Computer Science Concepts - Learn With Examples https://learnwithexamples.org/category/computer-science-concepts/ Lets Learn things the Easy Way Sun, 18 Oct 2026 05:25:09 +0000 en-US hourly 1 https://wordpress.org/?v=7.1.3 https://i0.wp.com/learnwithexamples.org/wp-content/uploads/2026/07/cropped-learnwithexamples-icon.png?fit=32%2C32&ssl=1 Computer Science Concepts - Learn With Examples https://learnwithexamples.org/category/computer-science-concepts/ 32 32 228207193 Data Types Explained: Integers, Floats, Booleans and Why They Differ https://learnwithexamples.org/data-types-explained/ https://learnwithexamples.org/data-types-explained/#respond Sun, 18 Oct 2026 05:25:07 +0000 https://learnwithexamples.org/?p=992 Every beginner hits the same wall sooner or later. They add 0.1 and 0.2, get 0.30000000000000004, and decide the computer is broken. It is not broken. It is doing exactly…

The post Data Types Explained: Integers, Floats, Booleans and Why They Differ appeared first on Learn With Examples.

]]>

Every beginner hits the same wall sooner or later. They add 0.1 and 0.2, get 0.30000000000000004, and decide the computer is broken. It is not broken. It is doing exactly what you told it to do, and what you told it depends on a choice you probably made without noticing: the data type. This guide explains integers, floats and booleans from the ground up, shows why the computer treats them so differently, and walks through the real bugs that happen when you pick the wrong one.

Why computers need types at all

A computer’s memory is a very long row of tiny switches, each either off or on. That is all it holds: zeros and ones. There is no such thing as a “number” or a “letter” down there. The pattern 01000001, for example, can mean the whole number 65, or it can mean the capital letter A, or it can be one tiny piece of a colour in a photograph. The bits themselves do not say which.

The data type is the label that tells the computer how to read a pattern. It answers three questions at once: how many switches does this value use, how should those switches be interpreted, and which operations make sense on it. You can add two numbers, but adding two pieces of text sticks them together instead, and asking whether a yes/no answer is “greater than 7” makes no sense at all.

Think of a kitchen. A measuring jug, a kitchen scale and a thermometer all give you a number, but you would not use the thermometer to weigh flour. Each tool suits a kind of question. Data types are the same: tools for different kinds of facts.

Integer42whole numbers,for countingFloat3.14has a decimal point,for measuringBooleanTrueyes or no,for decidingString’42’text in quotes,for labels
The four types you will meet in almost every language. Three of them are numbers or number-like; one is text.

The short version. An integer is a whole number, exact and used for counting. A float is a number with a decimal point, built for measuring and only approximately exact. A boolean is a yes/no value, either true or false. They differ because each is stored in a different way, and the way it is stored decides what it can do well and where it quietly goes wrong.

Integers: whole numbers, exact answers

An integer is a number with no fractional part: −3, 0, 7, 52,314. It is the type for anything you count. The number of people in a stadium, the number of items in a shopping cart, a person’s age in years, the page you are on: all integers. You cannot have 2.5 people in the stadium, so the type simply has no room for a fraction.

The big strength of integers is that they are exact. If you add 3 and 4, you get precisely 7, every time, forever. There is no rounding and no hidden error. That reliability is why money, counters, loops and array positions all lean on integers.

How an integer is stored

Computers store integers in binary, using a fixed number of bits. With 8 bits you have 256 possible patterns. If all of them are used for non-negative numbers (an “unsigned” integer), the range is 0 to 255. That is exactly why colour values on a screen run from 0 to 255: each of red, green and blue gets one byte.

If you also want negative numbers (a “signed” integer), one bit effectively goes to the sign, and the same 256 patterns cover −128 to 127. Wider integers get far more room: 16 bits cover −32,768 to 32,767, 32 bits cover about −2.1 billion to 2.1 billion, and 64 bits cover roughly −9.2 quintillion to 9.2 quintillion.

Overflow: when the number does not fit

Here is where integers can bite. A fixed-width integer has a biggest value, and adding one more does not produce an error in many languages. It wraps around, like a car odometer rolling from 99999 back to 00000.

Biggest 8-bit value127Add 1+ 1Wraps around−128In binary, 01111111 plus one is 10000000, which a signed integer reads as −128.
A signed 8-bit integer at its maximum. One more step and it flips to the most negative value.

I ran the numbers to be sure I was not just repeating folklore. This short program simulates what a signed integer of each width does when you add one to its maximum, and also shows the famous Unix time limit.

import struct
from datetime import datetime, timezone

def wrap(value, bits):
    """What a signed integer of this width does when it overflows."""
    m = 1 << bits
    v = value % m
    return v - m if v >= m // 2 else v

for bits in (8, 16, 32):
    top = 2 ** (bits - 1) - 1
    print(f"{bits:>2}-bit signed: max {top:>11,}   max + 1 wraps to {wrap(top + 1, bits):>14,}")

print()
last = 2 ** 31 - 1
print("32-bit Unix time limit:", datetime.fromtimestamp(last, tz=timezone.utc))
print("one second later wraps to:", datetime.fromtimestamp(wrap(last + 1, 32), tz=timezone.utc))

print()
print("Python int keeps going: 2**63 =", 2 ** 63)
print("float loses whole numbers:", float(2 ** 53) + 1 == float(2 ** 53))
print()
for code, name in (("b", "tiny int"), ("h", "short int"), ("i", "int"), ("q", "long int"), ("f", "float32"), ("d", "float64"), ("?", "boolean")):
    print(f"{name:<10} {struct.calcsize(code)} byte(s)")

Output:

 8-bit signed: max         127   max + 1 wraps to           -128
16-bit signed: max      32,767   max + 1 wraps to        -32,768
32-bit signed: max 2,147,483,647   max + 1 wraps to -2,147,483,648

32-bit Unix time limit: 2038-01-19 03:14:07+00:00
one second later wraps to: 1901-12-13 20:45:52+00:00

Python int keeps going: 2**63 = 9223372036854775808
float loses whole numbers: True

tiny int   1 byte(s)
short int  2 byte(s)
int        4 byte(s)
long int   8 byte(s)
float32    4 byte(s)
float64    8 byte(s)
boolean    1 byte(s)

Look at the date line. Many systems count time as the number of seconds since 1 January 1970, stored in a signed 32-bit integer. That counter runs out at 03:14:07 UTC on 19 January 2038. One second later it wraps to a large negative number, which a computer reads as December 1901. This is the “Year 2038 problem”, and engineers have been moving systems to 64-bit time to avoid it.

Real overflow stories

Overflow is not only a classroom curiosity. In 1996 the first launch of Europe’s Ariane 5 rocket ended in self-destruction after a value converted from a 64-bit floating-point number into a 16-bit signed integer was too large to fit. In December 2014, the view counter for the video “Gangnam Style” passed 2,147,483,647, the top of a 32-bit signed integer, and YouTube said it had to switch the counter to 64 bits. Both are reminders that the width of an integer is a decision, not a detail.

Python has an unusual comfort here: its integers grow as large as memory allows, so 2100 is simply 1,267,650,600,228,229,401,496,703,205,376. Languages such as C, Java and Go use fixed widths, and there you must choose carefully.

Floats: numbers with a decimal point

A float, short for floating-point number, is for values that can have a fractional part: 3.14, 36.6, 0.0001, 6.02 × 1023. Use it for things you measure rather than count: body temperature, the length of a table, the speed of a car, the voltage across a battery.

The name “floating point” describes how the number is stored. Instead of fixing the decimal point in one place, the computer keeps two pieces: the significant digits, and an exponent that says where the point floats to. It is the same idea as scientific notation. The number 6,020,000 can be written 6.02 × 106: the digits 6.02 and the exponent 6. A float stores a pair like that, but in binary.

This design gives floats a huge range. A standard 64-bit float, which most languages call a “double”, reaches from about 2.2 × 10−308 up to about 1.8 × 10308. No integer of the same size comes close. The price is exactness.

The 0.1 + 0.2 mystery, solved

Let me show you the thing that confuses everyone, then explain it. In Python:

import math

print("7           ->", type(7).__name__)
print("7.0         ->", type(7.0).__name__)
print("True        ->", type(True).__name__)
print('"7"         ->', type("7").__name__)
print()
print('"5" + "5"           =', repr("5" + "5"))
print('5 + 5               =', 5 + 5)
print('int("5") + int("5") =', int("5") + int("5"))
print()
print("10 / 4  =", 10 / 4)
print("10 // 4 =", 10 // 4)
print("10 % 4  =", 10 % 4)
print()
print("True + True       =", True + True)
print("isinstance(True, int) =", isinstance(True, int))
print("0.1 + 0.2         =", 0.1 + 0.2)
print("0.1 + 0.2 == 0.3  =", 0.1 + 0.2 == 0.3)
print("isclose           =", math.isclose(0.1 + 0.2, 0.3))
print("2 ** 100          =", 2 ** 100)

Output:

7           -> int
7.0         -> float
True        -> bool
"7"         -> str

"5" + "5"           = '55'
5 + 5               = 10
int("5") + int("5") = 10

10 / 4  = 2.5
10 // 4 = 2
10 % 4  = 2

True + True       = 2
isinstance(True, int) = True
0.1 + 0.2         = 0.30000000000000004
0.1 + 0.2 == 0.3  = False
isclose           = True
2 ** 100          = 1267650600228229401496703205376

Toward the bottom you will see 0.1 + 0.2 comes out as 0.30000000000000004, and the comparison with 0.3 is false. Python is not being silly. The same result appears in JavaScript, Java, C and nearly every language, because it comes from how binary stores fractions.

Here is the analogy I use with students. Try writing one third in decimal. You get 0.3333… and it never ends. You can write as many 3s as you like, but you can never write it exactly. Now notice that one third is a perfectly ordinary number. It is only awkward because our counting system is base ten, and ten is not divisible by three.

Computers use base two. In base two, one tenth is the awkward one. It becomes 0.0001100110011… repeating forever, so it has to be cut off somewhere. What the computer actually stores for 0.1 is a very slightly different number. I printed it:

from decimal import Decimal
import struct, sys

print("0.1 is really stored as:", Decimal(0.1))
print("0.5 is stored as       :", Decimal(0.5), "(a power of two, so exact)")
print("0.75 is stored as      :", Decimal(0.75))
bits = format(struct.unpack(">Q", struct.pack(">d", 0.1))[0], "064b")
print("64 bits of 0.1:", bits[0], bits[1:12], bits[12:])
print("largest float  :", sys.float_info.max)
print("smallest float :", sys.float_info.min)
print("digits of care :", sys.float_info.dig)
import math
print()
print("gap between neighbouring floats:")
print("  near 1             :", math.ulp(1.0))
print("  near 1e15          :", math.ulp(1e15))
print("  near 2**53 (9e15)  :", math.ulp(2.0 ** 53))

Output:

0.1 is really stored as: 0.1000000000000000055511151231257827021181583404541015625
0.5 is stored as       : 0.5 (a power of two, so exact)
0.75 is stored as      : 0.75
64 bits of 0.1: 0 01111111011 1001100110011001100110011001100110011001100110011010
largest float  : 1.7976931348623157e+308
smallest float : 2.2250738585072014e-308
digits of care : 15

gap between neighbouring floats:
  near 1             : 2.220446049250313e-16
  near 1e15          : 0.125
  near 2**53 (9e15)  : 2.0

So the stored 0.1 is 0.1000000000000000055511… Not exactly one tenth, but close enough that you normally never notice. Add two such slightly-off values and the tiny errors can show up at the sixteenth or seventeenth digit. Notice too that 0.5 and 0.75 are stored exactly, because they are built from powers of two (a half, a quarter). A float is only exact when the fraction is made of halves, quarters, eighths and so on.

Floats lose precision as they get big

There is a second quirk. A 64-bit float has only about 15 to 16 reliable decimal digits, and the gaps between neighbouring floats grow as the numbers grow. That is the output at the bottom of the block above: near 1, neighbouring floats are about 0.0000000000000002 apart. Near 9 quadrillion, they are 2 apart, so the float simply cannot represent every whole number.

Near 1: the next float is 0.00000000000000022 awayNear 1,000,000,000,000,000: the next float is 0.125 awayNear 9,007,199,254,740,992: the next float is 2 awayBar length is the size of the gap on a log scale, 64-bit floats.
The distance between one float and the next gets larger as the numbers get larger (log scale of the gap, longer bar means wider gap).

The practical rule: beyond 253, which is 9,007,199,254,740,992, floats skip whole numbers. In JavaScript, where every number is a float, this is why the biggest integer you can trust is 9,007,199,254,740,991. It is also why you should never store something like a 19-digit ID in a float.

How to compare floats safely

Because of those tiny errors, never ask whether two floats are exactly equal after calculation. Ask whether they are close enough. In Python, the function math.isclose does it. In other languages, take the absolute difference and compare it with a small tolerance, such as 0.000001, chosen to suit your problem. This one habit prevents a surprising number of bugs.

Booleans: the simplest type of all

A boolean has exactly two possible values: true or false. It is named after the mathematician George Boole, who built a branch of logic around exactly this idea in the nineteenth century. In everyday life, a boolean is any yes/no fact: is the user logged in, is the light on, has the invoice been paid, is the stock above its limit.

Booleans are the type that makes decisions possible. Every if statement and every loop condition eventually boils down to a boolean. When you write “if age is at least 18”, the comparison produces true or false, and the program picks a path based on it.

Storage: one bit of information, one byte of space

A boolean carries one bit of information, since there are only two answers. Yet most systems store it in a whole byte, because computers address memory in bytes and it is faster to read a full byte than to dig out a single bit. The little table at the end of the overflow code printed this: a boolean takes 1 byte, the same as a tiny integer. Programmers who need to store millions of flags sometimes pack eight of them into a single byte for exactly this reason.

Booleans in Python are secretly integers

In Python, True behaves like 1 and False behaves like 0. The code above showed that True + True gives 2 and that a boolean passes the test for being an integer. That is occasionally handy, for example counting how many items in a list satisfy a test by adding up their true/false results. It is also a source of odd bugs, so keep it in mind.

A more important trap involves text. The string “False” is not the boolean False. In Python, any non-empty string counts as true, so bool(“False”) is True. This bites people reading settings from a file or a web form, where everything arrives as text. Convert the value deliberately, instead of trusting it.

Why they differ: a side-by-side view

With all three in front of you, the differences are easier to see in one place.

PropertyIntegerFloatBoolean
HoldsWhole numbersNumbers with a fractionTrue or false
Example42, −73.14, 36.6True, False
Typical size1, 2, 4 or 8 bytes4 or 8 bytes1 byte
Exact?Yes, within its rangeNo, about 15 digitsYes
RangeLimited by widthEnormous, but coarseTwo values
Main dangerOverflowRounding errorConfusing text with true/false
Best forCounting, IDs, money in small unitsMeasurements, scienceConditions, flags

Notice that each type’s strength and weakness come from the same decision. Integers are exact because they cannot hold fractions. Floats can hold fractions because they give up exactness. Booleans are simple because they hold almost nothing. There is no free lunch, just a trade-off chosen for each job.

The fourth type that fools people: strings

Strictly speaking this article is about three types, but one more deserves a mention because beginners confuse it with integers all the time. A string is text: letters, digits, spaces, anything in quotation marks. The string “5” and the integer 5 look alike but behave very differently. Adding the two integers 5 + 5 gives 10. Adding the two strings “5” + “5” gives “55”, the text glued together.

This matters whenever data comes from outside your program. Form fields, CSV files and web pages deliver everything as text. If you forget to convert with int() or float(), you will get joined-up text instead of sums, or an error. The sample output earlier shows all three results side by side.

