)
except TypeError as e:
    print("TypeError:", e)

TypeError: unhashable type: 'list'

Use a tuple (tags=("php", "sql")) or a frozenset if you need the whole thing to be hashable.

frozendict is not a subclass of dict

This is the gotcha most likely to bite existing code. The documentation says a frozendict “is not a subclass of dict; it inherits directly from object.” I checked:

from collections.abc import Mapping
print(isinstance(a, dict), isinstance(a, Mapping), type(a).__mro__)

False True (<class 'frozendict'>, <class 'object'>)

Any function that checks isinstance(arg, dict) will reject a frozendict. The documentation recommends two fixes:

isinstance(arg, (dict, frozendict)) if you want exactly those two types.
isinstance(arg, collections.abc.Mapping) if you want to accept any read-only mapping, including MappingProxyType.

The second option is usually the better design: most functions only need to read keys and values, so they should ask for a Mapping, not a dict.

Creating changed copies: | and dict()

Since you can’t edit a frozendict, you create a new one with the changes. The merge operator | works and returns a frozendict when the left side is one:

print(a | {"z": 3}, type(a | {"z": 3}).__name__)
print(type({"a": 1} | frozendict(b=2)).__name__)

frozendict({'x': 1, 'y': 2, 'z': 3}) frozendict
dict

The result type follows the left-hand operand: frozendict | dict gives a frozendict, while dict | frozendict gives a normal dict. To change a value, build a dict, adjust it and freeze it again:

print(dict(a), frozendict(dict(a, x=10)))

{'x': 1, 'y': 2} frozendict({'x': 10, 'y': 2})

copy() is cheap: because the object can never change, a.copy() is a returned True in my test, and copy.copy(a) is a did too. There’s no point duplicating something immutable.

JSON, pickle and the standard library

According to the 3.15 documentation, these standard library modules were updated to accept frozendict: copy, decimal, json, marshal, plistlib (serialisation only), pickle, pprint and xml.etree.ElementTree. JSON and pickle round-trips worked in my test:

import json, copy, pickle
print(json.dumps(a), copy.copy(a) is a, pickle.loads(pickle.dumps(a)) == a)

{"x": 1, "y": 2} True True

Note that json.loads() still returns ordinary dicts when you read JSON back. If you want a frozen config from a JSON file, wrap the result: frozendict(json.load(f)). For writing JSON nicely formatted, the options in my post on writing JSON to a file with pretty print work with frozendicts unchanged.

Nested data: frozendict is shallow

Freezing the outer mapping doesn’t freeze what’s inside. If you want nested config to be read-only, freeze each level:

cfg = frozendict(db=frozendict(host="localhost"), debug=False)
try:
    cfg["db"]["host"] = "x"
except TypeError as e:
    print("TypeError:", e)

TypeError: 'frozendict' object does not support item assignment

If db had been a normal dict, cfg["db"]["host"] = "x" would have worked silently.

A recursive freeze() helper for JSON config

Real config is usually loaded from JSON and nested several levels deep. This small helper converts every dict into a frozendict and every list into a tuple, so the whole structure becomes read-only and hashable:

import json

def freeze(value):
    if isinstance(value, dict):
        return frozendict({k: freeze(v) for k, v in value.items()})
    if isinstance(value, list):
        return tuple(freeze(v) for v in value)
    return value

raw = json.loads('{"site": "mfaysal.com", "db": {"host": "localhost", "port": 3306}, "admins": ["mahir"]}')
CONFIG = freeze(raw)
print(CONFIG)
print(CONFIG["db"]["port"], hash(CONFIG) == hash(freeze(raw)))
try:
    CONFIG["db"]["port"] = 5432
except TypeError as e:
    print("TypeError:", e)

frozendict({'site': 'mfaysal.com', 'db': frozendict({'host': 'localhost', 'port': 3306}), 'admins': ('mahir',)})
3306 True
TypeError: 'frozendict' object does not support item assignment

Load the file once at startup, freeze it, and import CONFIG wherever you need it. Any code that tries to change a setting at runtime fails loudly instead of quietly affecting the rest of the app.

A safe default argument

A mutable default argument such as def connect(options={}) is one of Python’s best-known traps, because the same dict is shared between every call. A frozendict default is safe because nothing can change it:

def connect(options=frozendict(timeout=5)):
    return options["timeout"]
print(connect())

frozendict vs MappingProxyType vs dict

Before 3.15, types.MappingProxyType was the built-in way to get a read-only view. It’s still useful, but it’s different in an important way: it’s a view of an underlying dict, not a frozen copy.

import types
inner = {"x": 1}
mp = types.MappingProxyType(inner)
inner["x"] = 99
print(mp["x"])
f = frozendict(inner)
inner["x"] = 1
print(f["x"])

99
99

The proxy showed the change to inner, because it only wraps it. The frozendict kept the value it had when it was created (99), even after inner changed back to 1. A MappingProxyType also isn’t hashable. Here’s how the three compare:

dict: mutable, not hashable, available in every version.
types.MappingProxyType: read-only view; changes to the underlying dict show through; not hashable; available since Python 3.3.
frozendict: a frozen copy; nothing can change it; hashable when its contents are; new in Python 3.15.

Supporting older Python versions

frozendict doesn’t exist before 3.15, so code that must also run on 3.14 or earlier needs a fallback. A simple approach is to fall back to a read-only proxy, accepting that you lose hashability on older versions:

import sys, types
try:
    frozendict
except NameError:
    frozendict = types.MappingProxyType
print(sys.version_info[:2] >= (3, 15))

True

On 3.15 the try succeeds and you get the real built-in. On older versions you get a read-only wrapper. Don’t rely on hashing in that case, and remember that MappingProxyType needs a dict argument rather than keyword arguments.

Should you switch your dicts to frozendict?

Not everywhere. Normal dicts are still the right choice for data you build up and change. Reach for frozendict when:

A value is meant to be constant, and an accidental write would be a bug.
You need a mapping as a dict key or set member.
You want a safe default argument or a shared object between threads.

Keep in mind the deployment side too: Python 3.15 is brand new, so check that your hosting platform and libraries support it before you rely on new built-ins in production.

FAQ

What is frozendict in Python?

frozendict is a built-in immutable dictionary type added in Python 3.15 (PEP 814). It behaves like a read-only dict: you can read keys and values, but you can’t add, change or delete entries after creating it.

Which Python version has frozendict?

Python 3.15 and later. It was released on 9 October 2026. On Python 3.14 and earlier, the name frozendict doesn’t exist unless you install a third-party package or define a fallback.

Is frozendict hashable?

Yes, as long as all its keys and values are hashable. That means you can use it as a dictionary key or put it in a set. A frozendict containing a list raises TypeError: unhashable type: 'list' when hashed.

Is frozendict a subclass of dict?

No. It inherits directly from object, so isinstance(x, dict) returns False. Check for collections.abc.Mapping or (dict, frozendict) instead.

How do I add a key to a frozendict?

You can’t change it in place, but you can create a new one with the merge operator: new = old | {"key": "value"}. When the left side is a frozendict, the result is also a frozendict.

What is the difference between frozendict and MappingProxyType?

MappingProxyType is a read-only view of an existing dict, so changes to that dict show through, and it isn’t hashable. A frozendict is an independent frozen copy that never changes and is hashable when its contents are.

Does frozendict keep insertion order?

Yes. It preserves insertion order for display and iteration, but equality ignores order, so frozendict(x=1, y=2) == frozendict(y=2, x=1) is True.

