Dangerous commands: what never to paste

Most commands look, list or measure. A few delete, overwrite or reformat, and they do it instantly and without a Recycle Bin. Because a command is only a line of text, anyone can post one online with a friendly explanation that is not true. This page shows the patterns to recognise, so that you can tell a safe instruction from a harmful one.

Nothing on this page was run. It is here so that you can recognise these lines, not use them.

The rule before all others

Do not run a command that you cannot explain. If a message, a forum post or a video tells you to paste a line and you do not know what each part does, stop and look it up. A real fix can always be explained.

Commands that delete

Looks like	What it does
`rm -rf /`, `rm -rf /*`, `rm -rf ~`	deletes everything on the system, or everything in your home folder
`rm -rf *` in the wrong folder	deletes everything in the folder you happen to be in
`del /s /q .`	deletes every file in this folder and all folders below it, without asking
`rmdir /s /q C:\folder`	removes a folder and all its contents
`format C:` or `format D:`	erases a whole drive
`find . -delete`	deletes everything below the current folder
`git clean -fdx`	deletes every file that is not tracked in a code project

The danger signs are -rf, /s /q, -delete and a path that is very short: /, ~, *, C:\. The shorter the path, the more it covers.

See the pages on rm and del for how to delete safely.

Commands that overwrite

Looks like	What it does
`command > file`	replaces the file's contents. A slip turns a document into the output of a command
`dd if=... of=/dev/sda`	writes directly over a disk. The wrong target destroys everything on it
`mkfs.ext4 /dev/sdb1`	makes a new, empty file system: the old contents are gone
`mv file /dev/null`	throws the file away
`robocopy source dest /mir`	makes the destination identical to the source, deleting anything extra
`rsync -a --delete source dest`	the same, on Linux and Mac
`diskpart` then `clean`	wipes the partition table of the selected disk

With dd, mkfs and diskpart, the entire risk is in picking the wrong disk. People who use them professionally check the disk's name several times before pressing Enter.

Commands that change permissions or ownership widely

Looks like	What it does
`chmod -R 777 /`	lets everyone change every file: the system becomes insecure and may stop working
`chown -R user /`	changes the owner of system files: the system stops starting properly
`takeown` and `icacls` on `C:\Windows`	removes Windows' protection of its own files

A fix that begins "just give everything full permissions" is a bad fix.

Commands that download and run

Looks like	What it does
`curl URL \| sh` or `wget -O- URL \| bash`	downloads a script and runs it at once, unseen
`powershell -c "iex (iwr URL)"`	the PowerShell form of the same thing
`powershell -enc` followed by a long string of letters	runs a hidden, encoded command
`mshta http://...`	runs code from a web page

Legitimate installers do use the first form. The question is whose script it is. From the official site of well-known software, typed by you, it is a considered risk. From a pop-up, an email, a comment or a "verification" page, it is an attack.

The "press Win + R and paste" trick

A widespread scam shows a page that claims to check that you are human, or to fix a problem, and tells you to press Win + R, then Ctrl + V, then Enter. The page has already put a command on your clipboard. Those three key presses run it. It usually downloads a program that steals passwords.

No real website needs you to do this. A CAPTCHA never asks you to open the Run box or a terminal. Close the page.

Commands that hide what they do

Be suspicious of any line that contains:

a long run of random-looking letters and numbers, especially after -enc, -e or base64;
a web address that is an IP number or an unfamiliar domain;
sudo or "run as administrator" for something that should not need it;
several commands chained with ;, && or | where you were told it does one simple thing;
instructions to switch off your antivirus or security prompts first.

Small commands with large effects

Looks like	What it does
`:(){ :\|:& };:`	a "fork bomb": starts copies of itself until the computer freezes
`shutdown /s /t 0`, `shutdown now`	turns the computer off at once, losing unsaved work
`taskkill /f /im explorer.exe`	removes the Windows desktop and taskbar until restarted
`kill -9 -1`	ends every process you own
`> important.txt`	empties the file
`crontab -r`	deletes all your scheduled jobs (the `-r` is next to `-e`, for edit, on the keyboard)
`reg delete`	removes settings from the Windows Registry
`bcdedit`	changes how Windows starts

Habits that keep you safe

Read the whole line before pressing Enter.
Check where you are: pwd, or the Windows prompt.
List before you delete. Run ls or dir with the same pattern.
Try the harmless version first. Many commands have a dry-run option, often -n, --dry-run, /l or -WhatIf in PowerShell. Or put echo in front to see what the command would become.
Type, do not paste, when you can. Typing makes you read.
Paste into a text editor first when you must paste. Text copied from a web page can contain more than what you saw, including a hidden line break that runs the command the moment you paste.
Use an ordinary account. Open an administrator window, or use sudo, only for the one command that needs it.
Keep backups. A backup turns a disaster into an inconvenience.

If you have already run something

If it is still running, press Ctrl + C, or close the window.
If you ran a command from a suspicious page: disconnect from the internet, run a full scan with your security software, and change your important passwords from another device, starting with email and banking. If payment details may be involved, tell your bank.
If files were deleted: stop using the disk and look to your backup.

In India, online financial fraud can be reported to the national cyber crime helpline or its website. Use the number and address published on the Government of India's own cyber crime portal, not ones found in a search result or an advertisement.

This is an independent learning site. It is not connected with Microsoft, Apple or any Linux distribution. Windows, macOS and other names belong to their owners. Try commands first in a practice folder, never on files you cannot afford to lose.