The reverse mistake is just as common. A phone number, PIN code or postal code is made of digits, but you never add or average them. Store them as strings. A PIN of 0482 stored as an integer becomes 482, and the leading zero is gone for good.

The money rule: never use floats

If there is one lesson from this article that will save you real trouble, it is this: do not store money in floats. It is the most common serious data-type mistake in shops, billing systems and spreadsheets. Here is a test. A shop sells 1,000 sweets at 0.10 each. I added the price one thousand times three ways:

from decimal import Decimal

# A shop sells 1,000 sweets at 0.10 each. Add the prices one by one.
total_float = 0.0
for _ in range(1000):
    total_float += 0.10
print("float total   :", total_float, "| equals 100.0?", total_float == 100.0)

total_dec = Decimal("0")
for _ in range(1000):
    total_dec += Decimal("0.10")
print("Decimal total :", total_dec, "| equals 100?", total_dec == 100)

paise = 0
for _ in range(1000):
    paise += 10                      # store money as whole paise (integers)
print("integer paise :", paise, "-> rupees", paise / 100)

print()
print("19.99 * 3       =", 19.99 * 3)
print("1999 * 3 paise  =", 1999 * 3, "-> 59.97")

Output:

float total   : 99.9999999999986 | equals 100.0? False
Decimal total : 100.00 | equals 100? True
integer paise : 10000 -> rupees 100.0

19.99 * 3       = 59.97
1999 * 3 paise  = 5997 -> 59.97

The float total is 99.9999999999986 and fails the check against 100. The Decimal type, which stores decimal digits exactly, gets 100.00. And whole units, in this case paise, get exactly 10,000, which is 100 rupees. The tiny 0.0000000000014 error would never show up on a receipt, but it can break an equality check, trip a reconciliation report or make a daily total off by a cent when multiplied by millions of transactions.

To be fair, floats do not always misbehave. At the bottom of the output, 19.99 × 3 prints a clean 59.97. That is the danger: it works nearly every time, so you trust it, and then one day it does not. Whenever correctness matters, use one of two safe approaches:

  • Integer smallest units. Store 19.99 rupees as 1999 paise, or 19.99 dollars as 1999 cents. Calculate in whole numbers, and divide by 100 only when displaying.
  • A decimal type. Python has Decimal, Java has BigDecimal, and most databases have a DECIMAL or NUMERIC column. These store decimal digits exactly.

Data types in everyday life

You do not need to be a programmer to meet these types. Click a tab to see five everyday situations and which type fits each one, and why.

Stadium crowd

A cricket ground counts spectators through the turnstiles. What type should the counter be?

TypeInteger
Example52,314
WhyNo half people
RiskOverflow if too narrow

The right type. Counting whole things is the textbook job for an integer. Every entry adds exactly 1, and the total is exact no matter how many people arrive. The only thing to check is the width: a 16-bit counter tops out at 32,767, which a big stadium would pass, so a 32-bit or 64-bit integer is the safe choice.

Shop price

A shop sells an item for 19.99 rupees. How should the price be stored so the day’s total is right?

TypeWhole paise
Example1999
Float sum99.9999999999986
Exact sum10000

The right type. Store 1999 paise as an integer, calculate in paise and divide by 100 only for display. In my test, adding 0.10 a thousand times in a float gave 99.9999999999986, while adding 10 paise a thousand times gave exactly 10,000. A decimal type is the other safe route.

Body temperature

A thermometer app records 36.6 degrees Celsius. Which type fits?

TypeFloat
Example36.6
PrecisionAbout 15 digits
CompareWith a tolerance

The right type. A temperature is a measurement, so a float is right: it can hold a fraction, and a tiny error in the sixteenth digit is irrelevant for a thermometer that is only accurate to a tenth of a degree. When checking whether a reading equals a target, test whether it is close enough instead of testing for exact equality.

Logged in?

A website needs to remember whether a visitor is signed in. What type holds that fact?

TypeBoolean
ValuesTrue or False
InformationOne bit
Trap“False” is truthy

The right type. A yes/no fact is a boolean. It decides whether to show the account page or the login form. The classic trap is a setting saved as text: in Python, bool(“False”) is True, because any non-empty string counts as true. Convert text to a boolean on purpose.

Phone number

A form collects a phone number such as 09876543210. Should it be a number type?

TypeString
Example09876543210
As integer9876543210
LostThe leading 0

The right type. No. You never add or average phone numbers, so they are labels, and labels belong in strings. Stored as an integer, the leading zero disappears and the value changes. The same advice covers PIN codes, postal codes, account numbers and ID numbers.

Choosing the right type: a quick decision guide

When I design a new database table or a form, I go through the same short list. Read the questions top to bottom and stop at the first yes.

1. Is it a yes or no flag(on/off, paid/unpaid)?yesBooleanTrue or Falseno2. Are you counting wholethings, with no fractions?yesIntegerwatch the widthno3. Is it money, or must thedecimal digits be exact?yesWhole paise or cents,or a Decimal typeno4. Is it a measurement wherea tiny error is fine?yesFloatcompare with a toleranceno5. Is it a label, like a phonenumber, PIN or name?yesStringtext, never arithmetic
A practical way to choose a type. When in doubt about money, pick whole units.

Converting between types

Programs constantly change a value from one type to another, and some conversions lose information. Knowing which is useful.

  • Integer to float is usually safe for small numbers. 7 becomes 7.0. Very large integers can lose digits, as we saw past 253.
  • Float to integer throws away the fraction. In Python, int(3.9) gives 3 and int(−3.9) gives −3, since it chops toward zero instead of rounding. If you want rounding, call round() on purpose.
  • Rounding has quirks. Python’s round() uses “round half to even”, so round(2.5) is 2 and round(3.5) is 4. It is designed to avoid a bias when many values are rounded, but it surprises people who expect 2.5 to become 3.
  • String to number needs int() or float(), and it fails with an error if the text is not a valid number. Always handle that case when reading user input.
  • Anything to boolean follows the language’s own rules. In Python, zero, empty text and empty lists count as false, and almost everything else counts as true, including the string “False”.
  • Division is a type decision too. In Python, 10 / 4 is 2.5, a float, while 10 // 4 is 2, whole-number division, and 10 % 4 is the remainder, 2. In some older languages, dividing two integers silently gives an integer, which has caused many off-by-a-fraction bugs.

Common mistakes and how to avoid them

  • Using floats for money. Use integer paise or cents, or a decimal type.
  • Comparing floats with ==. Compare with a tolerance instead.
  • Storing IDs, phone numbers and PINs as numbers. If you never do arithmetic on it, it is probably a string.
  • Ignoring the width of an integer. If a counter could ever pass about two billion, use a 64-bit integer from the start.
  • Trusting text as a boolean. The text “false” is true in most languages. Convert it deliberately.
  • Forgetting that form data is text. Everything from a web form arrives as a string until you convert it.
  • Assuming integer division behaves the same everywhere. Check how your language divides whole numbers.
  • Storing huge whole numbers in floats. Beyond about nine quadrillion, floats skip numbers.

A mental model that sticks

If you remember only one picture, make it this. An integer is a staircase: you are on step 4 or step 5, never in between, and each step is exactly where it says it is. A float is a ramp with markers painted on it: you can stand anywhere, but the markers are only approximate, and they are spaced further apart as you climb. A boolean is a light switch: on or off, nothing else. Pick the staircase when you count, the ramp when you measure and the switch when you decide.

Practice problems with answers

Try each one before you tap to check.

1. Which type should hold the number of items in a shopping cart?

Integer. You count whole items, and there is no such thing as 2.5 items.

2. What do 10 / 4 and 10 // 4 give in Python?

2.5 and 2. The single slash gives a float, and the double slash divides and keeps only the whole part.

3. Why is 0.1 + 0.2 not exactly 0.3?

One tenth has no exact binary form, so the stored 0.1 and 0.2 are both slightly off. Their sum is 0.30000000000000004.

4. A signed 8-bit integer holds 127. What is the value after adding 1?

−128. The pattern 01111111 becomes 10000000, which is read as the most negative value.

5. What does True + True equal in Python?

2. In Python, True counts as 1 and False counts as 0.

6. Which type suits the PIN 0482, and why?

A string. You never do arithmetic on a PIN, and storing it as an integer would drop the leading zero and leave 482.

7. How would you store a price of 19.99 rupees safely?

As the integer 1999 paise, or as a Decimal. Divide by 100 only when you display it.

Test yourself: five quick questions

Tap a question to reveal the answer. The correct option is marked.

Which type is best for counting the people in a room?
  1. Integer
  2. Float
  3. Boolean
  4. String

People come in whole units, so an integer is exact and natural.

What does a signed 8-bit integer become when you add 1 to 127?
  1. 128
  2. 0
  3. −128
  4. 255

It wraps around. Binary 01111111 plus one is 10000000, which a signed integer reads as −128.

Why does 0.1 + 0.2 give 0.30000000000000004?
  1. Python has a bug
  2. 0.1 cannot be stored exactly in binary
  3. Floats cannot add
  4. The computer rounds up on purpose

One tenth repeats forever in binary, so it must be cut off. The tiny errors show up in the result.

What is bool(“False”) in Python?
  1. False
  2. An error
  3. None
  4. True

Any non-empty string counts as true, including the text “False”. Convert text to a boolean deliberately.

How should you store money to avoid rounding errors?
  1. As a float with two digits
  2. As whole paise or cents, or a Decimal
  3. As a boolean
  4. As a string only

Whole units are exact. Floats are not, as 1,000 additions of 0.10 showed: 99.9999999999986.

Frequently asked questions

What is the difference between an integer and a float?

An integer is a whole number with no fractional part and is stored exactly. A float has a decimal point and is stored as digits plus an exponent, which allows fractions and huge ranges but only approximate accuracy.

Why do floats have rounding errors?

Computers store numbers in binary. Some decimals, such as 0.1, repeat forever in binary, so they are cut off and stored as a nearby value. The small error can appear after calculations.

What is a boolean used for?

A boolean holds true or false and drives decisions in code. Every if statement and loop condition ends up as a boolean, and flags such as is_logged_in or has_paid use the type directly.

What is integer overflow?

When a calculation produces a value too large for the integer’s fixed width. In many languages it wraps around, so the biggest positive value plus one becomes the most negative value.

Should I use float or double?

Both are floating-point types. Float usually means 32 bits, with about 7 reliable digits, and double means 64 bits, with about 15. Most modern code uses double unless memory is tight. Python’s float is a 64-bit double.

Do all programming languages have these types?

Most do, but names and behaviour differ. Python integers grow without a fixed limit, C and Java use fixed widths, and JavaScript has a single number type that is a 64-bit float. Always check how your language handles each type.

Key takeaways

  • A data type tells the computer how many bits a value uses, how to read them and which operations make sense.
  • Integers are exact whole numbers, but a fixed width can overflow: 127 + 1 wraps to −128 in a signed 8-bit integer, and the 32-bit Unix clock runs out in January 2038.
  • Floats handle fractions and huge ranges, but they are approximate. 0.1 + 0.2 gives 0.30000000000000004 because 0.1 has no exact binary form.
  • Booleans hold true or false and drive every decision. The text “False” is not the boolean False.
  • Never store money in floats: my test of 1,000 additions of 0.10 gave 99.9999999999986. Use whole paise or cents, or a decimal type.
  • If you never do arithmetic on a value, such as a phone number or PIN, store it as a string.
data typesintegersfloating pointbooleansprogramming for beginnersfloating point precisioninteger overflow

The post Data Types Explained: Integers, Floats, Booleans and Why They Differ appeared first on Learn With Examples.

]]>
https://learnwithexamples.org/data-types-explained/feed/ 0 992
How a Phone’s Contact Search Finds Matches as You Type https://learnwithexamples.org/how-a-phones-contact-search/ https://learnwithexamples.org/how-a-phones-contact-search/#respond Tue, 13 Oct 2026 14:36:16 +0000 https://learnwithexamples.org/?p=977 You type the letter “m” and Mom appears. You add an “a” and the list shrinks. By the third letter, the person you wanted is already on screen and you…

The post How a Phone’s Contact Search Finds Matches as You Type appeared first on Learn With Examples.

]]>

You type the letter “m” and Mom appears. You add an “a” and the list shrinks. By the third letter, the person you wanted is already on screen and you have not finished typing. It feels like magic, but it is a handful of well-known tricks working together, and every one of them is something you can build yourself in an afternoon. This article takes the search apart piece by piece, with working code, real measurements and everyday pictures.

The magic trick, and why it needs engineering

Search-as-you-type looks simple until you ask what the phone is really being asked to do. Every single keystroke is a new question. By the time you type the fourth letter of a name, the phone has answered four separate searches, and it has to finish each one before your finger lands on the next key. Usability researchers have used a rule of thumb for decades: if a response arrives in about a tenth of a second, people experience it as instant. Anything much slower and the interface starts to feel like it is lagging behind you.

Now picture the other side of the problem. A phone might hold a few hundred contacts, but plenty of people have thousands, once you count work contacts, old numbers and group chats. And each contact is not just a name. It has several numbers, an email, a nickname, a company. The search has to be fast, forgiving, and sensible about which result to put first.

I have built search boxes for products of every size over the years, and I always start new engineers with this exact exercise. It teaches normalisation, data structures, ranking and the limits of “just loop over everything” in one small, familiar problem.

The short version. A contact search cleans up what you type (lowercase, no accents), looks it up in an index built ahead of time instead of scanning every contact, ranks the matches so the most likely person comes first, and can forgive small typos. Apps differ in the details, and the vendors do not publish their exact internals, but these are the standard building blocks, and they are what we will build here.

The pipeline in one picture

Whatever the app, the path from keystroke to list looks about the same.

1 Keystrokeyou type “ani”2 Normaliselowercase, no accents3 Look upin a prebuilt index4 Rankbest match first5 Showtop results on screenThe index in step 3 is built once, ahead of time, and updated only when contacts change.
Five steps run on every keystroke. The expensive work is done ahead of time, when the index is built.

Let us walk through the stages in order, starting with the most naive version that works, because the way it fails shows you why each later trick exists.

Step 1: clean up what people type (normalisation)

Before any matching happens, both the typed text and the stored names need to be put into the same shape. People type “jose” for José, they type in lower case, and they put dots and dashes into names such as “Anne-Marie” or “O’Brien”. If you compare raw text, none of those match.

So the first stage lowercases everything, strips accents, replaces punctuation with spaces and splits the name into words. That is called normalisation, and it is the unglamorous step that makes the rest work. Skipping it is the number one reason homemade search feels “broken.”

Below is a first version of the whole search in about twenty lines. It normalises, then checks every contact. A contact matches when every word you typed is the beginning of some word in the name.

import unicodedata, re

def normalise(text):
    """Lowercase, strip accents, turn punctuation into spaces."""
    text = unicodedata.normalize("NFKD", text)
    text = "".join(c for c in text if not unicodedata.combining(c))
    return re.sub(r"[^a-z0-9 ]+", " ", text.lower()).split()   # list of words

def linear_search(contacts, query):
    """Slowest idea that works: look at every contact on every keystroke."""
    q = normalise(query)
    hits = []
    for cid, words in contacts:                  # contacts = [(id, [words...]), ...]
        # every typed word must be the start of some word in the name
        if all(any(w.startswith(t) for w in words) for t in q):
            hits.append(cid)
    return hits

This already behaves like a real contact search. Type “sh” and you find both Onam Sharma (the surname starts with sh) and Shalini Rao (the first name does). Type “on sh” and only Onam Sharma remains, because each typed word must begin some word in the name. Matching at the start of any word is what makes phone searches feel natural: you can type the first or the last name, in any order.