Originally published on mfaysal.com.

I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.

Python enumerate(): How to Start at 1 (and 12 Tested Examples)

Mahir Faysal — Fri, 16 Oct 2026 03:59:20 +0000

To loop over a list in Python and get a counter that starts at 1, write for n, item in enumerate(items, start=1):. enumerate() returns pairs of (count, item), and the optional start argument sets the first number; it defaults to 0. You can also pass it positionally, as enumerate(items, 1). Changing start only changes the number you see, not which item comes first, so if you use that number to index the list, subtract one.

I ran every example in this post on Python 3.13.5 on 11 October 2026 and pasted the real output under each one. If you’re working through Python basics, this pairs well with my Python list comprehension examples, because enumerate() and comprehensions turn up together all the time.

What enumerate() does

The Python documentation for enumerate() gives the signature as enumerate(iterable, start=0). It returns an enumerate object, an iterator that yields tuples containing a count (starting from start) and the values from the iterable.

Here’s the most basic use:

fruits = ["apple", "banana", "cherry"]
for i, fruit in enumerate(fruits):
    print(i, fruit)

0 apple
1 banana
2 cherry

The i, fruit part is tuple unpacking. Each loop gets a tuple like (0, 'apple'), and Python splits it into two variables. You can name them anything; i and index are common.

How to make enumerate start at 1

Pass start=1. This is perfect for numbered lists that humans will read, where “item 0” would look odd:

for n, fruit in enumerate(fruits, start=1):
    print(f"{n}. {fruit}")

1. apple
2. banana
3. cherry

The f-string here builds each line; my Python f-string formatting examples cover padding and alignment if you want the numbers to line up in columns.

Two things to keep straight:

start changes the counter, not the position. The first item is still fruits[0].
If you use the counter to index or change the list, use fruits[n - 1], or simply keep the default start=0 for that loop.

What enumerate() actually returns

enumerate() doesn’t build a list. It returns a lazy iterator that produces one pair at a time, which is why it’s memory-friendly on large data. You can step through it by hand with next() or turn the rest into a list:

e = enumerate(fruits)
print(type(e).__name__, next(e), list(e))
print(list(enumerate("abc", 1)))

enumerate (0, 'apple') [(1, 'banana'), (2, 'cherry')]
[(1, 'a'), (2, 'b'), (3, 'c')]

Two details from that output. Once next(e) has taken the first pair, list(e) only gets what’s left: iterators are used up as you go. And enumerate() works on any iterable, including a string, where each “item” is a character.

How enumerate() works under the hood

There’s no magic inside enumerate(). The Python documentation shows that it’s equivalent to this small generator function:

def enumerate(iterable, start=0):
    n = start
    for elem in iterable:
        yield n, elem
        n += 1

Reading it line by line explains every behaviour in this post. The counter begins at whatever you pass as start. Each step hands back a tuple of the current number and the next element, then adds one. Because it uses yield, nothing is calculated until the loop asks for the next pair, which is why enumerate() works on huge files and endless generators without loading them into memory. And because it simply loops over iterable, it accepts anything a for loop accepts.

You’d never redefine the built-in like this in real code, since it would hide the faster C version, but writing it out once is a good way to understand generators.

enumerate() vs range(len())

Many beginners, me included, first write index loops like this:

for i in range(len(fruits)):
    print(i, fruits[i])

0 apple
1 banana
2 cherry

It works, but enumerate() is usually better:

Gives you the item directly: range(len(items)): No, you write items[i]; enumerate(items): Yes.
Works with any iterable (files, generators, sets): range(len(items)): No, needs len() and indexing; enumerate(items): Yes.
Easy to start counting at 1: range(len(items)): range(1, len(items) + 1) and then items[i - 1]; enumerate(items): start=1.
Readability: range(len(items)): More noise; enumerate(items): Says what you mean.

range(len()) still makes sense when you genuinely only need the numbers, or when you’re comparing an item with its neighbour (items[i] and items[i + 1]).

Changing list items in place with enumerate

You can’t change a list by assigning to the loop variable, because that only rebinds the name. You need the index, and enumerate() gives you both:

prices = [10.0, 12.5, 8.0]
for i, p in enumerate(prices):
    prices[i] = round(p * 1.2, 2)
print(prices)

[12.0, 15.0, 9.6]

This adds 20% to each price. Notice I kept the default start=0 here because I’m using i as a real index.

enumerate() with a dictionary

Looping over a dict gives you its keys, so to get keys, values and a counter, call .items() and unpack the inner tuple with brackets:

scores = {"Ayesha": 91, "Ben": 73}
for rank, (name, score) in enumerate(scores.items(), start=1):
    print(rank, name, score)

1 Ayesha 91
2 Ben 73

Dictionaries keep insertion order (guaranteed since Python 3.7), so the ranks follow the order you added the keys. To rank by score instead, sort the items first. With Chloe added on 88:

scores = {"Ayesha": 91, "Ben": 73, "Chloe": 88}
ranked = sorted(scores.items(), key=lambda kv: kv[1], reverse=True)
for rank, (name, score) in enumerate(ranked, start=1):
    print(rank, name, score)

1 Ayesha 91
2 Chloe 88
3 Ben 73

enumerate() with zip(): index plus two lists

zip() walks two lists side by side. Wrap it in enumerate() to number the pairs:

names = ["Ayesha", "Ben", "Chloe"]
marks = [91, 73, 88]
for i, (name, mark) in enumerate(zip(names, marks), start=1):
    print(i, name, mark)

1 Ayesha 91
2 Ben 73
3 Chloe 88

The order matters: enumerate(zip(...)) gives (i, (name, mark)), so you need the brackets around (name, mark) when unpacking.

Looping backwards with reversed and enumerate

reversed() needs a sequence it can walk backwards, and an enumerate object isn’t one. Calling reversed(enumerate(fruits)) directly raised TypeError: 'enumerate' object is not reversible in my test. Convert it to a list first, which keeps the original numbers attached to each item:

for i, fruit in reversed(list(enumerate(fruits, start=1))):
    print(i, fruit)

3 cherry
2 banana
1 apple

If you want the count to go 1, 2, 3 while the items go backwards, do it the other way round:

for i, f in enumerate(reversed(fruits), start=1):
    print(i, f)

1 cherry
2 banana
3 apple

This version works without building a list, because reversed() runs on the original list, and enumerate() happily wraps any iterator.

Line numbers when reading a file

Files are iterables of lines, so enumerate(f, start=1) gives you human-friendly line numbers for error messages. I’ve used an in-memory file here so the example runs anywhere, but a real open("scores.csv") works the same way:

import io
fake = io.StringIO("name,score\nAyesha,91\nBen,seventy\n")
for line_no, line in enumerate(fake, start=1):
    if line_no == 1:
        continue  # skip the header
    name, score = line.strip().split(",")
    if not score.isdigit():
        print(f"line {line_no}: bad score {score!r}")

line 3: bad score 'seventy'

Reporting “line 3” rather than “row 1 after the header” makes it easy to find the problem in a text editor. For proper CSV parsing with quoted fields, use the csv module, as in my guide to reading a CSV in Python without pandas.

enumerate() in list and dict comprehensions

enumerate() fits neatly into comprehensions. Two patterns I use a lot: building a lookup from item to position, and finding the positions of items that match a test:

print({fruit: i for i, fruit in enumerate(fruits)})
print([i for i, f in enumerate(fruits) if "an" in f])

{'apple': 0, 'banana': 1, 'cherry': 2}
[1]

The second one returns [1] because only “banana” contains “an”. It finds every match, unlike list.index(), which stops at the first.