Real-world picture: a library catalogue. You do not need the exact title. You type a few starting letters of any word and the system narrows the shelf for you.

Step 2: watch the results shrink as you type

Here is something satisfying to see. I generated 5,000 made-up contacts (random first and last names) and ran the search above while “typing” the name anit, one letter at a time. My test names lean heavily towards names beginning with A, so the early numbers are larger than a real address book would give, but the shape is what matters.

nothing typed5,000a1,188an568ani186anit90Matching contacts out of 5,000 (made-up names that lean towards A, so early counts run high).
Each new letter cuts the candidate list sharply. Out of 5,000 contacts, four letters leave 90.

This shrinking is the whole reason search-as-you-type works so well. The first letter does the least work and returns the longest list, which the phone only needs to display the top of. Every next letter cuts the list further, and by the fourth or fifth letter you are usually looking at a handful of names.

It also hides a second, very practical trick. Every result for “ani” is guaranteed to also be a result for “an”, because anything starting with “ani” also starts with “an”. So instead of searching all contacts again, you can search only the list you already have. I counted the name checks for typing anit across 10,000 contacts: scanning everything on every keystroke took 40,000 checks, while reusing the previous results took 13,852. That is about two-thirds fewer, for a change of a few lines of code.

The catch. This only works while the user keeps typing forward. The moment someone presses backspace, the saved list is too small, and you must go back to an earlier result or start over. Good apps keep a short history of the lists for exactly that reason.

Step 3: stop scanning, start looking up (the index)

The scan-and-reuse approach is fine for a thousand contacts. But it still touches every candidate on the first keystroke, and the cost grows with the size of the list. Real search systems avoid scanning entirely. They do the hard work once, ahead of time, and build an index, which is a structure designed to answer one specific question quickly. For “which words start with these letters?” the classic answer is a trie.

What is a trie?

A trie (said “try”) is a tree where each step down spells one more letter. All words that share a start share the same path. To find everything starting with “ani”, you walk three steps down and you are standing on the answer: every contact reachable from that spot begins with those letters. You never look at the other thousands of contacts at all.

•amniiktltiatAmitAnilAnitaAnkitWalk down the letters you typed. Everything below that spot is a match.
A small trie for the words Amit, Anil, Anita and Ankit. They share the first letter, and Anil, Anita and Ankit share the first two.

The cost of a lookup depends on the length of what you typed, not on how many contacts you own. A person with 100 contacts and a person with 100,000 both pay the same few steps for “ani”. That is the property that makes it scale.

Here is a compact version. In this one, every node remembers the set of contacts passing through it, so reading the answer is instant:

class Trie:
    """Every node remembers which contacts pass through it."""
    def __init__(self):
        self.root = {}
    def add(self, word, cid):
        node = self.root
        for ch in word:
            node = node.setdefault(ch, {})
            node.setdefault("#", set()).add(cid)  # '#' holds contact ids
    def prefix(self, text):
        node = self.root
        for ch in text:
            node = node.get(ch)
            if node is None:
                return set()
        return node.get("#", set())

def build(contacts):
    t = Trie()
    for cid, words in contacts:
        for w in words:
            t.add(w, cid)
    return t

def trie_search(t, query_words):
    sets = [t.prefix(w) for w in query_words]
    return set.intersection(*sets) if sets else set()

The trade-off is memory. The trie stores extra information so lookups are fast, which is the oldest bargain in computing: spend space and preparation time to buy speed.

A simpler cousin: the sorted list and binary search

If a trie sounds like more machinery than you want, there is a leaner way to get the same effect. Keep every word in one alphabetically sorted list. All words starting with “ani” sit together in one block, because they sort together. Use binary search to find where that block begins and ends, which takes only about seventeen steps even for a hundred thousand words. If you read our article on heaps and sorted arrays, this is the same “sorted array” idea put to a different job. It uses less memory than a trie and is easier to write, and it is a perfectly good choice.

The numbers: how much faster is an index?

I built all three versions (scan, sorted list with binary search, and trie), checked that they return identical results on 500 random queries, and then timed them. The test is typing the four letters anit, taking the best of five runs, with different address book sizes. These figures come from Python on a cloud machine, so a real phone running compiled code will be quicker in absolute terms. What matters is the ratio.

ContactsScan everythingSorted list + binary searchTrieTrie vs scan
1,0003.13 ms0.025 ms0.011 ms275x faster
10,00032.87 ms0.28 ms0.089 ms368x faster
100,000345.59 ms8.18 ms1.31 ms263x faster
Scan everything345.6 msSorted list + bisect8.2 msTrie1.3 msTyping “anit” with 100,000 contacts. Bar length uses a log scale: each 1/3 of the width is 10 times longer.
Time to type four letters with 100,000 contacts. The scan is hundreds of times slower than the trie.

Look at the first row of the table. With 1,000 contacts, every method finishes in a few milliseconds or less, and nobody would notice a difference. That is the honest takeaway: for a normal-sized address book, even the naive scan is fast enough. The index only earns its keep as the data grows. At 100,000 entries the scan needed about a third of a second to answer four keystrokes, which is long enough to feel sluggish, while the trie needed about a millisecond.

Step 4: searching by phone number

Name search matches the start of words. Number search needs different rules, because people remember numbers differently. They recall the last four digits, or the number without the country code, or they type it with spaces and dashes that were never stored.

The standard solution is to normalise numbers the same way we normalised names. Strip everything that is not a digit, and maybe drop a leading country code such as +91, so that “+91 98765-43210”, “098765 43210” and “9876543210” all become the same string. Then, instead of matching only at the beginning, you let the typed digits match anywhere in the number, or at the end for the “last four digits” habit.

Real-world picture: a security guard asking, “What are the last four digits of your flat number?” People anchor on the end of a number because that is the part they have said out loud the most.

Because digits have only ten possible characters, a similar trie or sorted index works well. For suffix searching, you can index the reversed number so “last four digits” becomes an ordinary prefix lookup.

Step 5: put the most likely person first (ranking)

Finding matches is only half the job. If typing “sha” returns thirty people in alphabetical order, the one you wanted may be on the third screen. So the list has to be ranked.

The idea is to give every match a score from several signals, then sort by score. The signals I always start with are: how well the text matches (the whole name starts with it, a word starts with it, or it appears in the middle), whether you marked the person as a favourite, and how often or how recently you contact them.

from norm import normalise

def score(contact, query):
    """Higher is better. contact = dict(name, favorite, calls)."""
    words = normalise(contact["name"])
    q = normalise(query)
    s = 0
    if " ".join(words).startswith(" ".join(q)):
        s += 100                      # the whole name starts with what you typed
    elif all(any(w.startswith(t) for w in words) for t in q):
        s += 60                       # every typed word starts some word in the name
    elif all(t in " ".join(words) for t in q):
        s += 20                       # typed text appears inside a word
    else:
        return 0
    s += 30 if contact["favorite"] else 0
    s += min(contact["calls"], 50) * 0.5   # frequent contacts float up
    return s

contacts = [
    {"name": "Shalini Rao",   "favorite": False, "calls": 2},
    {"name": "Onam Sharma",   "favorite": False, "calls": 40},
    {"name": "Sharad Verma",  "favorite": True,  "calls": 12},
    {"name": "Ashwin Shah",   "favorite": False, "calls": 5},
    {"name": "Harsh Gupta",   "favorite": False, "calls": 60},
]
query = "sha"
ranked = sorted(((score(c, query), c["name"]) for c in contacts), reverse=True)
for s, name in ranked:
    if s: print(f"{s:6.1f}  {name}")

Running it for the typed text “sha” gives:

 136.0  Sharad Verma
 101.0  Shalini Rao
  80.0  Onam Sharma
  62.5  Ashwin Shah

Notice the order. Sharad Verma is first because his name starts exactly with “sha” and he is a favourite. Shalini Rao is next on pure match quality. Onam Sharma follows, as only the surname starts with “sha”, even though he is called often. Ashwin Shah comes last of the matches, and Harsh Gupta does not appear at all because “sha” never occurs in his name. The weights (100, 60, 20, 30 and the call bonus) are just numbers I chose to demonstrate. In a real product, teams tune them with usage data, and that tuning is the difference between a search that is merely correct and one that feels uncannily helpful.

Step 6: forgiving typos (fuzzy matching)

Thumbs are clumsy and names have many spellings. Is it Anita or Anitha? Sunita or Suneeta? Strict prefix matching treats any typo as a complete failure. Fuzzy matching asks a gentler question: how many small edits would it take to turn what you typed into this name?

The classic measure is edit distance, also called Levenshtein distance, which counts single-letter insertions, deletions and replacements. Here it is in a few lines:

def edit_distance(a, b):
    """Minimum single-letter edits (insert, delete, replace) to turn a into b."""
    prev = list(range(len(b) + 1))
    for i, ca in enumerate(a, 1):
        cur = [i]
        for j, cb in enumerate(b, 1):
            cur.append(min(prev[j] + 1, cur[j-1] + 1, prev[j-1] + (ca != cb)))
        prev = cur
    return prev[-1]

names = ["Anita", "Amit", "Anil", "Ankit", "Anjali"]
typed = "Anitha"           # another common spelling of "Anita"
for name in sorted(names, key=lambda n: edit_distance(typed.lower(), n.lower())):
    print(f"{name:<7} distance {edit_distance(typed.lower(), name.lower())}")

The output:

Anita   distance 1
Amit    distance 3
Anil    distance 3
Ankit   distance 3
Anjali  distance 4

“Anitha” is one deletion away from “Anita”, so Anita comes first, and everything else is at least three edits away. A search that falls back to fuzzy matching only when the exact search finds nothing gives you the best of both: exact results are fast and clean, and typos still find someone.

One small warning from experience: in plain edit distance, swapping two neighbouring letters (typing “Aniat” for “Anita”) costs two edits, not one, even though it is the most common typing mistake. A variant called Damerau-Levenshtein counts a swap as one. Also, comparing your text against every contact is slow, so real systems use fuzzy matching sparingly, usually on a shortlist, or use clever indexes built for it.

A fun relic: the keypad dialer

Many phone dialers let you type digits on the number pad and show contacts whose names could be spelled with those keys. It is the old keypad letter layout (2 for ABC, 3 for DEF and so on) doing a modern job.

KEYS = {"2":"abc","3":"def","4":"ghi","5":"jkl","6":"mno","7":"pqrs","8":"tuv","9":"wxyz"}
LETTER = {ch: d for d, chars in KEYS.items() for ch in chars}

def to_digits(name):
    return "".join(LETTER[c] for c in name.lower() if c in LETTER)

for name in ["Anita", "Amit", "Anil", "Ankit"]:
    print(f"{name:<6} -> {to_digits(name)}")

typed = "26"                          # you pressed 2 then 6 on the dialer
matches = [n for n in ["Anita", "Amit", "Anil", "Ankit", "Rahul"] if to_digits(n).startswith(typed)]
print("typed", typed, "matches", matches)
Anita  -> 26482
Amit   -> 2648
Anil   -> 2645
Ankit  -> 26548
typed 26 matches ['Anita', 'Amit', 'Anil', 'Ankit']

Pressing 2 then 6 matches every name whose first letter lives on the 2 key and whose second letter lives on the 6 key, which is why Anita, Amit, Anil and Ankit all appear. Add a 4 and Ankit drops out, because its third letter, K, sits on the 5 key. Add an 8 and Anil drops out too, leaving Amit and Anita. Working a few of these by hand is a good way to check that you really understand the mapping.

The same idea in five real settings

This pattern appears far beyond contacts. Click a tab to see it in other places.

Phone contacts

You open the phone app and type three letters of a friend’s name.

DataLocal
MatchWord starts
ExtrasRanking
SpeedInstant

How it searches. Everything lives on the device, so the lookup is local and needs no network. The list matches at the start of any word in the name, can also match digits in a number, and ranks favourites and frequently called people first. The exact internals vary between phone makers and are not published, but this is the standard design.

Email ‘To:’ box

You start typing a colleague’s name in the To field and a small list drops down.

SourcePast contacts
MatchName or address
RankingRecent first
LimitShort list

How it searches. The suggestions are usually drawn from people you have written to and from your address book, then ranked so recent and frequent contacts come first. Matching works on both name and email address, so typing the start of either works. The list is kept short, because a dropdown of fifty names would be slower to scan than to type.

Website search suggestions

You type into a shop’s search bar and suggestions appear below it.

DataOn a server
TrickDebounce
IndexPrefix based
DangerStale replies

How it searches. Here the index lives on a server, so every request costs real time. Pages wait a moment after you stop typing (debouncing) and cancel old requests so the suggestions always match the latest text. The suggestions often come from a prefix index of popular searches, which is the same idea as our trie.

Maps place search

You type “gandhi mar” and the app guesses a road you have never spelled in full.

DataHuge
IndexPrefix + fuzzy
RankingNearby first
TyposForgiven

How it searches. Place search has to cope with millions of names, so it relies on prebuilt indexes, not scans. It typically ranks results by closeness to you or to the map you are viewing, as well as text match, and tolerates misspellings. It shows why ranking signals beyond the text itself matter once the list is large.

Code editor autocomplete

You type get in a code editor and it offers getUser, getUserName and getUsers.

DataSymbols in project
MatchPrefix, initials
RankingContext
SpeedPer keystroke

How it searches. Editors index the names in your project and match what you type against them as you go. Many also match on initials, so typing “gUN” can find getUserName. Ranking uses context, such as which names are valid at the cursor, and how recently you used them. It is search-as-you-type applied to code.

When the data is not on your phone: debouncing and races

Everything so far searched a local list, where each lookup takes microseconds. Things change when the search has to ask a server, such as a company directory with a million staff or a search box on a website. Now each keystroke could trigger a network request taking 100 to 500 milliseconds, and two new problems appear.

  • Too many requests. Typing a seven-letter name could send seven requests in a second. The fix is debouncing: wait until the user pauses for a short time, often 150 to 300 milliseconds, before sending anything. The delay is barely noticeable, and the request count drops sharply.
  • Answers arriving out of order. The reply for “an” might arrive after the reply for “ani”, and the screen ends up showing results for the wrong text. The fix is to cancel the old request, or to tag each request with a number and ignore any reply that is not for the latest one.

Phone contact lists are local, so they rarely need debouncing. A server-backed search box almost always does. Knowing which situation you are in is half the design.

Hard cases that break simple search

  • Names in other scripts. A contact saved in Devanagari or Arabic script cannot be found by typing Latin letters unless the system stores a transliteration or the user switches keyboards. Many real apps index several forms of the same name.
  • Prefixes in surnames. “McDonald”, “de la Cruz” and “Al-Farsi” do not split into words the way English names do. Treat the hyphen and the apostrophe thoughtfully.
  • Accent rules differ by language. Stripping the dots from “ü” helps in French and Spanish but may be wrong in German searches, where “ue” is the usual substitute.
  • Sorting order. The alphabet itself differs between languages. Sorting by raw character codes puts all capitals before all lowercase letters. Use a locale-aware sort.
  • Duplicates. The same person saved twice with slightly different details should usually appear as one result.

Which approach should you choose?

Your situationGood choiceWhy
A few hundred or a few thousand itemsSimple scan, plus reuse of previous resultsFast enough, minimal code, easy to debug.
Tens of thousands of items, prefix searchSorted list with binary searchLean on memory and quick to write.
Very large lists, instant response neededTrie or similar indexLookup cost depends on typed length, not list size.
Users make typosExact search first, fuzzy fallbackKeeps the common case fast and still forgives mistakes.
Results must feel “smart”Ranking by match quality plus usagePuts the likely person first.
Data lives on a serverDebounce and cancel old requestsSaves bandwidth and avoids wrong-order results.

Common mistakes when building search-as-you-type

  • Skipping normalisation. Case and accent mismatches make good data look broken.
  • Matching anywhere instead of at word starts. Typing “an” returns “Hannah” and “Joanna” before “Anita”, because they contain “an” in the middle. Prefer word-start matches and rank anywhere-matches lower.
  • Not ranking at all. An alphabetical list of thirty matches is a correct answer and a poor experience.
  • Rebuilding the index on every keystroke. Build once, update when contacts change.
  • Doing the work on the main thread. Heavy searching on the thread that draws the screen makes the typing itself stutter.
  • Forgetting empty results. Show something helpful, such as “no match” or a fuzzy suggestion, not a blank screen.

Test yourself

Tap a question to reveal the answer. The correct option is marked.

Why can a search reuse the results for “an” when the user types “ani”?
  1. Because the phone remembers everything forever
  2. Every match for “ani” must also be a match for “an”
  3. Because searches are always cached on a server
  4. It cannot, a new full scan is required

Anything that starts with “ani” also starts with “an”, so the longer search can run on the shorter search’s results. It stops working when the user presses backspace.

In a trie, what does the cost of a lookup depend on?
  1. The number of contacts
  2. The number of contacts squared
  3. The length of the text you typed
  4. The alphabet size only

You walk one step per typed letter, so the cost follows the typed length, not the size of the list.

You type “sha” and the list is correct but alphabetical, and your favourite contact is on page three. What is missing?
  1. Ranking
  2. Normalisation
  3. Debouncing
  4. Encryption

Finding matches is only half the job. Scoring by match quality, favourites and how often you contact someone puts the likely person first.

Why debounce a search box that asks a server?
  1. To make the server slower
  2. To hide typos
  3. To sort the results
  4. To avoid sending a request on every keystroke

Waiting a short moment after the last keystroke cuts the number of requests sharply, and cancelling old requests keeps stale replies off the screen.

You typed “Anitha” but the contact is saved as “Anita”. Which technique finds it?
  1. Binary search
  2. Fuzzy matching using edit distance
  3. Debouncing
  4. Trie prefix lookup

Edit distance counts the small changes between two strings. “Anitha” is one deletion away from “Anita”, so it ranks first.

Frequently asked questions

How does contact search work so fast?

It does the heavy work ahead of time. Names are cleaned up and stored in an index, so each keystroke is a quick lookup instead of a scan of every contact. Results are then ranked so the likely person comes first.

What is a trie in simple words?

A tree where each step down spells one more letter. Words that start the same share the same path, so finding everything that begins with a few letters means walking down those letters and reading what lies below.

Why does searching “sh” find a surname that starts with sh?

Good contact search matches the start of any word in the name, not just the first word. That lets you type either the first or the last name.

Do I need a trie for a small app?

Usually not. With a few thousand items, a simple scan is fast enough. In my test, even 10,000 contacts took only a few milliseconds per keystroke for the naive version in Python. Build an index when the data is large or the response must be instant.

How do apps handle spelling mistakes?

Many try an exact prefix search first and, only if that finds little, fall back to fuzzy matching such as edit distance. That keeps common searches fast while still forgiving typos.

What is the difference between debouncing and caching?

Debouncing waits for a pause in typing before sending a request, which reduces how many requests you make. Caching remembers earlier answers so repeating a search needs no new work. Real search boxes often use both.

Key takeaways

  • Search-as-you-type is a new search on every keystroke, so each answer has to be nearly instant.
  • Normalise first: lowercase, strip accents, split into words. Then match the start of any word.
  • Results for a longer text are a subset of results for a shorter one, so you can reuse the previous list. In my test that cut name checks by about two-thirds.
  • An index (a trie or a sorted list with binary search) makes lookup cost depend on what you typed, not on how many contacts you have. At 100,000 contacts the scan was hundreds of times slower.
  • For a normal address book, a simple scan is already fast enough. Do not over-engineer small data.
  • Ranking, fuzzy matching and debouncing are what turn a correct search into one that feels smart.
search as you typeautocompletetriecontact searchprefix searchfuzzy matchingdata structures

The post How a Phone’s Contact Search Finds Matches as You Type appeared first on Learn With Examples.

]]>
https://learnwithexamples.org/how-a-phones-contact-search/feed/ 0 977
Top 20 Networking Interview Questions with Plain-English Answers https://learnwithexamples.org/top-20-networking-interview-questions/ https://learnwithexamples.org/top-20-networking-interview-questions/#respond Tue, 13 Oct 2026 14:12:21 +0000 https://learnwithexamples.org/?p=973 I have sat on both sides of the interview table for a long time, and I can tell you something that surprises most candidates: interviewers rarely want a textbook definition.…

The post Top 20 Networking Interview Questions with Plain-English Answers appeared first on Learn With Examples.

]]>

I have sat on both sides of the interview table for a long time, and I can tell you something that surprises most candidates: interviewers rarely want a textbook definition. They want to hear whether you actually understand what happens when two computers talk. This guide gives you the twenty questions that come up again and again, each answered the way you would say it out loud, with a real-world picture, a “what the interviewer wants to hear” note, and a few small programs whose output I ran so the numbers are real.

How to use this guide

Read the questions in order the first time, because later answers lean on earlier ones. Subnets make more sense after IP addresses, and the “what happens when you type a URL” question ties together half the list. After that, use the headings to jump to whatever you are weakest on.

The one rule for answering. Give the one-sentence definition first, then a quick real-world picture, then one detail that proves you have actually used it. Three short layers beat a long speech. If the interviewer wants more, they will ask, and that is when the conversation gets good.

Questions 1 to 5 cover the foundations. Questions 6 to 11 cover the protocols that make the internet work. Questions 12 to 15 cover devices and routing, and 16 to 20 cover security and troubleshooting.

Part 1: The foundations

Q1 What is a computer network, and what are LAN, WAN and MAN?

The interviewer wants to hear: that a network is just devices sharing data, and that the types differ by reach.

A network is two or more devices connected so they can exchange data. Everything else is about scale. A LAN (local area network) covers a small area such as a home, an office floor or a school lab. A MAN (metropolitan area network) spans a city or a campus. A WAN (wide area network) links networks across cities or countries, and the internet is the largest WAN there is.

Real-world picture: your home Wi-Fi is a LAN. The company that runs your office has LANs in Delhi and Pune joined by a leased line, and that link is a WAN.

Q2 Explain the OSI model and the TCP/IP model.

The interviewer wants to hear: that layers split a big problem into small ones, and that you can name what happens at each.

The OSI model is a seven-layer teaching framework for how data travels. Each layer does one job and talks only to the layers directly above and below it. The TCP/IP model is the four-layer version the real internet is built on. Interviewers love asking for both because the layers give you a map for troubleshooting.

OSI model (7 layers)TCP/IP model (4 layers)7 ApplicationHTTP, DNS, SMTP6 PresentationEncryption, encoding5 SessionSessions, dialogue4 TransportTCP, UDP, ports3 NetworkIP, routing2 Data LinkMAC, switches1 PhysicalCables, radio, bitsApplicationDataTransportSegment / datagramInternetPacketLinkFrame / bitsMnemonic from the top: All People Seem To Need Data Processing
OSI has seven layers, TCP/IP has four. The data unit gets a new name at each stage.

A handy memory trick for the OSI layers from the top is: All People Seem To Need Data Processing (Application, Presentation, Session, Transport, Network, Data Link, Physical). In practice, people use the layer numbers as shorthand. When an engineer says “layer 2 problem,” they mean something about switches and MAC addresses. “Layer 3” means IP and routing, and “layer 4” means TCP or UDP ports.

Real-world picture: posting a parcel. You write the letter (application), put it in an envelope with an address (network), a courier packs it into a truck (data link), and the truck drives on the road (physical). Each stage ignores how the others do their work.

Q3 What is an IP address? What is the difference between IPv4 and IPv6, and between public and private?

The interviewer wants to hear: 32 versus 128 bits, and why private ranges exist.

An IP address is the logical address of a device on a network, used to route data to it. IPv4 addresses are 32 bits long, written as four numbers such as 192.168.1.10, giving about 4.29 billion possible addresses (232 is exactly 4,294,967,296). That turned out not to be enough for a world of phones and sensors. IPv6 addresses are 128 bits, which gives roughly 3.4 × 1038 addresses, an almost unimaginable number.

Private addresses are reserved for use inside networks and are not routed on the public internet. The three ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Public addresses are unique across the internet. Because many homes reuse the same private ranges, NAT (Question 13) lets them all share one public address.

Real-world picture: private addresses are like room numbers inside a hotel. Room 204 exists in thousands of hotels, but it only means something inside one building. The hotel’s street address is the public one.

Q4 What is a subnet mask and what is subnetting?

The interviewer wants to hear: that a mask splits an address into network and host parts, and that you can do the arithmetic.

A subnet mask tells a device which part of an IP address identifies the network and which part identifies the host. The mask 255.255.255.0 means the first three numbers name the network and the last one names the device. Engineers also write it as CIDR notation: 192.168.10.0/24, where 24 is the count of network bits.

Subnetting means cutting one large network into smaller ones, usually for tidiness, security or to reduce broadcast traffic. The useful formula: a network with a prefix length of n has 2(32 − n) addresses, and two of those are reserved (the network address and the broadcast address), so the usable host count is 2(32 − n) − 2. A /24 gives 254 hosts. A /26 gives 62.

Here is a short Python program that does the arithmetic with the standard ipaddress module. It splits a /24 into four /26 subnets.

import ipaddress

net = ipaddress.ip_network("192.168.10.0/24")
print(net, "has", net.num_addresses, "addresses,", net.num_addresses - 2, "usable hosts")
print("mask:", net.netmask)
print()
print("Split into four /26 subnets:")
for s in net.subnets(new_prefix=26):
    hosts = list(s.hosts())
    print(f"{str(s):<18} hosts {hosts[0]} - {hosts[-1]}   broadcast {s.broadcast_address}")

Output:

192.168.10.0/24 has 256 addresses, 254 usable hosts
mask: 255.255.255.0

Split into four /26 subnets:
192.168.10.0/26    hosts 192.168.10.1 - 192.168.10.62   broadcast 192.168.10.63
192.168.10.64/26   hosts 192.168.10.65 - 192.168.10.126   broadcast 192.168.10.127
192.168.10.128/26  hosts 192.168.10.129 - 192.168.10.190   broadcast 192.168.10.191
192.168.10.192/26  hosts 192.168.10.193 - 192.168.10.254   broadcast 192.168.10.255

Read each line as a mini network: the first usable host, the last usable host, and the broadcast address at the end. Interviewers who ask this question often give you a block like 192.168.10.0/24 and ask you to carve out four equal subnets. The answer is the table above, and the trick is that each /26 holds 64 addresses, so the blocks start at 0, 64, 128 and 192.

Q5 What is the difference between a MAC address and an IP address?

The interviewer wants to hear: local identity versus logical location.

A MAC address is a 48-bit hardware identifier burned into a network card, written like 3C:52:82:AB:12:EF. It is used for delivery within one local network. An IP address is assigned by software or a DHCP server, can change, and is used to route data between networks.

Real-world picture: your name is your MAC address, and it goes wherever you go. Your postal address is your IP address, and it changes when you move house. The post office sorts by postal address across the country, but the final handover at your door is to you by name.

One more detail worth saying: as a packet crosses several routers, the IP addresses at both ends stay the same, but the MAC addresses are rewritten at every hop. That single sentence tells an interviewer you understand how layers 2 and 3 cooperate.

Part 2: The protocols that run the internet

Q6 What is the difference between TCP and UDP?

The interviewer wants to hear: reliability versus speed, with an example of each.

TCP is connection-oriented. It sets up a connection first, numbers the data, retransmits what is lost and delivers it in order. UDP is connectionless. It just sends packets with no handshake, no retransmission and no ordering guarantee, so it is faster and lighter.

FeatureTCPUDP
ConnectionHandshake firstNone
DeliveryGuaranteed and orderedBest effort
SpeedSlower, more overheadFaster, less overhead
Used forWeb pages, email, file transfer, SSHDNS lookups, voice and video calls, games, streaming
Real-world picture: TCP is registered post with a signature at the end. UDP is a postcard. In a live video call, a lost frame is not worth resending because the moment has already passed, so a postcard is the right choice.

Q7 Explain the TCP three-way handshake.

The interviewer wants to hear: SYN, SYN-ACK, ACK, and why it exists.

Before TCP sends any data, the two sides agree to talk. The client sends a SYN (“I want to connect, my starting sequence number is X”). The server answers with SYN-ACK (“Got it, here is mine, Y”). The client finishes with an ACK (“Got yours too”). Now both sides know the other is alive and reachable, and they have agreed on sequence numbers for tracking data.

CLIENTSERVER1 SYNI want to connect, my sequence is x2 SYN-ACKOK, mine is y, I expect x+13 ACKGot it, I expect y+1Connection established. Data can now flow both ways.
Three messages open a TCP connection. Closing normally takes FIN and ACK messages in each direction.
Real-world picture: a phone call. “Hello, can you hear me?” “Yes, can you hear me?” “Yes. Okay, let us talk.”

A bonus line that impresses: a SYN flood attack sends huge numbers of SYNs and never completes the handshake, leaving the server holding half-open connections. Defences include SYN cookies and rate limits.

Q8 What is DNS and how does a lookup work?

The interviewer wants to hear: the hierarchy and that caching is why it is fast.

DNS, the Domain Name System, is the internet’s phone book. People remember names like example.com, but computers need IP addresses, and DNS translates one into the other.

When your device needs an address, it asks a recursive resolver, usually run by your ISP or a public DNS service. If the resolver does not already have the answer cached, it asks a root server, which points it to the server for the top-level domain (.com, .org, .in). That server points to the domain’s authoritative server, which gives the real answer. The resolver returns it to you and remembers it for the record’s time to live (TTL).

Your devicebrowserResolvercaches answersRoot serverpoints to .comTLD server (.com)points to the domainAuthoritativeknows the real IP12345. The resolver sends the IP address back to you and remembers it until the TTL expires.
A DNS lookup follows a chain from resolver to root to TLD to authoritative server, and every answer is cached.

Know the common record types: A (name to IPv4), AAAA (name to IPv6), CNAME (an alias to another name), MX (mail servers) and NS (which servers are authoritative). Plain DNS uses UDP port 53, and TCP port 53 is used for large responses.

Q9 What is DHCP and how does it work?

The interviewer wants to hear: automatic address assignment and the four-step DORA exchange.

DHCP, the Dynamic Host Configuration Protocol, automatically gives a device an IP address, subnet mask, default gateway and DNS servers when it joins a network. The exchange is nicknamed DORA: the client broadcasts a Discover, the server sends an Offer, the client sends a Request for that offer, and the server sends an Acknowledge. The address is a lease, not a permanent grant, and the client renews it before it expires.

Real-world picture: the front desk at a hotel handing you a room key that works until checkout. If you see an address beginning with 169.254 on your laptop, it means no DHCP server answered and the device gave itself a fallback address.

Q10 What is ARP and why is it needed?

The interviewer wants to hear: that ARP maps an IP address to a MAC address on the local network.

On a local network, devices deliver frames by MAC address, but programs only know IP addresses. ARP, the Address Resolution Protocol, bridges the gap. When your PC wants to reach 192.168.1.1 and does not know its MAC, it broadcasts “Who has 192.168.1.1?” to everyone. The owner replies with its MAC address. Your PC stores the answer in its ARP cache for a while, so it does not need to ask again.

The classic security follow-up is ARP spoofing: an attacker sends false ARP replies so that traffic meant for the gateway flows through their machine. Managed switches can defend against it with features such as dynamic ARP inspection.