Every second item, and other counter tricks

Because you have the counter, you can act on every nth item with the modulo operator:

for i, f in enumerate(fruits):
    if i % 2 == 0:
        print(i, f)

0 apple
2 cherry

For simply taking every second item, slicing (fruits[::2]) is shorter. Use enumerate() when you also need the position, for example to print “row 3 of 10” or to add a separator before every item except the first (if i > 0:).

Numbering results on page 2 and beyond

start is great for paginated lists. If page 2 shows items 11 to 20, you want the numbers to carry on from page 1 rather than restart at 1. Work out the offset once and pass offset + 1 as start:

results = [f"item-{n}" for n in range(1, 26)]
page, per_page = 2, 10
offset = (page - 1) * per_page
for n, item in enumerate(results[offset:offset + per_page], start=offset + 1):
    print(n, item)

11 item-11
12 item-12
...
20 item-20

I’ve trimmed the middle lines of the output; the full run printed 11 to 20 in order. The same offset is what you’d pass to LIMIT ... OFFSET ... in SQL when fetching that page from a database.

Nested loops: rows and columns

For a grid (a list of lists), use one enumerate() per level to get row and column numbers. Here I look for every O on a small noughts-and-crosses board:

grid = [["X", "O", "X"], ["O", "X", "O"]]
for r, row in enumerate(grid):
    for c, cell in enumerate(row):
        if cell == "O":
            print(f"O at row {r}, col {c}")

O at row 0, col 1
O at row 1, col 0
O at row 1, col 2

Use the default start=0 here, so the numbers match grid[r][c] exactly. That makes it easy to update a cell later with grid[r][c] = "X".

Negative and non-integer start values

start can be any integer, including a negative one. It can’t be a float:

print(list(enumerate(fruits, start=-1)))
try:
    list(enumerate(fruits, start=1.5))
except TypeError as err:
    print("TypeError:", err)

[(-1, 'apple'), (0, 'banana'), (1, 'cherry')]
TypeError: 'float' object cannot be interpreted as an integer

Negative starts are rare, but they’re handy when your numbering needs an offset, such as counting relative to a reference row.

The list.index() trap

A common beginner bug is to call .index() inside a loop to find the current position. It returns the position of the first matching value, so it goes wrong as soon as the list has duplicates:

dupes = ["a", "b", "a"]
print([dupes.index(x) for x in dupes], [i for i, _ in enumerate(dupes)])

[0, 1, 0] [0, 1, 2]

The third item is at position 2, but .index() says 0. It’s also slow on big lists, because it searches from the beginning every time. enumerate() gives the correct position for free. The _ is a convention for “I don’t need this value”.

Common enumerate() mistakes

Swapping the order: it’s for i, item in enumerate(items), count first. for item, i in ... runs without error but gives you confusing names.
Forgetting to unpack: for pair in enumerate(items) gives you tuples; use pair[0] and pair[1] or unpack straight away.
Using the start=1 counter as an index: items[n] with start=1 skips the first item and raises IndexError on the last.
Reusing an exhausted enumerate object: like any iterator, it’s empty after one full pass. Call enumerate() again for a second loop.
Changing the list while enumerating it: appending to or removing from a list inside its own for loop shifts the positions under you, so items get skipped or processed twice. Loop over a copy (for i, x in enumerate(items[:]):) or build a new list instead.
Needing a running total, not a counter: enumerate() only counts items. For sums, use a separate variable or itertools.accumulate().

FAQ

How do I make Python enumerate start at 1?

Pass the start argument: for n, item in enumerate(items, start=1):. You can also write enumerate(items, 1). The first item is still items[0]; only the counter changes.

What does enumerate() return in Python?

It returns an enumerate object, a lazy iterator that yields (count, item) tuples. Wrap it in list() if you want to see all the pairs at once, for example list(enumerate(["a", "b"])) gives [(0, 'a'), (1, 'b')].

Is enumerate faster than range(len())?

For everyday loops the speed difference is small, but enumerate() is cleaner, works with any iterable (including files and generators) and avoids indexing mistakes. Choose it for readability first.

How do I use enumerate with a dictionary?

Use .items() and unpack the inner pair: for i, (key, value) in enumerate(my_dict.items(), start=1):. Looping over the dict directly gives you only the keys.

Can enumerate start at a negative number?

Yes. Any integer works, so enumerate(items, start=-1) numbers the items -1, 0, 1 and so on. A float such as 1.5 raises a TypeError.

How do I enumerate in reverse in Python?

Use reversed(list(enumerate(items))) to keep each item’s original number while looping backwards, or enumerate(reversed(items), start=1) to count upwards over the reversed items.

Does enumerate work with strings and files?

Yes. enumerate() accepts any iterable. A string yields one character at a time, and an open file yields one line at a time, which makes enumerate(f, start=1) a neat way to get line numbers.

Originally published on mfaysal.com.

I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.

MySQL GROUP_CONCAT with ORDER BY, SEPARATOR and DISTINCT (Tested on 8.4)

Mahir Faysal — Thu, 15 Oct 2026 04:07:24 +0000

To join several rows into one string per group in MySQL, use GROUP_CONCAT() with GROUP BY. The order and the separator go inside the brackets: GROUP_CONCAT(subject ORDER BY subject SEPARATOR ', '). Add DISTINCT straight after the opening bracket to drop duplicates. Two things catch people out: NULL values are skipped silently, and the result is cut off at group_concat_max_len, which is 1,024 bytes by default, with only a warning to tell you.

I ran every query in this post on MySQL 8.4.6 on 11 October 2026, with the default sql_mode (which includes ONLY_FULL_GROUP_BY), and pasted the real output under each one. Everything below is copy-and-paste ready: create the two tables, insert the rows and run each query in order. If you run your queries from PHP, my guide to PDO fetch() and fetchAll() shows how to read the results back.

The sample tables

The examples use two small tables: students and the subjects they’ve taken, with an optional score. I’ve deliberately included a duplicate (Chloe took Biology twice), a NULL score and a row with a NULL subject, because that’s where GROUP_CONCAT behaves in surprising ways.

CREATE TABLE students (id INT PRIMARY KEY, name VARCHAR(40), class VARCHAR(10));
CREATE TABLE subjects (student_id INT, subject VARCHAR(40), score INT NULL);

INSERT INTO students VALUES
  (1,'Ayesha','10A'), (2,'Ben','10A'), (3,'Chloe','10B'), (4,'Dev','10B');

INSERT INTO subjects VALUES
  (1,'Maths',91), (1,'Physics',84), (1,'English',77),
  (2,'History',68), (2,'Maths',73),
  (3,'Biology',88), (3,'Maths',NULL), (3,'Biology',90),
  (4,NULL,NULL);

Basic GROUP_CONCAT: one row per group

GROUP_CONCAT() is an aggregate function, like COUNT() or SUM(). The MySQL aggregate function reference describes it simply as “return a concatenated string”. You group the rows, and it glues each group’s values together.