Q11 What happens when you type a URL into your browser and press Enter?

The interviewer wants to hear: an ordered story that touches DNS, TCP, TLS and HTTP. This is the most famous question on the list, and it is really a test of the previous ten.

Here is the version I recommend you tell, in order:

  • 1. The browser checks its caches and the operating system’s cache for a known address.
  • 2. DNS lookup. If nothing is cached, it resolves the name to an IP address (Question 8).
  • 3. TCP connection. The browser opens a connection to port 443 with the three-way handshake (Question 7).
  • 4. TLS handshake. For HTTPS, both sides agree on encryption and the server proves its identity with a certificate.
  • 5. HTTP request. The browser sends GET / with headers.
  • 6. The server responds with a status code (200 for success) and the page.
  • 7. The browser renders the page, requesting images, scripts and styles, often over the same connection.

Mention that on your local network, the first packet needs ARP to find the gateway’s MAC address, and that routers along the way forward the packet by IP. That shows you can connect every layer in one story.

Part 3: Devices and routing

Q12 What is the difference between a hub, a switch and a router?

The interviewer wants to hear: three devices, three layers, three levels of intelligence.
DeviceWorks atHow it forwardsIntelligence
HubLayer 1Repeats every signal out of every portNone, and now rare
SwitchLayer 2Learns MAC addresses and sends frames only to the right portMedium
RouterLayer 3Looks at IP addresses and connects different networksHigh
Real-world picture: a hub is someone shouting a message to the entire room. A switch is a receptionist who knows where each person sits and walks the note to the right desk. A router is the post office that sends mail between towns.

Q13 What is NAT?

The interviewer wants to hear: private to public translation, and that ports make it work.

NAT, Network Address Translation, lets many devices with private addresses share one public IP address. The router rewrites the source address and port of outgoing packets and keeps a table. When replies come back, it looks up the table and forwards them to the right internal device. The common form, where ports tell the devices apart, is often called PAT or NAT overload.

Know the side effects. NAT helped the world survive IPv4 exhaustion, and it hides internal addresses from the outside. But it is not a firewall, and it breaks anything that needs inbound connections, which is why we use port forwarding to reach a server inside a home network.

Q14 What is a default gateway, and how does a router choose where to send a packet?

The interviewer wants to hear: the routing table and the longest-prefix-match rule.

A default gateway is the router a device uses for any destination outside its own subnet. Your laptop does not know how to reach the whole internet, so it hands everything non-local to the gateway.

A router keeps a routing table, a list of destination networks and where to send traffic for each. When a packet arrives, the router finds every entry that matches the destination and picks the most specific one, meaning the longest prefix. That is the longest prefix match. The entry 0.0.0.0/0 is the default route and matches everything, but because it is the least specific, it only wins when nothing better matches.

Here is a tiny router in Python with four routes:

import ipaddress

routes = {
    "0.0.0.0/0":   "ISP (default route)",
    "10.0.0.0/8":  "Head office core",
    "10.1.0.0/16": "Branch office",
    "10.1.2.0/24": "Branch lab network",
}

def lookup(dest):
    ip = ipaddress.ip_address(dest)
    best = None
    for prefix, hop in routes.items():
        net = ipaddress.ip_network(prefix)
        if ip in net and (best is None or net.prefixlen > best[0].prefixlen):
            best = (net, hop)
    return best

for dest in ["10.1.2.50", "10.1.9.9", "10.7.7.7", "8.8.8.8"]:
    net, hop = lookup(dest)
    print(f"{dest:<10} matches {str(net):<12} -> {hop}")

Output:

10.1.2.50  matches 10.1.2.0/24  -> Branch lab network
10.1.9.9   matches 10.1.0.0/16  -> Branch office
10.7.7.7   matches 10.0.0.0/8   -> Head office core
8.8.8.8    matches 0.0.0.0/0    -> ISP (default route)

Look at the first line. The address 10.1.2.50 matches the /8, the /16 and the /24, and the /24 wins because it is the most specific. The last line matches only the default route, which sends it to the ISP.

One more thing interviewers like: routes can be static (written by an administrator) or dynamic (learned from other routers using protocols such as OSPF inside an organisation and BGP between internet providers). Static is simple and predictable. Dynamic adapts when links fail.

Q15 What is a VLAN and why would you use one?

The interviewer wants to hear: logical separation on shared hardware.

A VLAN, virtual LAN, splits one physical switch into several logical networks. Devices in different VLANs cannot talk directly even if they are plugged into the same switch, and they need a router (or a layer 3 switch) to communicate. Frames carry a VLAN tag following the 802.1Q standard when they travel between switches.

The reasons to use them are security (keep guest Wi-Fi away from the finance team), performance (smaller broadcast domains) and tidiness (group devices by function, not by cable location).

Real-world picture: one office building with separate locked floors for different companies. Everyone shares the same lifts and walls, but you cannot walk into another company’s space without going through reception.

Part 4: Security and troubleshooting

Q16 What is a firewall?

The interviewer wants to hear: rules on traffic, and the stateless versus stateful difference.

A firewall filters network traffic by rules, allowing or blocking it based on things like source, destination, port and protocol. A stateless firewall checks each packet alone against the rules. A stateful firewall tracks connections, so it knows that an incoming packet is a reply to something you started, and it allows it automatically. Modern “next-generation” firewalls also look at applications and can detect certain threats.

The principle to quote is default deny: block everything, then allow only what you need. That way, a mistake leaves you too closed instead of too open.

Q17 What is the difference between HTTP and HTTPS?

The interviewer wants to hear: encryption, certificates and ports 80 and 443.

HTTP sends web traffic in plain text on port 80, so anyone on the path can read or alter it. HTTPS is the same protocol carried inside TLS encryption, usually on port 443. TLS gives you three things: confidentiality (nobody can read it), integrity (nobody can change it unnoticed) and authentication (a certificate proves you reached the real site).

If asked how the handshake works, a safe outline is: the client says hello and lists its supported options, the server answers with its certificate, the client checks the certificate against trusted authorities, and both sides agree on session keys, which then encrypt the data. Modern TLS also uses temporary keys, so recorded traffic stays unreadable even if a server key leaks later.

Q18 What is a VPN, and how is it different from a proxy?

The interviewer wants to hear: tunnel versus middleman.

A VPN creates an encrypted tunnel between your device and a VPN server, and typically sends all your traffic through it. Companies use VPNs so remote staff can reach internal systems as if they were in the office. A proxy is a server that makes requests on your behalf, usually for particular applications, and it may not encrypt anything. A VPN protects the whole path to the VPN server. A proxy mainly changes where the request appears to come from or adds filtering and caching.

Be careful with claims. A VPN hides your traffic from the local network and your ISP, but the VPN provider can see it instead. It does not make you anonymous.

Q19 How do you troubleshoot “the internet is not working”? What do ping and traceroute do?

The interviewer wants to hear: a method, not guesses. Work from near to far.

Ping sends a small ICMP echo request and waits for a reply. It tells you whether a host is reachable and how long the round trip takes. Traceroute (called tracert on Windows) lists the routers on the path by sending packets with increasing TTL values, so each router in turn reports back when the TTL runs out. It shows you where along the path things slow down or stop.

My own habit is a four-step ladder, working outward until something fails:

1 Ping 127.0.0.1your own network stackFails: this machine2 Ping gatewaye.g. 192.168.1.1Fails: cable, Wi-Fi, gateway3 Ping 8.8.8.8a public IPFails: ISP or beyond4 Ping a namee.g. example.comFails: DNSWork outward. The first step that fails shows where to look.
Test close to home first. The first step that fails tells you which layer to investigate.
  • Ping 127.0.0.1. If this fails, the network software on your own machine is broken.
  • Ping the default gateway. If this fails, the problem is local: cable, Wi-Fi, switch or gateway.
  • Ping a public IP such as 8.8.8.8. If this works but names fail, you are nearly at DNS. If it fails, the problem is beyond the gateway, maybe the ISP.
  • Ping a domain name. If the IP works but the name does not, DNS is the culprit.

Also check the basics early: is the address a 169.254 one (DHCP failed), is the cable plugged in, and did anything change recently? In my experience, most “mysterious” outages are one of those three.

Q20 What is the difference between bandwidth, latency and throughput?

The interviewer wants to hear: that fast internet is not one number.

Bandwidth is the maximum amount of data a link can carry per second, like the number of lanes on a highway. Latency is how long a single piece of data takes to get there, like the time for one car to complete the trip. Throughput is the amount that actually gets through in practice, which is usually lower than bandwidth because of congestion, errors and protocol overhead.

Real-world picture: a satellite link can have huge bandwidth, a wide highway, but high latency, a very long road. Downloading a big file is fine. A fast-paced online game feels terrible, because every action waits for a long round trip.

It is worth adding that a bigger plan does not fix a latency problem. When someone says “my connection is fast but pages feel slow,” look at latency, DNS and packet loss before blaming bandwidth.

How the same question changes by role

The twenty questions above are common, but interviewers adjust the depth to the job. Click a tab to see what each role is really probing for.

Help desk or IT support

You are the first person someone calls when their laptop cannot reach anything.

FocusTroubleshooting
CoreIP, DHCP, DNS
Toolsping, ipconfig
StyleStep by step

What they probe. Expect Questions 3, 9, 10 and 19 in some form. They want a calm method: check the cable or Wi-Fi, look for a 169.254 address, ping the gateway, then a public IP, then a name. Say each step out loud and what a failure at that step would mean.

Network engineer

You design and maintain the switches, routers and links that a company depends on.

FocusDesign and routing
CoreVLANs, OSPF, BGP
MathsSubnetting
ToolsCLI, Wireshark

What they probe. Expect deep dives into Questions 4, 12, 14 and 15: carve a block into subnets on a whiteboard, explain how a routing table picks a path, how a VLAN trunk works, and what happens when a link fails. Quote real protocols and mention labs you have built.

Backend developer

You write services that talk to databases, APIs and browsers across a network.

FocusHow apps use it
CoreHTTP, TCP, DNS
SkillsTimeouts, TLS
QuestionQ11 favourite

What they probe. The URL question (Q11) is almost guaranteed. Be ready for follow-ups on TCP versus UDP, what a timeout or a connection reset means, how DNS caching can cause stale answers after a deploy, and how HTTPS certificates fail. Latency and connection reuse come up often.

DevOps or cloud

You build and run infrastructure in a cloud, where networks are made from settings, not cables.

FocusCloud networks
CoreCIDR, NAT, LB
IdeasVPC, subnets
ToolsCloud console

What they probe. Subnetting and CIDR (Q4) matter a lot, because you will plan address ranges for virtual private clouds. Expect NAT (Q13), firewalls and security groups (Q16), DNS records (Q8), and a scenario such as why a private server cannot reach the internet. The answer often involves a missing route or NAT gateway.

Security analyst

You watch traffic for things that should not be there and harden what is exposed.

FocusAttack and defence
CoreFirewalls, TLS
KnowARP spoofing
MindsetDefault deny

What they probe. Expect Questions 7, 10, 16, 17 and 18 with an attacker’s twist: SYN floods, ARP spoofing, why HTTP is unsafe, what a VPN does and does not hide, and how stateful firewalls track connections. Strong answers always state both the attack and the defence.

Common mistakes candidates make

  • Reciting definitions with no example. A definition shows memory. An example shows understanding.
  • Mixing up layers. Saying a switch “routes” or that IP is at layer 2 is the quickest way to lose credibility.
  • Confusing the port with the protocol. Port 443 is conventionally HTTPS, but a program can use any port.
  • Forgetting that DNS uses UDP. Most do not mention that TCP is used for large answers and zone transfers.
  • Claiming NAT is a firewall. It hides addresses as a side effect. It does not enforce a security policy.
  • Guessing in troubleshooting questions. Describe your method out loud. Interviewers care more about how you think than what you land on.
  • Bluffing. “I have not used that, but here is how I would find out” works far better than inventing an answer.

A study plan that actually works

If you have two weeks, here is the order I recommend. Spend the first few days on layers, IP, subnets and TCP versus UDP, and practise subnetting by hand until the powers of two come automatically. In the middle days, trace one full web request (Question 11) on paper, then capture a real one using a packet analyser such as Wireshark and watch the DNS query, handshake and TLS hello appear. In the last days, build a small lab. The free Packet Tracer simulator from Cisco Networking Academy is excellent for this, and you can also run a few Linux virtual machines. Break something on purpose, then fix it using the ping ladder.

Nothing replaces hands-on practice. The people who stand out are the ones who say “when I set this up at home, I noticed…” because that cannot be memorised.

Test yourself: five-question mock round

Tap a question to reveal the answer. The correct option is marked.

A /26 network holds how many usable host addresses?
  1. 64
  2. 62
  3. 30
  4. 254

A /26 has 2^(32-26) = 64 addresses. Two are reserved for the network and broadcast addresses, leaving 62.

Your laptop shows 169.254.12.7 and has no internet. What most likely failed?
  1. DNS
  2. The website
  3. DHCP, so no address was assigned
  4. TLS

169.254.x.x is the link-local fallback used when no DHCP server answers.

A router has routes for 10.0.0.0/8, 10.1.0.0/16 and 0.0.0.0/0. Where does a packet to 10.1.5.5 go?
  1. The 10.1.0.0/16 route
  2. The 10.0.0.0/8 route
  3. The default route
  4. It is dropped

All three match, but the longest prefix (/16) is the most specific, so it wins.

Which device forwards frames using MAC addresses?
  1. Hub
  2. Router
  3. Firewall
  4. Switch

A switch is a layer 2 device that learns MAC addresses and sends each frame only to the right port.

What are the three messages in the TCP handshake, in order?
  1. SYN, ACK, SYN-ACK
  2. SYN, SYN-ACK, ACK
  3. ACK, SYN, SYN-ACK
  4. SYN-ACK, SYN, ACK

The client sends SYN, the server replies SYN-ACK, and the client finishes with ACK.

Frequently asked questions

How many networking questions should I expect in an interview?

It depends on the role. For a general IT or developer job, expect a handful of fundamentals such as TCP versus UDP, DNS and the URL question. For a network engineer role, expect a long technical session with subnetting, routing and troubleshooting scenarios.

Do I need a certification like CCNA?

It helps for network engineering and support roles because it shows structured knowledge and gives you lab practice. It is rarely required for developer roles, where clear understanding of the basics matters more.

How do I practise without expensive equipment?

Use a free simulator such as Cisco Packet Tracer, run a few virtual machines on your own PC, and capture real traffic with Wireshark. Breaking and fixing a small lab teaches more than reading.

What should I do if I do not know an answer?

Say what you do know, reason from the layers, and say how you would find out. Interviewers value honest thinking much more than a confident wrong answer.

Should I memorise port numbers?

Learn the common ones: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3306 MySQL and 3389 RDP. You do not need hundreds, but you do need those, and the reasoning behind them.

Is the OSI model actually used in real networks?

The internet runs on TCP/IP, but engineers use OSI layer numbers every day as shorthand for where a problem lives. That makes it worth knowing even though it is a reference model, not a protocol stack.

Key takeaways

  • Answer in three layers: a one-sentence definition, a real-world picture, then one detail from experience.
  • Know the layers cold. Switches are layer 2, routers are layer 3, and TCP and UDP are layer 4.
  • Be able to do subnet arithmetic: usable hosts = 2(32 − prefix) − 2, and the longest prefix wins in routing.
  • Tell the URL story end to end: DNS, TCP handshake, TLS, HTTP, render.
  • For troubleshooting, work from near to far with ping: loopback, gateway, public IP, domain name.
  • Practise with a real lab and a packet capture. Hands-on stories beat memorised definitions every time.
networking interview questionsOSI modelTCP vs UDPsubnettingDNSDHCPNATCCNA prep

The post Top 20 Networking Interview Questions with Plain-English Answers appeared first on Learn With Examples.

]]>
https://learnwithexamples.org/top-20-networking-interview-questions/feed/ 0 973
What Is a Port Number? Why 80, 443 and 22 Matter https://learnwithexamples.org/what-is-a-port-number/ https://learnwithexamples.org/what-is-a-port-number/#respond Tue, 06 Oct 2026 09:58:30 +0000 https://learnwithexamples.org/?p=966 Networking basics · TCP and UDP · Security An IP address gets data to the right computer. But that computer is running dozens of programs at once: a browser, a…

The post What Is a Port Number? Why 80, 443 and 22 Matter appeared first on Learn With Examples.

]]>
Networking basics · TCP and UDP · Security

An IP address gets data to the right computer. But that computer is running dozens of programs at once: a browser, a mail app, a database, a chat client, an update service. Something has to decide which program receives which piece of data. That something is the port number, and once you understand it, firewalls, port forwarding, “address already in use” errors and half of the security advice you have ever read start making sense.

The problem ports solve

Think about what happens when you open a website while a video call is running, a music app is streaming and your email is syncing in the background. All of that traffic arrives at your laptop through one network connection, addressed to one IP address. Yet the website data ends up in the browser, the call audio in the call app, and the emails in the mail client. They never get mixed up.

The IP address cannot do that job, because it only identifies the machine. You need a second number that identifies the program or service on that machine. That number is the port.

The one-paragraph version. A port is a 16-bit number, from 0 to 65535, that tells the receiving computer which program or service should get the incoming data. An IP address is the building, and the port is the apartment number. Web servers conventionally listen on 80 (HTTP) and 443 (HTTPS), and remote-login servers on 22 (SSH). A connection is identified by the pair of IP addresses plus the pair of port numbers, which is how thousands of conversations share one network card without colliding.

An everyday analogy: the apartment building

Imagine you send a parcel to “42 Mall Road.” The courier finds the building, which is what an IP address does. But 42 Mall Road is an apartment block with a hundred flats. Without a flat number the parcel sits in the lobby. Write “Flat 443” on it and the right resident receives it.

One IP address: 203.0.113.1022SSH80HTTP443HTTPS3306MySQLEach numbered door leads to a different program running on the same machine.
One IP address, many doors. Each door is a port, and each service listens at its own.

The analogy also explains why some flat numbers are famous. Everybody knows the front desk is Flat 1, so visitors do not have to ask. Ports work the same way. If every web server on Earth listens on 443 for secure traffic, your browser can reach any of them without being told the number.

Where ports live: the transport layer

Ports belong to the transport layer of networking, and the two protocols that use them are TCP and UDP.

  • TCP sets up a connection first, guarantees delivery and keeps the data in order. Web pages, email and file transfers use it.
  • UDP just fires packets without a handshake or guarantees. It suits things where speed matters more than perfection, such as DNS lookups, live video, voice calls and games.

TCP port 53 and UDP port 53 are different doors that happen to share a number. Each protocol has its own full set of 65,536 ports, which is why you will see written forms like 443/tcp and 443/udp. In fact, modern HTTP/3 uses UDP port 443, while ordinary HTTPS uses TCP port 443.

Why exactly 0 to 65535?

The port number is stored in 16 bits in the TCP and UDP headers. Sixteen bits give 216, or 65,536 possible values, counting from zero. That is the whole reason for the limit. Port 0 is reserved and is not used for ordinary traffic, so in practice you work with 1 to 65535.

The three port ranges

The internet’s numbering authority, IANA, divides the 65,536 numbers into three zones.

Registered 1024–49151DynamicWell-known 0–1023 (1,024 ports, only 1.6% of the space)06553549152Total: 65,536 ports (16 bits). Dynamic zone: 16,384 ports.
The three port zones. Notice how small the well-known zone is compared with the whole space.
RangeNameCountWhat lives here
0 – 1023Well-known (system) ports1,024Core services: web, SSH, email, DNS. Assigned by IANA.
1024 – 49151Registered ports48,128Applications and databases, such as MySQL on 3306 or PostgreSQL on 5432.
49152 – 65535Dynamic (ephemeral) ports16,384Temporary numbers your device picks for outgoing connections.

One caution: operating systems do not all follow the IANA suggestion for temporary ports. Modern Windows uses 49152 to 65535 by default. Linux commonly uses 32768 to 60999, and you can read the exact range in /proc/sys/net/ipv4/ip_local_port_range. That is a tuning detail worth knowing when you debug connection limits.

The ports every beginner should memorise

PortServiceWhat it does
22 (TCP)SSHEncrypted remote login and file copying.
25 (TCP)SMTPMail transfer between mail servers.
53 (UDP/TCP)DNSTurns names like example.com into IP addresses.
80 (TCP)HTTPUnencrypted web traffic.
443 (TCP, UDP)HTTPSEncrypted web traffic. UDP carries HTTP/3.
587 (TCP)SMTP submissionWhere your mail app sends outgoing mail.
993 (TCP)IMAPSEncrypted mailbox access.
3306 (TCP)MySQLDefault MySQL and MariaDB database port.
3389 (TCP)RDPWindows Remote Desktop.
5432 (TCP)PostgreSQLDefault PostgreSQL database port.
6379 (TCP)RedisDefault Redis cache and data store port.

These are conventions, not laws. Nothing in physics forces a web server to listen on 80. It is simply the agreed default, and the agreement is what lets browsers and servers find each other without negotiation.

Why 80, 443 and 22 matter so much

Port 80: the original web

When you type http://example.com, your browser quietly adds :80. This is plain, unencrypted HTTP. Anyone on the path, such as the coffee shop Wi-Fi owner, can read or modify what travels over it. Today port 80 mostly survives to redirect visitors to the secure version.

Port 443: the secure web

When you type https://example.com, the browser adds :443. The same HTTP conversation happens, but wrapped in TLS encryption. This is the port that matters most for any site you run. Search engines, browsers and users all expect it. If you want to run a site that ranks and earns trust, port 443 must be open, and the certificate behind it must be valid.

Port 22: the administrator’s door

SSH is how people manage servers from afar. It is also, unfortunately, one of the most attacked doors on the internet. If you have ever put a server online and checked its logs an hour later, you have seen strangers hammering port 22 with guessed passwords. We will come back to what to do about that.

You can use any port in a URL by writing it after a colon. https://example.com:8443 tells the browser to use 8443 instead of 443. Developers do this constantly, and the reason is a ritual every programmer knows: local test servers run on ports like 3000, 5000, 8000 or 8080, so that they do not clash with the real web ports.

The key idea: a connection is four numbers

Here is the part that clears up the most confusion. When your browser connects to a web server, it uses a port on both sides. The server side is the well-known one (443). Your side is a temporary number the operating system picks from the dynamic range.

A TCP connection is uniquely identified by four values: your IP address, your port, the server’s IP address and the server’s port. Change any one of them and it is a different connection. That is how you can open ten tabs to the same website, all talking to the same server on the same port 443, without the answers colliding. Each tab uses a different source port on your side.

Tab 1my port 52114Tab 2my port 52115Tab 3my port 52116203.0.113.10server port 443 (HTTPS)Same server, same port 443. Each connection differs by the visitor’s port.
Three browser tabs, one server door. The server tells the conversations apart by the visitor’s port numbers.

See it for yourself in about twenty lines of Python

I like proving things in code rather than asking you to believe them. The script below starts a small server, connects to it three times, and prints which ports each side used. Then it tries to start a second server on the same port.

import socket, threading

# 1. A server listens on one port. We let the OS pick a free one (port 0).
server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server.bind(("127.0.0.1", 0))
server.listen()
host, port = server.getsockname()
print("server listening on port", port)

# 2. Three clients connect to that single server port.
def serve():
    for _ in range(3):
        conn, addr = server.accept()
        conn.close()
threading.Thread(target=serve, daemon=True).start()

for n in range(3):
    c = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    c.connect((host, port))
    print(f"client {n+1}: my port {c.getsockname()[1]} -> server port {c.getpeername()[1]}")
    c.close()

# 3. A second server cannot grab the same port.
dup = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
    dup.bind((host, port))
except OSError as e:
    print("second bind failed:", e.strerror)

This is the output from one run on my machine. Your numbers will differ, because the operating system picks them:

server listening on port 54875
client 1: my port 47676 -> server port 54875
client 2: my port 47684 -> server port 54875
client 3: my port 47700 -> server port 54875
second bind failed: Address already in use

Three things are worth noticing. First, the server uses one port, 54875 in this run, for all three clients. Second, each client received a different temporary port of its own. Third, the attempt to bind a second server to the same address and port failed with “Address already in use.” Only one program can listen on a given port at a time, which explains an error that confuses beginners every single week.

The error you will meet one day. “Address already in use” or “port 3000 is already allocated” almost always means a previous copy of your program is still running, or another application owns that port. Find the owner with the commands later in this article, stop it, and try again.

The same idea in five real settings

Click a tab to see ports at work in different places. No reload, nothing to install.

Browsing the web

You type a web address and press enter. You never type a port, yet one is used on every request.

You typehttps://…
Port443
Fallback80
HTTP/3UDP 443

What happens with ports. With no port in the address, the browser assumes 80 for http and 443 for https. A site on port 80 usually just redirects you to 443. Newer browsers may also try HTTP/3, which uses UDP port 443, and fall back to TCP if that fails. If you ever see a site at :8443 or :8080, the owner chose a non-default port.

Logging in to a server

A developer manages a rented server from home. They connect with a secure shell, and their password-guessing visitors do the same.

ServiceSSH
Port22
Commandssh user@host
RiskBrute force

What happens with ports. SSH listens on 22 by default, so every scanner on the internet knocks there. Sensible practice is key-based login, no root login, and a firewall rule that allows 22 only from known addresses. To use another port, you write ssh -p 2222 user@host. It lowers log noise but is not a security measure.

Sending and reading email

Your phone’s mail app needs to send a message and fetch new ones.

Send587 or 465
Server-to-server25
Read993 or 995
Secure?Use TLS

What happens with ports. Mail uses several ports because it has several jobs. Your app submits outgoing mail on 587 (or 465 with immediate TLS). Mail servers pass messages between each other on 25. For reading, IMAP over TLS uses 993 and POP3 over TLS uses 995. Many hosting providers block outgoing port 25 from ordinary customers to cut spam, so a mail setup that works on a laptop may fail on a cloud server.

Databases

A web app stores its data in a database on the same server, or on a neighbouring one.

MySQL3306
PostgreSQL5432
Redis6379
Expose?Rarely

What happens with ports. Databases listen on their own registered ports, and the app connects to them. The golden rule is to bind them to a private address and block them in the firewall, so only the application server can reach them. Unprotected database ports on the public internet are found and attacked within hours, which is why every serious guide says to keep them closed.

Gaming and home servers

You host a game server on your PC so friends can join from their homes.

ExampleMinecraft
Port25565
NeedsForwarding
AlsoPC firewall

What happens with ports. A common Java Minecraft server listens on 25565. Your friends connect to your public IP on that port, but your router drops the unsolicited traffic until you forward public port 25565 to the PC’s private address. Then allow the same port in the PC’s own firewall. Providers that put many homes behind shared addresses can block this entirely, in which case a hosted server or a relay service is the workaround.

How your router uses ports: NAT in plain English

Your home has one public IP address from your internet provider, yet a dozen devices share it. How do replies find the right device? The router performs NAT, network address translation, and ports are the trick that makes it work.

Suppose your phone (192.168.1.20) opens a connection to a web server from its local port 51000. The router rewrites the outgoing packet so it appears to come from the router’s own public address, using its own chosen port, say 40001. It remembers the pairing in a table. When the reply returns to port 40001, it looks it up and forwards the data to the phone at 192.168.1.20 port 51000. Your laptop doing the same thing would get a different public port.

Device (private)Private portRouter (public) portDestination
192.168.1.20 phone5100040001example.com:443
192.168.1.31 laptop5100040002example.com:443
192.168.1.44 TV4950040003video.example.net:443

The numbers in the table are illustrative, since real routers pick their own. Notice that the phone and laptop both used private port 51000 and nothing broke. The router separates them by assigning different public ports.

Port forwarding: the reverse trick

NAT works naturally for connections that start inside your home. Connections that start outside have a problem: the router has no table entry, so it drops them. If you want a friend to join a game server running on your PC, you create a port forwarding rule: “anything arriving on public port 25565 goes to 192.168.1.50, port 25565.” That is exactly what the home-router tab above shows.

Firewalls: deciding which doors are open

A firewall is largely a list of rules about ports. A typical server firewall says: allow incoming 443, allow incoming 22 only from my office, and drop everything else. Because a program can only receive connections if something is listening, closing a port you do not need means that if the software behind it has a flaw, the flaw is unreachable.

When you scan a machine for open ports, there are usually three results:

  • Open. A program is listening and accepted the connection.
  • Closed. The machine is reachable, but nothing listens there, and it politely refuses.
  • Filtered. A firewall dropped the attempt, so you get no answer at all.

The practical rule I teach every junior: every open port is a promise to answer strangers. Keep that list as short as you can.

Commands to see ports on your own machine

GoalCommandNotes
List listening ports (Linux)ss -tulpnShows protocol, port and the program. Needs sudo to see other users’ programs.
List listening ports (Windows)netstat -anoThe last column is the process ID. Match it in Task Manager.
Who owns port 3000? (macOS, Linux)lsof -i :3000Prints the program and its process ID.
Test a remote port (Windows PowerShell)Test-NetConnection host -Port 443Reports whether the TCP connection succeeded.
Test a remote port (Linux, macOS)nc -zv host 443Needs netcat installed.

Tool options vary slightly between systems and versions, so treat these as reliable starting points. Only scan machines you own or have permission to test. Scanning other people’s networks can break rules or laws.

Limits you can actually hit: running out of ports

Because each outgoing connection needs a temporary port, a single client talking to a single server address and port has a ceiling. With Windows’ default dynamic range of 49152 to 65535, that is 16,384 simultaneous connections. With Linux’s common default of 32768 to 60999, it is 28,232. After that, new connections fail until old ones close.

Most users never see this. Busy servers and load balancers do, and the same arithmetic hits NAT gateways that funnel thousands of devices through one public address. When people say a service “ran out of ephemeral ports,” this is what they mean. The usual fixes are reusing connections (keep-alive and connection pooling), widening the range, or adding more addresses.

Security myths about ports

Myth: changing the SSH port makes it secure

Moving SSH from 22 to something obscure reduces noise in your logs because the lazy scanners that probe only port 22 stop finding you. It does not stop a determined scanner, which checks all ports in minutes. Real protection comes from key-based login instead of passwords, disabling root login, keeping software updated, and restricting who may connect at all. Treat a port change as tidiness, not security.

Myth: a closed port means the machine is invisible

A closed port still reveals that the machine exists. Only a firewall that silently drops traffic hides that, and even then the machine can leak information in other ways.

Myth: databases are safe on their default port because nobody knows the number

Everybody knows the number. MySQL on 3306, PostgreSQL on 5432, Redis on 6379 and MongoDB on 27017 are scanned constantly. A database should normally listen only on a private interface, with the firewall blocking public access.

Common mistakes beginners make

  • Confusing the port with the protocol. Port 443 is conventionally HTTPS, but a program can run anything on any port. The convention is not enforced.
  • Forgetting TCP versus UDP. Opening TCP 53 in a firewall does nothing for DNS queries that use UDP 53.
  • Opening a port without checking what listens behind it. You have just exposed that program to the whole internet.
  • Forwarding a port on the router but not opening it on the PC firewall. The traffic arrives and is dropped by the last gate.
  • Assuming a number above 1023 needs no thought. Registered ports can be just as dangerous as well-known ones when they hold a database.
  • Running a second copy of a server and ignoring “Address already in use.” Something already owns that port.