SELECT s.name, GROUP_CONCAT(sub.subject) AS subjects
FROM students s
JOIN subjects sub ON sub.student_id = s.id
GROUP BY s.id, s.name
ORDER BY s.id;

+--------+-----------------------+
| name   | subjects              |
+--------+-----------------------+
| Ayesha | Maths,Physics,English |
| Ben    | History,Maths         |
| Chloe  | Biology,Maths,Biology |
| Dev    | NULL                  |
+--------+-----------------------+

Notice three things. The default separator is a comma with no space. The order inside each list isn’t guaranteed; here it happens to follow insertion order, but you shouldn’t rely on that. And Dev’s only subject is NULL, so his whole result is NULL.

GROUP_CONCAT with ORDER BY and SEPARATOR

To control the order of values inside each string, put ORDER BY inside the function call. To change the separator, add SEPARATOR after it. Both are part of GROUP_CONCAT’s own syntax, separate from the query’s outer ORDER BY.

SELECT s.name,
       GROUP_CONCAT(sub.subject ORDER BY sub.subject SEPARATOR ', ') AS subjects
FROM students s
JOIN subjects sub ON sub.student_id = s.id
GROUP BY s.id, s.name
ORDER BY s.id;

+--------+-------------------------+
| name   | subjects                |
+--------+-------------------------+
| Ayesha | English, Maths, Physics |
| Ben    | History, Maths          |
| Chloe  | Biology, Biology, Maths |
| Dev    | NULL                    |
+--------+-------------------------+

The outer ORDER BY s.id sorts the rows of the result. The inner ORDER BY sub.subject sorts the values within each string. You’ll often want both.

Ordering by a different column

The inner ORDER BY doesn’t have to use the column you’re concatenating. Here I list each student’s subjects best score first, with the score in brackets and a pipe as the separator:

SELECT s.name,
       GROUP_CONCAT(CONCAT(sub.subject, ' (', sub.score, ')')
                    ORDER BY sub.score DESC SEPARATOR ' | ') AS best_first
FROM students s
JOIN subjects sub ON sub.student_id = s.id
GROUP BY s.id, s.name
ORDER BY s.id;

+--------+------------------------------------------+
| name   | best_first                               |
+--------+------------------------------------------+
| Ayesha | Maths (91) | Physics (84) | English (77) |
| Ben    | Maths (73) | History (68)                |
| Chloe  | Biology (90) | Biology (88)              |
| Dev    | NULL                                     |
+--------+------------------------------------------+

Look closely at Chloe. Her Maths entry has disappeared. Its score is NULL, CONCAT() returns NULL if any argument is NULL, and GROUP_CONCAT skips NULL values. That leads us to the biggest gotcha.

Why NULL values disappear from GROUP_CONCAT

The MySQL manual states that, unless otherwise stated, aggregate functions ignore NULL values, and GROUP_CONCAT follows that rule. If every value in a group is NULL, the result is NULL rather than an empty string.

SELECT s.name, GROUP_CONCAT(sub.subject) AS subjects, COUNT(*) AS rows_in_group
FROM students s
LEFT JOIN subjects sub ON sub.student_id = s.id
WHERE s.id = 4
GROUP BY s.id, s.name;

+------+----------+---------------+
| name | subjects | rows_in_group |
+------+----------+---------------+
| Dev  | NULL     |             1 |
+------+----------+---------------+

There’s one row in the group, but its subject is NULL, so the concatenated result is NULL. Two fixes:

Default for the whole result: wrap it in COALESCE(GROUP_CONCAT(sub.subject), 'none'), which returned none for Dev in my test.
Keep NULL items visible: use COALESCE() or IFNULL() on the value inside, for example GROUP_CONCAT(CONCAT(sub.subject, ' (', COALESCE(sub.score, '-'), ')')), so Chloe’s Maths stays in the list instead of vanishing. In my test that returned Biology (90) | Biology (88) | Maths (-). Note that NULL scores sort last with DESC, which is usually what you want.

GROUP_CONCAT DISTINCT: removing duplicates

Put DISTINCT first inside the brackets to keep only unique values. You can combine it with ORDER BY and SEPARATOR:

SELECT s.name,
       GROUP_CONCAT(DISTINCT sub.subject ORDER BY sub.subject SEPARATOR ', ') AS subjects
FROM students s
JOIN subjects sub ON sub.student_id = s.id
WHERE s.id = 3
GROUP BY s.id, s.name;

+-------+----------------+
| name  | subjects       |
+-------+----------------+
| Chloe | Biology, Maths |
+-------+----------------+

Biology now appears once. If duplicate rows are a symptom of bad data rather than a legitimate repeat, fix the table instead; my post on deleting duplicate rows in MySQL covers safe ways to do that.

Custom separators: no separator, new lines and more

Any string literal works as a separator, including an empty one and escape sequences:

SELECT class,
       GROUP_CONCAT(name ORDER BY name SEPARATOR '')   AS squashed,
       GROUP_CONCAT(name ORDER BY name SEPARATOR '\n') AS one_per_line
FROM students
GROUP BY class;

+-------+-----------+--------------+
| class | squashed  | one_per_line |
+-------+-----------+--------------+
| 10A   | AyeshaBen | Ayesha
Ben   |
| 10B   | ChloeDev  | Chloe
Dev    |
+-------+-----------+--------------+

The new-line version breaks the text table, which is exactly what you want when you’re building a plain-text email or a CSV cell. Other separators I find handy are ' | ' for readable reports and ';' for exporting to spreadsheets that treat commas as column breaks.

The 1024 limit: group_concat_max_len and truncated results

This one causes real bugs in production. GROUP_CONCAT results are capped by the group_concat_max_len system variable. On my MySQL 8.4.6 server, SELECT @@group_concat_max_len; returned 1024. When a result is longer, MySQL cuts it off and raises a warning, but the query still succeeds, so your application never notices.

To demonstrate, I set a tiny limit of 20 bytes:

SET SESSION group_concat_max_len = 20;
SELECT GROUP_CONCAT(name ORDER BY id SEPARATOR ', ') AS names FROM students;
SHOW WARNINGS;

+----------------------+
| names                |
+----------------------+
| Ayesha, Ben, Chloe,  |
+----------------------+
+---------+------+---------------------------------+
| Level   | Code | Message                         |
+---------+------+---------------------------------+
| Warning | 1260 | Row 4 was cut by GROUP_CONCAT() |
+---------+------+---------------------------------+

Dev was silently dropped, and the string even ends with a stray separator. Raising the limit for the session fixes it:

SET SESSION group_concat_max_len = 1000000;
SELECT GROUP_CONCAT(name ORDER BY id SEPARATOR ', ') AS names FROM students;

+-------------------------+
| names                   |
+-------------------------+
| Ayesha, Ben, Chloe, Dev |
+-------------------------+

Practical advice:

Run SET SESSION group_concat_max_len = ... right after connecting, in the same connection that runs the query. It only lasts for that session.
If you can’t predict the size, check warnings (warning code 1260) or compare the result length with the limit.
If the list could be huge, ask whether you need one string at all. Fetching the rows and joining them in PHP or Python is often simpler and has no cut-off.

Top N per group with GROUP_CONCAT

MySQL’s GROUP_CONCAT has no LIMIT clause inside the brackets (MariaDB added one, MySQL hasn’t), so a common trick is to order the list and then keep the first N items with SUBSTRING_INDEX():

SELECT s.name,
       SUBSTRING_INDEX(GROUP_CONCAT(sub.subject ORDER BY sub.score DESC SEPARATOR ','), ',', 2) AS top2
FROM students s
JOIN subjects sub ON sub.student_id = s.id
WHERE s.id = 1
GROUP BY s.id, s.name;

+--------+---------------+
| name   | top2          |
+--------+---------------+
| Ayesha | Maths,Physics |
+--------+---------------+

SUBSTRING_INDEX(str, ',', 2) returns everything before the second comma. It breaks if the values themselves contain your separator, so pick one that can’t appear in the data. For anything more complex, a window function such as ROW_NUMBER() in a subquery is more robust.