Test yourself

Tap a question to reveal the answer. The correct option is marked.

How many bits is a TCP or UDP port number, and what is the highest port?
  1. 8 bits, 255
  2. 32 bits, 4,294,967,295
  3. 16 bits, 65535
  4. 12 bits, 4095

Sixteen bits give 65,536 values, 0 through 65535.

You type https://example.com with no port. Which port does your browser use?
  1. 80
  2. 443
  3. 22
  4. 8080

The https scheme defaults to 443. Plain http defaults to 80.

Ten browser tabs open connections to the same server on port 443. How does the server tell them apart?
  1. By the website address
  2. By the tab title
  3. It cannot, so they share one connection
  4. By the different source ports on the visitor’s side

A connection is identified by both IP addresses and both ports. Each tab uses its own temporary source port.

Your program fails with “Address already in use” on port 3000. What is the most likely cause?
  1. Another program, maybe an earlier copy of yours, is already listening on 3000
  2. Port 3000 is reserved by IANA
  3. Your internet is down
  4. TCP does not allow ports above 1023

Only one program can listen on a given address and port. Find the owner with lsof, ss or netstat.

Which statement about changing the SSH port from 22 is true?
  1. It makes SSH impossible to attack
  2. It reduces log noise from lazy scanners but is not real security
  3. It is required by law
  4. It disables password logins

A full port scan finds any port in minutes. Real protection is key-based login, updates and firewall rules.

Frequently asked questions

What is a port number in simple words?

A number that tells a computer which program should receive incoming data. The IP address finds the machine, and the port finds the program on it.

What is the difference between port 80 and port 443?

Port 80 is the default for plain HTTP, which is unencrypted. Port 443 is the default for HTTPS, which wraps the same web traffic in TLS encryption. Modern sites use 443 and redirect 80 to it.

Is a port a physical thing?

No. It is just a number in the TCP or UDP header that the operating system uses to route data to the right program. It is not a hardware socket, even though a network cable plug is also sometimes called a port.

Can I use any port I want for my own program?

Yes, within limits. Avoid the well-known range below 1024 for personal projects, since on many systems those need extra privileges, and check that the port is not already used. Ports from about 1024 up are the usual choice for custom apps.

Are open ports dangerous?

An open port is a program accepting connections from the network. It is only as risky as the program behind it and who can reach it. Keep open only what you need, patch the software, and restrict access with a firewall.

What is the difference between TCP and UDP ports?

They are two separate sets of 65,536 numbers. TCP 53 and UDP 53 are different doors. TCP is reliable and ordered, UDP is faster with no guarantees, and some services, like DNS, use both.

Key takeaways

  • A port is a number from 0 to 65535 that tells a computer which program should receive incoming data. An IP address is the building, a port is the apartment.
  • Ports 80 (HTTP), 443 (HTTPS) and 22 (SSH) are conventions that let clients find services without negotiating.
  • A connection is identified by four values: both IP addresses and both port numbers. That is how many tabs share one server port.
  • Only one program can listen on a given port at a time, which causes “Address already in use.”
  • Routers use ports to let many devices share one public address, and port forwarding opens a door from outside.
  • Every open port is a promise to answer strangers. Keep the list short, and never rely on an obscure port number as security.
port numberport 443port 80SSH port 22TCPUDPfirewallport forwarding

The post What Is a Port Number? Why 80, 443 and 22 Matter appeared first on Learn With Examples.

]]>
https://learnwithexamples.org/what-is-a-port-number/feed/ 0 966
What Is DHCP? How Your Device Gets an IP Address Automatically https://learnwithexamples.org/what-is-dhcp/ https://learnwithexamples.org/what-is-dhcp/#respond Tue, 06 Oct 2026 09:44:23 +0000 https://learnwithexamples.org/?p=963 You walk into a café, tap the Wi-Fi name, and within a second the web works. Nobody typed an address, picked a gateway or told your phone where to find…

The post What Is DHCP? How Your Device Gets an IP Address Automatically appeared first on Learn With Examples.

]]>

You walk into a café, tap the Wi-Fi name, and within a second the web works. Nobody typed an address, picked a gateway or told your phone where to find a DNS server. Behind that second sits a short, polite conversation between your phone and a small piece of software called a DHCP server. This article walks through that conversation, step by step, with real examples and a simulation I ran to show what happens when it goes wrong.

The problem DHCP solves

Every device on a network needs an IP address, which is the number other devices use to send it data. If you set one by hand, you have to pick a number nobody else is using, enter the right subnet mask, the right gateway, and at least one DNS server. Get one digit wrong and the device either cannot talk to anyone or, worse, collides with another device and knocks it offline.

I have done this by hand on more machines than I care to count, back when a small office meant a spreadsheet of addresses taped inside the server cabinet. It works for ten machines. It collapses at a hundred, and it is hopeless for phones that join and leave a network several times a day.

The fix is DHCP, the Dynamic Host Configuration Protocol. A DHCP server owns a range of addresses and a set of settings. Any device that joins the network asks for them, receives a loan of one address, and uses it until the loan runs out. The key word is loan, and it explains almost everything else in this article.

The one-paragraph version. DHCP automatically gives a device an IP address and the other settings it needs (subnet mask, default gateway, DNS servers) when it joins a network. The exchange has four messages, nicknamed DORA: Discover, Offer, Request, Acknowledge. The address is leased for a limited time, and the device renews it before it expires. At home, your router is the DHCP server.

An everyday analogy: the hotel front desk

Picture a hotel with fifty rooms. You arrive with a suitcase and no room number. You do not walk the corridors trying doors. You go to the front desk, and the clerk checks which rooms are free, assigns you one, and hands over a key card that works until checkout. If you stay longer, you stop by the desk and extend it. If you leave without telling anyone, the key card simply stops working at checkout time and the room goes back into the pool.

Map it across: the hotel is the network, the rooms are IP addresses, the guest is your device, and the clerk is the DHCP server. The checkout time is the lease. That last detail matters more than it looks, and we will see why when the café runs out of rooms.

What exactly does a DHCP server hand out?

An IP address is only the headline. A device usually receives a small bundle of settings, delivered as numbered “options” inside the DHCP messages.

SettingExampleWhat it is for
IP address192.168.1.134Your device’s identity on this network.
Subnet mask255.255.255.0Tells the device which addresses are on the same local network.
Default gateway192.168.1.1The router that carries traffic out to the internet.
DNS servers192.168.1.1Where to look up names like example.com. At home, this is often the router itself, which forwards on.
Lease time24 hoursHow long the device may keep this address before renewing.

The ordinary home values above are only an example. Many routers use 192.168.0.x or 10.0.0.x instead, and lease times vary by manufacturer and by network. There are many more options (a domain name, time servers, boot file locations for network booting), but these five are the ones you will see in daily life.

The big question: how can you ask for an address when you have none?

Here is the puzzle that makes DHCP clever. Your phone has just joined the Wi-Fi. It has no IP address, no idea what the network looks like, and no idea where the DHCP server is. How do you send a message to someone you cannot address?

The answer is broadcast. The phone sends its first message from the address 0.0.0.0 (“I am nobody yet”) to 255.255.255.255 (“everybody on this local network”). It does not know who the server is, so it shouts to the whole room. Every device on the local network hears it, but only a DHCP server answers. DHCP runs over UDP, with clients using port 68 and servers using port 67.

DORA: the four-message conversation

Network engineers use the nickname DORA for the four steps. Here is the whole exchange.

CLIENTDHCP SERVER1 DISCOVERBroadcast: anyone have an address for me?2 OFFERServer: how about 192.168.1.134?3 REQUESTBroadcast: yes, I accept that offer4 ACKNOWLEDGEServer: confirmed, lease starts nowClient uses 0.0.0.0 until step 4. Client port 68, server port 67 (UDP).
The four DHCP messages. The first two are broadcast because the client has no address yet.

1. Discover

The client broadcasts: “Is there a DHCP server out there? I need an address.” The message carries the client’s hardware (MAC) address so the server knows who is asking.

2. Offer

A DHCP server picks a free address from its pool and replies: “I can lend you 192.168.1.134, with this mask, this gateway, these DNS servers, for 24 hours.” Notice it is an offer, not a grant. The address is held aside for the client, but the deal is not done.

3. Request

The client says: “Yes, I would like that address from that server.” This message is still broadcast, and that is deliberate. If two DHCP servers both made offers, the broadcast tells every server which offer the client accepted, so the others can release the address they had reserved.

4. Acknowledge

The server confirms: “It is yours.” Only now does the client configure its network interface with the address. The conversation takes a fraction of a second on a healthy network.

If you remember one thing: Discover and Request come from the client, Offer and Acknowledge come from the server. A common exam and interview trap is mixing up Offer (a proposal) with Acknowledge (the final confirmation).

The lease: an address is borrowed, not owned

When the server says “24 hours,” the clock starts. The client does not wait until the last second. It follows two timers defined in the DHCP standard (RFC 2131):

  • T1, the renewal time, defaults to 50 percent of the lease. The client quietly asks the same server, directly, to extend the lease.
  • T2, the rebinding time, defaults to 87.5 percent of the lease. If the original server has not answered, the client now broadcasts, asking any DHCP server to extend.
  • Expiry at 100 percent. If no server has answered, the client must stop using the address and start over with Discover.
Using the addressRenewing with the same serverAny server0 hLease granted12 hT1 renew (50%)21 hT2 rebind (87.5%)24 hExpiresLifetime of a 24-hour DHCP leaseRenewal success resets the clock. Failure at 24 h means the client must start over with Discover.
A 24-hour lease. Renewal is tried at 12 hours, rebinding at 21 hours, and the address must be given up at 24 hours.

On a normal network, renewal succeeds at the 12-hour mark and the lease clock resets. Your laptop can keep the same address for months without you noticing. The lease exists for the opposite case: devices that vanish. A phone that walks out of range never says goodbye, so the server needs a way to reclaim its address. That is what expiry does.

Let us build a tiny DHCP pool

Reading about leases is one thing. Seeing one is better. Here is a small address pool in Python that hands out addresses, renews them and reclaims expired ones. It is not a real DHCP server (there are no network packets), but it implements the same bookkeeping that real servers do.

import ipaddress
from collections import deque

class DhcpPool:
    """A tiny DHCP address pool: hand out, renew and reclaim leases."""
    def __init__(self, first, last, lease_seconds):
        a = int(ipaddress.IPv4Address(first))
        b = int(ipaddress.IPv4Address(last))
        self.free = deque(str(ipaddress.IPv4Address(i)) for i in range(a, b + 1))
        self.lease = lease_seconds
        self.leases = {}                     # mac -> (ip, expires_at)

    def reclaim(self, now):
        for mac, (ip, exp) in list(self.leases.items()):
            if exp <= now:
                del self.leases[mac]
                self.free.append(ip)         # reused last, like many servers

    def request(self, mac, now):
        self.reclaim(now)
        if mac in self.leases:               # renewal: same address, fresh clock
            ip = self.leases[mac][0]
        elif self.free:
            ip = self.free.popleft()
        else:
            return None                      # pool exhausted
        self.leases[mac] = (ip, now + self.lease)
        return ip

def timers(lease_seconds):
    """RFC 2131 defaults: renew at 50 percent, rebind at 87.5 percent."""
    return lease_seconds * 0.5, lease_seconds * 0.875

# demo
pool = DhcpPool("192.168.1.100", "192.168.1.102", lease_seconds=3600)
print("phone  ->", pool.request("aa:aa", 0))
print("laptop ->", pool.request("bb:bb", 10))
print("tv     ->", pool.request("cc:cc", 20))
print("tablet ->", pool.request("dd:dd", 30), "(pool is empty)")
print("phone renews at 1800s ->", pool.request("aa:aa", 1800))
print("tablet at 3700s ->", pool.request("dd:dd", 3700), "(laptop and tv expired)")
t1, t2 = timers(86400)
print("24h lease: renew at %.0fh, rebind at %.1fh" % (t1/3600, t2/3600))

Running it with a pool of only three addresses and a one-hour lease produces this:

phone  -> 192.168.1.100
laptop -> 192.168.1.101
tv     -> 192.168.1.102
tablet -> None (pool is empty)
phone renews at 1800s -> 192.168.1.100
tablet at 3700s -> 192.168.1.101 (laptop and tv expired)
24h lease: renew at 12h, rebind at 21.0h

Read it line by line. The first three devices get consecutive addresses. The tablet asks while the pool is empty and gets nothing, which is exactly what a real device experiences when a network runs out of addresses. The phone renews at the half-hour mark and keeps the same address. By 3,700 seconds, the laptop and TV leases have expired without anyone releasing them, so the tablet finally gets the laptop’s old address.

When the hotel runs out of rooms: a café simulation

Lease length sounds like a boring setting until you see it break something. So I simulated a café with Wi-Fi. About one new customer device joins every minute, stays for roughly half an hour on average, and leaves without telling the network. The DHCP pool has 100 addresses. I ran ten hours of café time, repeated twenty times with different random seeds, and varied only the lease length. Devices renew at the 50 percent mark while they are present, just like real ones.

Lease timePeak addresses in useDevices that could not get an address
10 min54 of 1000.0%
30 min71 of 1000.0%
1 hour95 of 1000.2%
4 hours100 of 10051.3%
24 hours100 of 10083.3%
0%25%50%75%100%0.0%10 min0.0%30 min0.2%1 hour51.3%4 hours83.3%24 hoursLease length (pool of 100 addresses, ten-hour café day, average of 20 runs)
Share of arriving devices that found the pool empty, by lease length. Same café, same crowd, same pool size.

The shape of the result is the lesson. With a 10 or 30-minute lease, nobody was turned away. At one hour, a handful of devices failed during the busiest moments. At four hours, about half of all arriving devices found no free address, and at 24 hours more than four out of five did. The crowd was identical in every run. The only difference was how long departed devices kept their addresses reserved.

The figures come from a simplified model: random arrivals, a random stay time and no early release. Real cafés have more variety, and the exact percentages will differ. The pattern will not. A short lease is the right tool for a transient crowd, and a long lease is the right tool for a stable one. Home and office networks, where the same devices come back every day, can use long leases comfortably. Hotels, airports, conferences and cafés should use short ones.

The same idea in five real settings

Click a tab to see DHCP in different places. Nothing to install and no page reload.

Home router

You buy a Wi-Fi router, plug it in and connect your phone, TV, laptop and a smart speaker. You never touch an address setting.

ServerYour router
Pool~100 addresses
LeaseOften 24 h
DNSRouter or ISP

How DHCP fits. The router runs a DHCP server by default, usually with a pool such as 192.168.1.100 to 192.168.1.199 (the exact range differs by brand). Long leases suit a home, because the same dozen devices come back every day. Look in the router’s admin page for a “connected devices” or “DHCP clients” list and you will see the leases.

Café or airport Wi-Fi

Hundreds of strangers pass through, most staying under an hour. Phones leave without any goodbye.

CrowdConstantly changing
LeaseMinutes to 1 h
PoolLarge
RiskPool runs dry

How DHCP fits. This is the café from our simulation. Public networks use short leases and wide pools so addresses of departed devices return quickly. Many also use much larger private ranges than a home network, because a /24 holds only 254 addresses.

Office with several networks

A company separates staff, guests, phones and printers into different networks for security and tidiness.

ServersOne central
RelayIP helper
ScopesOne per network
ExtrasReservations

How DHCP fits. Each network gets its own pool, called a scope, on one central DHCP server. Routers forward the broadcasts through a relay agent. Managers also add reservations for fixed gear and exclusion ranges so the pool never touches addresses set by hand.