GROUP_CONCAT vs JSON_ARRAYAGG

If the result is going to code rather than a human, consider JSON_ARRAYAGG(), which the MySQL manual lists as returning the result set “as a single JSON array”. You get proper quoting for free, so commas inside values can’t break your parsing:

SELECT s.name, JSON_ARRAYAGG(sub.subject) AS subjects_json
FROM students s
JOIN subjects sub ON sub.student_id = s.id
WHERE s.id IN (1, 2)
GROUP BY s.id, s.name
ORDER BY s.id;

+--------+---------------------------------+
| name   | subjects_json                   |
+--------+---------------------------------+
| Ayesha | ["Maths", "Physics", "English"] |
| Ben    | ["History", "Maths"]            |
+--------+---------------------------------+

In PHP you can json_decode() that column straight into an array. The trade-off: JSON_ARRAYAGG doesn’t accept an ORDER BY inside the brackets. When I tried JSON_ARRAYAGG(name ORDER BY name) on MySQL 8.4.6, it failed with syntax error 1064. Use GROUP_CONCAT when the order of items matters, or sort the array in your application code after decoding it.

Error 1055 and ONLY_FULL_GROUP_BY

Because MySQL 8.4 enables ONLY_FULL_GROUP_BY by default, every non-aggregated column in your SELECT must be in the GROUP BY or depend on it. Grouping by the primary key s.id while selecting s.name is fine, since the name depends on the id. But this query fails:

SELECT s.class, s.name, GROUP_CONCAT(sub.subject)
FROM students s
JOIN subjects sub ON sub.student_id = s.id
GROUP BY s.class;

ERROR 1055 (42000): Expression #2 of SELECT list is not in GROUP BY clause and contains
nonaggregated column 'gc_demo.s.name' which is not functionally dependent on columns in
GROUP BY clause; this is incompatible with sql_mode=only_full_group_by

Each class has several names, so MySQL can’t pick one. Either add s.name to the GROUP BY or aggregate it too, for example GROUP_CONCAT(DISTINCT s.name). Don’t switch the SQL mode off to make the error go away; it’s protecting you from random results.

When not to use GROUP_CONCAT

GROUP_CONCAT is brilliant for display: a tag list next to a blog post, a comma-separated list of products in an order summary, or a quick report you paste into a spreadsheet. It’s a poor fit when you need to filter, count or join on the individual values later. Searching inside a concatenated string with LIKE '%Maths%' is slow and matches partial words, and storing comma-separated lists in a column breaks the basic rule of one value per field. Keep the data in proper rows and only concatenate at the very end, in the query that feeds the page.

Using GROUP_CONCAT safely from PHP

If any part of the query comes from user input, such as a class name from a dropdown, bind it with a prepared statement rather than gluing it into the SQL string. My guide to PHP PDO prepared statements shows the pattern. GROUP_CONCAT itself is just another column in the result; you read it with fetch() like any other value and explode(', ', $row['subjects']) if you need an array back.

FAQ

How do I use ORDER BY inside GROUP_CONCAT?

Put it inside the brackets, after the column: GROUP_CONCAT(subject ORDER BY subject ASC). It sorts the values within each concatenated string. The query’s outer ORDER BY sorts the result rows separately.

How do I change the GROUP_CONCAT separator?

Add SEPARATOR as the last part inside the brackets: GROUP_CONCAT(subject SEPARATOR ', '). The default is a comma with no space. Use SEPARATOR '' for no separator or SEPARATOR '\n' for one value per line.

Why is my GROUP_CONCAT result cut off?

It has hit group_concat_max_len, which was 1,024 bytes by default on my MySQL 8.4 server. MySQL truncates the string and raises warning 1260. Run SET SESSION group_concat_max_len = 1000000; before the query.

Why does GROUP_CONCAT return NULL?

Every value in that group was NULL, and aggregate functions ignore NULLs. Wrap the call in COALESCE(GROUP_CONCAT(col), '') to get an empty string or a default label instead.

How do I remove duplicates in GROUP_CONCAT?

Add DISTINCT straight after the opening bracket: GROUP_CONCAT(DISTINCT subject ORDER BY subject SEPARATOR ', ').

Can I limit the number of values in GROUP_CONCAT?

Not with a LIMIT inside the function in MySQL, but you can order the values and keep the first N with SUBSTRING_INDEX(GROUP_CONCAT(col ORDER BY score DESC), ',', N). For complex cases, use ROW_NUMBER() in a subquery.

What is the difference between GROUP_CONCAT and JSON_ARRAYAGG?

GROUP_CONCAT returns a plain string with your chosen separator and supports ORDER BY and DISTINCT inside the call. JSON_ARRAYAGG returns a JSON array with proper quoting, which is safer to parse in code.

Originally published on mfaysal.com.

I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.

What Is %windir%? Windows Environment Variables Explained (With a List)

Mahir Faysal — Wed, 14 Oct 2026 04:02:12 +0000

%windir% is a Windows environment variable that holds the path of the Windows folder on the system drive, which is usually C:\Windows. The percent signs tell Windows to swap the name for its value, so typing %windir%\System32 in the Run box opens C:\Windows\System32. %SystemRoot% points to the same folder. Environment variables like these let scripts, installers and tutorials refer to folders without hard-coding a drive letter or user name.

I kept seeing %windir%, %appdata% and %temp% in Windows security labs and setup guides without really knowing what they were, so I worked through Microsoft’s documentation (checked on 11 October 2026) and wrote down what actually matters. This post covers what the common variables mean, where they come from and how to view or change them safely.

What is an environment variable?

An environment variable is a named piece of text that Windows hands to every program it starts. Each process gets an environment block, a list of NAME=value pairs. Microsoft’s environment variables documentation explains that there are two types, user variables (set for each user) and system variables (set for everyone), and that a child process inherits the environment of its parent by default.

That inheritance is the key idea. When you open Command Prompt from the Start menu, it inherits the environment from Explorer. Any program you start from that Command Prompt inherits it from there. That’s why changing a variable in one window doesn’t magically change it in programs that are already running.

A few more rules from the same page:

A variable name can’t contain an equals sign (=).
A user-defined variable can be up to 32,767 characters long.
Names aren’t case-sensitive on Windows, so %WINDIR%, %windir% and %WinDir% are the same thing.

What %windir% and %SystemRoot% mean

Microsoft’s list of recognised environment variables describes WINDIR as the variable that “refers to the Windows folder located on the system drive” and lists SYSTEMROOT as “same as WINDIR”. Its typical value is C:\Windows.

So why do both exist? Historically, %SystemRoot% belongs to the Windows NT family, while %windir% was already used by the older DOS-based versions of Windows, and both were kept for compatibility. Today they hold the same path on a normal installation, and you’ll see both in Microsoft’s own documentation and registry values. In my experience, %SystemRoot% turns up more in registry paths and service settings, and %windir% more in scripts and Run-box shortcuts.

Useful folders under %windir%:

%windir%\System32: What’s there: Core 64-bit system programs and libraries (cmd.exe, notepad.exe, most .msc consoles).
%windir%\SysWOW64: What’s there: 32-bit system files on 64-bit Windows.
%windir%\System32\drivers\etc: What’s there: The hosts file, which maps names to IP addresses.
%windir%\Temp: What’s there: Temporary files used by the system and services.
%windir%\Fonts: What’s there: Installed fonts.
%windir%\Logs: What’s there: Various Windows log files.

That hosts file comes up a lot in security courses, because malware has historically edited it to redirect websites. It’s protected: you need admin rights to change anything under %windir%.

Common Windows environment variables (list)

These are the variables you’ll meet most often. Typical values are from Microsoft’s recognised variables list and assume Windows is on C: and the user is called mahir.

%windir% / %SystemRoot%: C:\Windows (system variable).
%SystemDrive%: C: (a drive, not a folder: no trailing backslash) (system variable).
%ProgramFiles%: C:\Program Files (system variable).
%ProgramFiles(x86)%: C:\Program Files (x86) on 64-bit Windows (system variable).
%ProgramData%: C:\ProgramData (application data for all users) (system variable).
%ALLUSERSPROFILE%: C:\ProgramData (system variable).
%USERPROFILE%: C:\Users\mahir (user variable).
%APPDATA%: C:\Users\mahir\AppData\Roaming (user variable).
%LOCALAPPDATA%: C:\Users\mahir\AppData\Local (user variable).
%TEMP% / %TMP%: C:\Users\mahir\AppData\Local\Temp (user variable).
%USERNAME%: mahir (user variable).
%COMPUTERNAME%: The PC’s name (system variable).
%PATH%: A semicolon-separated list of folders (user and system values combined).
%COMSPEC%: C:\Windows\System32\cmd.exe (system variable).

Roaming vs Local AppData: Microsoft describes %APPDATA% (Roaming) as a common repository for application-specific data, which can roam with a user profile on managed networks, and %LOCALAPPDATA% as the home for local, non-roaming application data. Browser caches and large files usually sit in Local; small settings files often sit in Roaming.

How to use environment variables in Explorer and the Run box

You can type a variable anywhere Windows accepts a path:

Press Win + R to open Run.
Type %temp% and press Enter. Your temporary files folder opens.
Try %appdata%, %userprofile%\Downloads or %windir%\System32\drivers\etc.

Explorer’s address bar works the same way. This is handy when a guide says “delete the app’s folder in AppData”: you don’t have to un-hide anything or know the user name, you just type %appdata%.

Clearing %temp% is a classic safe tidy-up: close your programs, open %temp%, select everything and delete it. Windows will skip any file that’s still in use.

Viewing environment variables in Command Prompt

In Command Prompt (cmd.exe) you read a variable by wrapping its name in percent signs:

C:\> echo %windir%
C:\Windows

C:\> echo %USERPROFILE%
C:\Users\mahir

To see everything, use the built-in set command. Microsoft notes that with no parameters it “displays the current environment variable settings”, and that set with part of a name lists every variable that begins with it:

C:\> set
C:\> set prog
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
ProgramFiles(x86)=C:\Program Files (x86)

The output above is the typical shape; exact values depend on your PC.

One quirk worth knowing: if a variable doesn’t exist, Command Prompt doesn’t show an error. echo %NOSUCHVAR% simply prints %NOSUCHVAR% back at you, percent signs and all. So if you see the raw name in a script’s output, that’s your clue the variable is misspelt or was never set in that window. In a batch file, if defined NOSUCHVAR echo yes is the tidy way to test for it before you use it.

Temporary vs permanent variables: set vs setx

This is where most beginners get caught out.

set is temporary. set MYVAR=hello creates or changes a variable for the current Command Prompt window and the programs started from it. Close the window and it’s gone. Microsoft’s user environment variables page says the same thing: variables created with set “apply only to the command window in which they are set, and to its child processes”.

setx is permanent. Microsoft’s setx documentation says it writes variables “to the master environment in the registry”. By default it sets a user variable; add /m to set a system variable (which needs an elevated prompt).

setx MYVAR "hello"
setx MYVAR "hello" /m

Three setx gotchas, all straight from the docs:

It doesn’t affect the current window. “Variables set with setx variables are available in future command windows only, not in the current command window.” Open a new window to see the change.
It truncates at 1,024 characters. If you assign more, the content is cropped, and if you were overwriting an existing variable you can lose data.
It expands references. If %PATH% contains %JAVADIR% and you rewrite PATH with setx, the reference is replaced with its current value, so later changes to JAVADIR won’t flow through.

Point 2 and point 3 are why you should never run setx PATH "%PATH%;C:\something". On many PCs, PATH is already near or over 1,024 characters, and that command merges the user and system PATH into your user variable while cropping it. Use the graphical editor below instead.

Environment variables in PowerShell: $Env:windir

PowerShell doesn’t use percent signs. According to Microsoft’s about_Environment_Variables page, you use the $Env: prefix:

$Env:windir
# C:\Windows

$Env:Foo = 'An example'   # current session only
Get-ChildItem Env:        # list every variable

Setting $Env:Foo only changes the current PowerShell session, just like set in Command Prompt. The same page notes that environment variable names are case-sensitive on macOS and Linux, unlike on Windows, so $Env:Path and $Env:PATH are different there. That difference bites people who write cross-platform scripts.

How to edit environment variables in Windows 11 and 10

For permanent changes, the graphical editor is the safest route:

Press Win, type environment variables and choose Edit the system environment variables (or Edit environment variables for your account for user-only changes).
Click Environment Variables….
The top list holds your user variables; the bottom list holds system variables.
Select a variable and click Edit. For Path, Windows shows one folder per line, so you can add, remove or reorder entries without editing one long string.
Click OK in every window, then restart any program that needs the new value.

Behind the scenes, Microsoft documents that system variables live in the registry under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, and that programs which change them should broadcast a WM_SETTINGCHANGE message so the shell picks up the update. User variables live under HKEY_CURRENT_USER\Environment.

How PATH works (and why order matters)

PATH is the most important variable for anyone who codes. When you type python or git without a full path, Windows searches the current folder and then each folder listed in PATH, in order, for a matching program. The first match wins.

That has two consequences:

“Not recognised as an internal or external command” usually means the program’s folder isn’t in PATH, or you haven’t opened a new terminal since adding it.
Order matters for security. If an attacker can write to a folder that appears early in PATH, they can drop a fake python.exe or git.exe there and it will run instead of the real one. Keep user-writable folders out of the system PATH, and check new entries before adding them.

You can see which copy of a program wins with where:

C:\> where python

Environment variables and security: what to look for

Once you know these variables, a lot of security advice makes more sense. Here’s why they keep appearing in labs and incident write-ups.

User-writable folders are where unwanted programs hide. %TEMP%, %APPDATA% and %LOCALAPPDATA% all sit inside your user profile, so any program you run can write there without an admin prompt. That makes them convenient for legitimate apps and for malware alike. When you’re checking a PC for something suspicious, look for unfamiliar .exe files in these folders, especially ones set to start automatically.

Protected folders need elevation. %windir% and %ProgramFiles% are writable only with administrator rights. A program that installs itself there had to get past a UAC prompt (I explain those in what UAC in Windows is), which is a useful clue when you’re working out how something arrived.

Variables are visible to every process you run. Any program started under your account can read your user and system environment variables. They’re fine for configuration, and better than hard-coding secrets in source files, but they aren’t a vault. On a shared PC, don’t store passwords in system variables, and on a server, give each app only the keys it needs.

Scripts should use variables, not hard-coded paths. A script that writes to C:\Users\mahir\Desktop breaks for every other user and on any PC where Windows isn’t on C:. Using %USERPROFILE%\Desktop or %SystemDrive% keeps it portable, and it’s easier to review, because the intent is obvious.

Reading environment variables in code

Environment variables are also how developers keep configuration and secrets out of source code. The same idea runs from a Windows PC up to a cloud host:

import os
print(os.environ.get("WINDIR"))      # C:\Windows on Windows, None on Linux
print(os.environ.get("APPDATA", "not set"))

<?php
echo getenv('windir') ?: 'not on Windows';

Using .get() with a default in Python, or checking getenv()’s false return in PHP, means your script won’t crash on a machine where the variable doesn’t exist. Hosting platforms use the same mechanism for API keys; I used it when setting a Gemini API key on Vercel, so the key never lands in the code repository.

FAQ

What is %windir% in Windows?

%windir% is an environment variable that stores the path of the Windows folder on the system drive, usually C:\Windows. Windows replaces the variable with that path when you use it in the Run box, Explorer, a script or a shortcut.

What is the difference between %windir% and %SystemRoot%?

On a normal installation there’s no difference in value: Microsoft lists SYSTEMROOT as “same as WINDIR”, and both point to the Windows folder. %SystemRoot% comes from the Windows NT line and is common in registry values, while %windir% is older and common in scripts.

Where is %appdata%?

%appdata% points to the Roaming application data folder, typically C:\Users\<username>\AppData\Roaming. %localappdata% points to C:\Users\<username>\AppData\Local. Type either into the Run box to open it.

Is it safe to delete files in %temp%?

Generally yes. %temp% holds temporary files, and Windows won’t let you delete files that are still in use. Close your programs first, then delete what’s left. Don’t delete the Temp folder itself.

What is the difference between set and setx?

set changes a variable only in the current Command Prompt window and its child processes. setx saves the variable permanently in the registry, but the change only appears in new windows, and values longer than 1,024 characters are cropped.

How do I see all environment variables in Windows?

Run set in Command Prompt or Get-ChildItem Env: in PowerShell. For permanent user and system variables, open Edit the system environment variables and click Environment Variables….

Why does my new PATH entry not work?

Programs read their environment when they start, so close and reopen your terminal or editor after editing PATH. Also check the folder you added actually contains the program, and that there isn’t a typo or a stray quote in the entry.

Originally published on mfaysal.com.

I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.

NTFS vs FAT32 vs exFAT: Which Format Should You Use? (Windows 2026)

Mahir Faysal — Tue, 13 Oct 2026 03:59:14 +0000

Short answer: use NTFS for Windows system drives and internal disks, exFAT for USB sticks, external drives and SD cards that move between Windows and Mac, and FAT32 only when an older device (a car stereo, a games console, some cameras) refuses anything else. FAT32 can’t store a single file bigger than 4 GB, and Windows’ own tools won’t create a new FAT32 volume larger than 32 GB. exFAT removes those limits but has no permissions or journaling. NTFS has both, but Macs can’t format it.

I wrote this while studying Windows fundamentals for cybersecurity, because the “which format?” question keeps coming up in labs and at home. Every limit below comes from Microsoft’s documentation or Apple’s Disk Utility guide, checked on 11 October 2026. I’ve kept the maths light and the commands safe to read.

What a file system actually is

A drive is just billions of numbered blocks. A file system is the set of rules that turns those blocks into files and folders: where each file starts, how big it is, when it changed and (on some file systems) who’s allowed to open it. When you “format” a drive, you’re writing a fresh, empty copy of those rules onto it, which is why formatting wipes what was there.

Windows supports several file systems. The three you’ll meet every week are:

FAT32, from the 1990s. Simple, and understood by almost every device ever made.
NTFS (New Technology File System), the native file system of Windows.
exFAT (Extended File Allocation Table), designed by Microsoft for flash storage such as USB sticks and SD cards.

NTFS vs FAT32 vs exFAT at a glance

This comparison pulls together Microsoft’s file system functionality comparison and the other sources linked below.

Maximum file size: NTFS: 2^64 − 1 bytes in the format (practically limited by cluster size, 16 TB at the default 4 KB); exFAT: 2^64 − 1 bytes; FAT32: 4 GiB.
Largest new volume Windows will format: NTFS: 8 PB on recent Windows (with 2 MB clusters); exFAT: Very large (2^32 − 1 clusters); FAT32: 32 GB.
File name length: NTFS: 255 Unicode characters; exFAT: 255 Unicode characters; FAT32: 255 Unicode characters.
Permissions (access control lists): NTFS: Yes; exFAT: No; FAT32: No.
Tracks file owner: NTFS: Yes; exFAT: No; FAT32: No.
Built-in encryption and compression: NTFS: Yes; exFAT: No; FAT32: No.
Journaling: NTFS: Yes (metadata); exFAT: No; FAT32: No.
Disk quotas: NTFS: Yes; exFAT: No; FAT32: No.
Hard links and symbolic links: NTFS: Yes; exFAT: No; FAT32: No.
Mac Disk Utility can format it: NTFS: No; exFAT: Yes; FAT32: Yes (as MS-DOS FAT).

The pattern is clear. NTFS is the feature-rich one, FAT32 is the most compatible, and exFAT sits in the middle: big files, broad compatibility, very few features.

FAT32: the old, universal option

FAT stands for File Allocation Table, the table near the start of the drive that records which blocks belong to which file. FAT32 is the version introduced with Windows 95 OSR2 and Windows 98, using 32-bit entries (28 bits of which are actually used for cluster numbers).

FAT32’s two famous limits trip people up constantly.

The 4 GB file limit

FAT32 stores each file’s size as a 32-bit number, so no single file can be 4 GB or larger. Microsoft’s comparison table lists the maximum file size as 4 GiB. Try to copy a 6 GB video or a Windows ISO to a FAT32 stick and you’ll get an error saying the file is too large for the destination file system, even if the stick has 50 GB free.

The 32 GB format limit

FAT32 could theoretically address volumes of several terabytes. But, as Microsoft’s Windows file systems overview explains, Windows “works with existing FAT32 volumes of larger sizes (created in other operating systems)” while it “limits new FAT32 volumes to a maximum of 32 GB”. That’s why the FAT32 option disappears from Windows’ format dialog for a 64 GB stick. Third-party tools can make bigger FAT32 volumes, but at that size exFAT is the better answer anyway.

Pick FAT32 when a device’s manual says it only reads FAT32, the drive is 32 GB or smaller, and you won’t store any file of 4 GB or more.

exFAT: built for flash drives

Microsoft designed exFAT to fix FAT32’s limits without adding NTFS’s overhead, which matters on cheap flash memory. The Windows file systems overview notes that it raises the file size limit to 2^64 bytes, adds a bitmap that tracks free clusters (making allocation and deletion faster) and allows more than 1,000 files in a single directory.

exFAT is also widely supported outside Windows. Apple’s Disk Utility guide lists both MS-DOS (FAT) and ExFAT as the file systems “compatible with Windows” that a Mac can create. Microsoft also publishes the full exFAT specification on its developer documentation site.

The trade-off is that exFAT is deliberately simple:

No permissions. Anyone who plugs the drive in can read every file.
No journaling. If you pull the drive out mid-copy, the file system can be left inconsistent. Always use Safely Remove Hardware or Eject.
No encryption built into the file system. BitLocker To Go can still encrypt an exFAT drive on supported Windows editions, but exFAT itself has no encryption.

Pick exFAT when you’re formatting a USB stick, SD card or external SSD bigger than 32 GB, especially if it moves between Windows and macOS, or you need to store files larger than 4 GB.

NTFS: the Windows default

NTFS is what your C: drive uses, and for good reasons. It keeps a journal of changes to its own structures, so after a crash or power cut it can repair itself to a consistent state. The Windows file systems overview also notes that the NTFS driver can make many minor repairs while Windows is running, without a reboot.

NTFS is also the only one of the three with security built in. Each file and folder has an access control list (ACL): a list of users and groups and what each may do (read, write, modify, full control). That’s what the Security tab in a file’s Properties shows. Without ACLs, Windows couldn’t stop one user reading another user’s Documents folder, or stop a program overwriting system files.

Other NTFS features you’ll see in Windows and security labs:

Encrypting File System (EFS) and compression per file or folder.
Disk quotas per user.
Hard links and symbolic links, used heavily by Windows itself.
Alternate data streams (ADS), extra hidden “streams” of data attached to a file. Windows uses one to mark files downloaded from the internet, and attackers have historically used ADS to hide data, which is why it comes up in security courses.

NTFS size limits in 2026

The maximum NTFS volume depends on the cluster size. According to Microsoft’s NTFS overview, Windows 10 version 1709 and later, and Windows Server 2019 and later, support NTFS volumes up to 8 PB using 2 MB clusters. Earlier versions top out at 256 TB. At the default 4 KB cluster size, the largest volume and file is 16 TB, which is still far bigger than any single file you’re likely to handle.

Pick NTFS when the drive stays inside or attached to Windows PCs: the system disk, a second internal SSD, or an external backup drive used only with Windows. Also pick it when you need permissions or encryption.

Which one should I use? A quick decision guide

Windows system drive or internal disk: NTFS. Permissions, journaling, Windows features need it.
USB stick or SD card used on Windows and Mac: exFAT. Both can read and write; no 4 GB limit.
External backup drive for Windows only: NTFS. Journaling protects against corruption.
Old car stereo, console or camera: FAT32. Many older devices only read FAT32.
Drive of 32 GB or less for maximum compatibility: FAT32. Readable almost everywhere.
Storing a single file over 4 GB: exFAT or NTFS. FAT32 physically can’t.
Sensitive files on a removable drive: NTFS with BitLocker, or exFAT with BitLocker To Go. Neither FAT format has built-in protection.

If you’re unsure about a camera or TV, check its manual. Many modern cameras format SD cards themselves, and that is usually the safest option because the camera picks the format it expects.

How to check which file system a drive uses

You don’t need to format anything to find out. Any of these works:

File Explorer: right-click the drive, choose Properties, and read File system on the General tab.
Command Prompt: run fsutil fsinfo volumeinfo E: (replace E: with your drive letter) and look for File System Name.
PowerShell: run Get-Volume to list every volume with its file system type, size and free space.

Get-Volume | Select-Object DriveLetter, FileSystemLabel, FileSystemType, Size, SizeRemaining

How to format a drive as exFAT, NTFS or FAT32

Warning: formatting erases everything on the drive. Copy anything you need first and triple-check the drive letter.

The easy route is File Explorer: right-click the drive, choose Format, pick the file system and click Start. Leave Allocation unit size on the default; Microsoft says default settings are recommended for general use.

From an administrator command prompt, the built-in format command does the same job. The /FS: switch accepts FAT, FAT32, NTFS, exFAT, ReFS or UDF, /V: sets the label and /Q does a quick format:

format E: /FS:exFAT /V:USBSTICK /Q

Windows will ask you to confirm before it wipes the drive. You must be a member of the Administrators group to format a hard drive, so expect a UAC prompt if you start from a normal window.

Can you convert FAT32 to NTFS without losing data?

Yes, in one direction only. Windows includes the convert tool, which Microsoft’s convert documentation says “converts file allocation table (FAT) and FAT32 volumes to the NTFS file system, leaving existing files and directories intact”:

convert E: /fs:ntfs /v

Things to know before you run it:

It’s one-way. Volumes converted to NTFS can’t be converted back to FAT or FAT32. Going back means backing up, reformatting and copying the files back.
Back up first anyway. Data loss is unlikely, but a power cut mid-conversion isn’t a risk worth taking.
It can’t convert to exFAT. There’s no built-in in-place conversion to or from exFAT. For exFAT, you copy the files off, format and copy them back.
Converted volumes can be slightly less efficient than ones formatted as NTFS from the start; Microsoft notes the master file table might become fragmented.

Why file systems matter in cybersecurity

If you’re studying security, file systems aren’t just trivia. They decide what evidence exists and what protection a file has:

Permissions only exist on NTFS. Copy a confidential file from an NTFS drive to an exFAT stick and its access controls are gone. Anyone with the stick can open it.
Timestamps differ. Microsoft’s comparison shows FAT32 stores the last access time as a date only, and notes that NTFS last-access updating has changed between Windows versions. Investigators need to know that before reading too much into a timestamp.
Alternate data streams exist on NTFS but not on exFAT or FAT32, so copying a file to a FAT-family drive strips them, including the “downloaded from the internet” marker.
Encryption at rest needs BitLocker or EFS. A lost USB stick formatted as plain exFAT is an open book.

NTFS permissions work hand in hand with account rights. Even an administrator’s programs run with limited rights until a prompt approves more, which I cover in what UAC in Windows is. Permissions on files plus limited rights for programs is the basic Windows defence model.

FAQ

What is the difference between NTFS, FAT32 and exFAT?

NTFS is the Windows file system with permissions, journaling and encryption. FAT32 is an old, highly compatible format limited to 4 GB files and, in Windows’ format tool, 32 GB volumes. exFAT removes those size limits and works on Mac and Windows but has no permissions or journaling.

Is exFAT or NTFS better for a USB drive?

exFAT is usually better for a USB stick you share between computers, because macOS can read and write it. Choose NTFS if the drive is only used with Windows and you want journaling, permissions or file-level encryption.

Why can’t I copy a 4 GB file to my USB stick?

The stick is almost certainly formatted as FAT32, which can’t hold any single file of 4 GB or more. Back up its contents and reformat it as exFAT or NTFS, or convert it to NTFS with convert E: /fs:ntfs.

Why doesn’t Windows offer FAT32 for my 64 GB drive?

Windows limits new FAT32 volumes to a maximum of 32 GB, so the option disappears for bigger drives. Use exFAT instead. Windows can still read and write larger FAT32 volumes created elsewhere.

Can a Mac format a drive as NTFS?

Not with Apple’s Disk Utility. The Windows-compatible formats it offers are MS-DOS (FAT) and ExFAT. If a drive needs to be used on both Mac and Windows, format it as exFAT.

Does formatting a drive delete everything?

Yes. Formatting writes a new, empty file system, so the existing files are no longer accessible. A quick format doesn’t overwrite every sector, but you should still treat formatting as permanent and back up first.

Which file system is most secure?

NTFS, because it supports access control lists, file ownership, EFS encryption and BitLocker. exFAT and FAT32 have no permissions, so anyone with physical access can read the files unless the whole drive is encrypted.

Originally published on mfaysal.com.

I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.