Your ISP connection

Your home router does not come with an internet-facing address built in. It has to get one from your internet provider.

ClientYour router
ServerISP equipment
GetsWAN address
ChangesSometimes

How DHCP fits. On many cable and fibre connections, your router is itself a DHCP client on the provider’s side. It broadcasts a request, and the provider’s server leases it a public address. That is why a home address can change after a long outage. Other providers use different methods, such as PPPoE, so this varies by ISP.

Printer or NAS reservation

Your family prints from five devices. The printer is found by address, and every few weeks one laptop loses it.

DevicePrinter, NAS
Matched byMAC address
ResultFixed address
Set inDHCP server

How DHCP fits. A reservation tells the DHCP server: whenever this MAC address asks, always give it this address. The printer still uses DHCP, so nothing is typed on the device itself, but its address never moves. It is the tidiest way to get a stable address without hand-configuring anything.

Dynamic, static and reserved: three ways to get an address

DHCP is not all-or-nothing. Most real networks mix three approaches.

MethodHow the address is setBest forWatch out for
Dynamic DHCPServer picks any free address from the pool.Phones, laptops, guests, most devices.The address can change after a long absence.
DHCP reservationServer always gives the same address to a specific MAC address.Printers, NAS boxes, cameras, servers.Changing the network card changes the MAC, which breaks the match.
Static (manual)You type the address on the device itself.Routers, core infrastructure, bootstrapping.You must avoid the DHCP pool range or you risk conflicts.

My own rule after fifteen-odd years: configure a reservation on the DHCP server rather than a static address on the device whenever you can. All the addressing then lives in one place, and you can see and change it from the server. Static addresses scattered across devices are how networks accumulate mysteries.

What happens when DHCP fails?

If a device sends Discover and nobody answers, it does not give up silently. Modern operating systems fall back to a link-local address in the range 169.254.0.0 to 169.254.255.255 (defined in RFC 3927, and called APIPA on Windows). The device picks one at random in that range and checks that nobody else is using it.

That fallback only lets the device talk to other link-local devices on the same local network. There is no gateway, so there is no internet. If you ever open your network settings and see an address starting with 169.254, read it as a message: “I asked for an address, and nobody gave me one.”

Quick diagnosis. An address starting with 169.254 means DHCP did not respond. Check that the router is on, that you are on the right network, and that the DHCP service is enabled. Do not waste time hunting for DNS or website problems yet. You do not even have a valid address.

Commands you can run yourself

Seeing the lease on your own machine makes this concrete. The commands vary a little by operating system.

GoalWindowsLinux or macOS
See your current address and DHCP serveripconfig /allip addr (Linux), ipconfig getpacket en0 (macOS)
Give up the current leaseipconfig /releaseToggle the network interface off, or use your network manager’s reconnect option.
Ask for a new leaseipconfig /renewToggle the interface back on, or reconnect.

On Windows, ipconfig /all prints a “DHCP Server” line plus “Lease Obtained” and “Lease Expires” times. That is the lease we have been discussing, sitting right there on your screen. The macOS interface name (en0 here) can differ between machines, and Linux tools differ between distributions, so treat these as starting points.

Beyond one subnet: relay agents

There is an obvious catch with broadcasts. Routers do not forward them, so a DHCP broadcast stays inside its own local network. In a company with separate networks for staff, guests and printers, would you need a DHCP server in every one?

No. The trick is a DHCP relay agent, usually a setting on the router (often called “IP helper”). It listens for broadcasts on one network, wraps them in a unicast message and forwards them to a central DHCP server. The relay stamps in the address of the network the request came from, so the server knows which pool to use. One central server can then serve dozens of separate networks, each with its own address range.

Routerrelay agentStaff network10.1.0.0/24Guest network10.2.0.0/24Printer network10.3.0.0/24DHCP serverone central serverunicastBroadcasts stop at the router, so it forwards them to the server.The server picks the pool that matches the network each request came from.
A relay agent carries broadcasts from separate networks to one central DHCP server.

IPv6 and DHCPv6, briefly

Everything above is DHCP for IPv4. IPv6 networks have another automatic option called SLAAC (stateless address autoconfiguration), where a device builds its own address from information advertised by the router. DHCPv6 also exists, and networks use it when they want central control over addresses or need to pass out extra settings. The two are not rivals so much as tools, and many networks use them together. The details deserve their own article.

Security: DHCP trusts everyone

DHCP was designed for a friendlier era. A client believes the first offer it likes, with no authentication. That creates two classic problems.

Rogue DHCP servers

Someone plugs in a router, or a misconfigured device starts running a DHCP service. Clients that hear its offer first accept it, and now they receive a wrong gateway or a malicious DNS server. At best, people lose internet access and nobody can explain why. At worst, traffic is redirected through an attacker. The defence on managed switches is DHCP snooping, which only allows DHCP server messages from ports marked as trusted.

Address starvation

An attacker, or a buggy device, sends a flood of requests with fake MAC addresses until the pool is empty and real users get nothing. Switch features that limit the number of MAC addresses per port, and short leases on guest networks, reduce the damage.

Common problems and how I debug them

  • Two DHCP servers on one network. A very common home mistake is plugging a second router into the first one with its DHCP still enabled. Devices randomly get settings from either, and some end up with the wrong gateway. Turn off DHCP on one of them.
  • The 169.254 address. No reply from any server. Check cabling, Wi-Fi network, and whether the DHCP service is running.
  • Duplicate address warnings. A device with a manually typed address inside the DHCP pool range. Move the static address outside the pool, or create a reservation instead.
  • Pool exhaustion. Leases too long for the crowd, or the pool simply too small. Widen the range or shorten the lease, as in the café simulation.
  • The printer keeps “disappearing.” It got a new address after a long power-off. Give it a reservation.
  • Everything works by IP but not by name. The DHCP server handed out a bad DNS setting. Check the DNS option in the lease, not the website.

Common mistakes beginners make

  • Thinking DHCP and DNS are the same thing. DHCP assigns addresses. DNS translates names into addresses. DHCP merely tells you which DNS server to use.
  • Assuming a DHCP address is permanent. It is a lease. It often stays the same in practice, but nothing guarantees it.
  • Setting a static address inside the DHCP pool. The server may hand the same address to someone else.
  • Forgetting to exclude the router. The gateway itself should sit outside the dynamic range, typically at the start of the subnet.
  • Using a 24-hour lease on a public Wi-Fi network. You now know how that ends.

Test yourself

Tap a question to reveal the answer. The correct option is marked.

What are the four DHCP messages, in order?
  1. Request, Offer, Discover, Acknowledge
  2. Discover, Offer, Request, Acknowledge
  3. Discover, Request, Offer, Acknowledge
  4. Offer, Discover, Acknowledge, Request

Remember DORA: Discover and Request come from the client, Offer and Acknowledge from the server.

Why is the first DHCP message sent as a broadcast?
  1. Broadcasts are encrypted
  2. DHCP only works over TCP
  3. The client has no address and does not know where the server is
  4. Routers require it

With no address and no knowledge of the server, the client shouts to everyone on the local network and lets the server answer.

A lease is 8 hours. When does the client first try to renew, using the default timers?
  1. After 4 hours
  2. After 6 hours
  3. After 7 hours
  4. Only at 8 hours

T1 is 50 percent of the lease, so renewal begins at 4 hours. T2, the broadcast rebind, comes at 87.5 percent, or 7 hours.

Your laptop shows the address 169.254.37.12 and has no internet. What most likely happened?
  1. DNS is down
  2. The website is blocked
  3. The router is overheating
  4. No DHCP server answered, so it gave itself a link-local address

169.254.x.x is the link-local fallback used when DHCP does not respond. It allows only local-network chatter.

Which is the best way to give a network printer a stable address while managing everything centrally?
  1. A static address inside the DHCP pool
  2. A DHCP reservation tied to its MAC address
  3. A very short lease
  4. Turning DHCP off for the whole network

A reservation keeps the printer on DHCP but always gives it the same address, with no conflict risk and no manual typing on the device.

Frequently asked questions

What does DHCP stand for?

Dynamic Host Configuration Protocol. It automatically configures devices with an IP address and related network settings.

Is DHCP the same as DNS?

No. DHCP gives a device its address and tells it which DNS server to use. DNS is the separate service that turns names like example.com into addresses.

Will my device keep the same IP address?

Often yes in practice, because a returning device usually gets its old address back if it is still free. But a lease is not a guarantee. For a fixed address, use a DHCP reservation.

Where is the DHCP server on my home network?

In almost every case, it is your router. Some networks use a separate server or a dedicated device, and a home setup can have only one active DHCP server safely.

What happens if two DHCP servers are on one network?

Clients take whichever offer reaches them first, so devices get inconsistent settings, such as different gateways, and failures look random. Disable DHCP on one of the devices.

Should I use static IPs or DHCP?

Use DHCP for most devices. For devices that need a fixed address, prefer a DHCP reservation. Use true static addressing mainly for the router itself and a few core pieces of infrastructure, keeping those addresses outside the DHCP pool.

Key takeaways

  • DHCP automatically gives a device an IP address, subnet mask, gateway and DNS servers when it joins a network.
  • The four-step conversation is Discover, Offer, Request, Acknowledge. The first two are broadcast because the client has no address yet.
  • An address is a lease, not a gift. Clients renew at 50 percent of the lease and rebind at 87.5 percent.
  • Lease length should match the crowd. In my café simulation, a 30-minute lease turned nobody away, while a 24-hour lease turned away more than four in five devices.
  • Use reservations for printers and servers, keep static addresses outside the pool, and treat any 169.254 address as “DHCP did not answer.”
  • Relay agents let one server serve many networks, and DHCP snooping protects against rogue servers.
DHCPIP addressnetworking basicsDORADHCP leaserouterPython

The post What Is DHCP? How Your Device Gets an IP Address Automatically appeared first on Learn With Examples.

]]>
https://learnwithexamples.org/what-is-dhcp/feed/ 0 963
Heap vs Sorted Array for Priority Handling https://learnwithexamples.org/heap-vs-sorted-array-for-priority-handling/ https://learnwithexamples.org/heap-vs-sorted-array-for-priority-handling/#respond Mon, 05 Oct 2026 08:47:42 +0000 https://learnwithexamples.org/?p=960 Data structures · Priority queues · Performance An emergency room does not treat patients in the order they walk in. A nurse looks at each person and the sickest one…

The post Heap vs Sorted Array for Priority Handling appeared first on Learn With Examples.

]]>
Data structures · Priority queues · Performance

An emergency room does not treat patients in the order they walk in. A nurse looks at each person and the sickest one goes first. Software has the same problem everywhere: tasks, packets, alerts and routes all arrive with different levels of urgency, and something has to hand you the most urgent one, fast. There are two classic ways to build that. One keeps everything sorted. The other keeps everything “sorted enough.” This article shows you, with real numbers, when each one wins.

The problem: always give me the most urgent thing

I have been writing and reviewing code for a little over fifteen years, and the same question comes back every couple of years in a new costume. A job scheduler needs the next job to run. A game server needs the next event to fire. A routing service needs the next closest intersection. Different industries, same shape: items arrive in any order, each carries a priority, and at any moment somebody asks for the single most important item.

The abstract name for this is a priority queue. It is a queue where the order of leaving is decided by priority, not by arrival. You need exactly three operations, and almost nothing else.

The one-paragraph version. A sorted array keeps every item in order, so the most urgent one is always at the end and you can grab it instantly, but every insertion has to shove other items aside, which costs O(n). A binary heap keeps only a loose order: the most urgent item is at the top, and each insertion or removal fixes things with about log n small swaps. For small or read-heavy data the sorted array is perfectly fine. For large collections with constant inserting and removing, the heap wins by a wide margin.

The three operations that matter

  • insert(item, priority) adds a new item.
  • peek() shows the most urgent item without removing it.
  • extract() removes and returns the most urgent item.

That is the whole contract. How you store the items behind the scenes is your business, and the storage choice decides how fast each of those three runs. In this article, “most urgent” is just whichever end of the ordering you care about. Python’s standard library treats the smallest number as most urgent, so I will use that convention for the heap. For the sorted array I will keep the list in ascending order and call the highest number most urgent, which keeps removal cheap. The two structures can be flipped either way, and the cost is the same.

Where priority handling shows up in real life

Before we compare structures, it helps to see how often this pattern appears. Here are the ones I run into most.

  • Hospital triage. A broken wrist waits, chest pain does not.
  • Task and job schedulers. Run the highest-priority job whose time has come.
  • Shortest-path routing. Dijkstra’s algorithm repeatedly asks for the closest unvisited place.
  • Top-K tracking. Keep the ten best scores out of a stream of millions.
  • Event simulation and timers. Always fire the event with the earliest timestamp next.
  • Merging sorted logs. Pull the smallest head item from many sorted files.

We will return to each of these in the interactive panel later. For now, hold on to the hospital, because it makes the data-structure question concrete.

Why a plain queue or an unsorted list is not enough

Start with the two ideas everybody tries first.

Attempt 1: a normal queue

A normal queue serves first come, first served. That is fair at a bakery and a disaster at a hospital. The chest-pain patient who arrived last would wait behind everyone with a sprained ankle. A plain queue ignores priority entirely, so it cannot be the answer.

Attempt 2: an unsorted list

Throw items into a list in any order. Insertion is instant, you just append. But to find the most urgent item you have to scan the whole list, which costs O(n). With ten items that is nothing. With a million items and a million requests, you are doing about a trillion comparisons. The unsorted list moves all the cost to the extraction side.

So the real design question is where to spend your effort: at insertion time, at extraction time, or a little at each. That is exactly the difference between our two contenders.

Contender one: the sorted array

The idea is simple enough to explain to anyone. Keep the array sorted at all times. If the most urgent item is at one end, extraction is trivial. If you keep the array ascending and treat the largest as most urgent, the best item sits at the last position, and removing the last element of an array costs O(1). Peeking costs O(1) too.

Insertion is where you pay. To add a new item, you first find where it belongs. Because the array is sorted, you can use binary search and find the spot in O(log n) comparisons. That part is cheap. The expensive part is that everything after that spot has to slide one position to the right to make room. On average that is half the array.

Before: insert 51347912binary search: slot is hereAfter134579127, 9 and 12 each slid one place right (3 shifts)
Inserting 5 into a sorted array. Finding the slot is quick; moving 7, 9 and 12 aside is the real work.

Here is the whole thing in Python. It uses the bisect module, which does the binary search and the insertion for you.

from bisect import insort

class SortedPQ:
    """Highest number = most urgent. Kept in ascending order,
    so the most urgent item is always at the end of the list."""
    def __init__(self):
        self.a = []

    def push(self, x):
        insort(self.a, x)                 # binary search + shift: O(n)

    def pop(self):
        return self.a.pop()               # remove from the end: O(1)

    def peek(self):
        return self.a[-1]

That is nearly all of it. The simplicity is a real virtue, and I do not want to understate it. A sorted array is cache-friendly, easy to debug, easy to print, and the memory move that does the shifting is one of the most heavily optimised operations a computer knows. We will come back to that, because it changes the verdict for small data.

Contender two: the binary heap

A heap makes a different bargain. It refuses to keep everything sorted. It only promises one thing: every parent is at least as urgent as its children. That single rule guarantees the most urgent item is at the top, and it is much cheaper to maintain than a full ordering.

The clever part is how it is stored. A heap is conceptually a tree, but it lives in a plain array with no pointers at all. The tree is kept complete, filled level by level from left to right, so the position of every relative is just arithmetic:

  • The parent of index i is at (i - 1) // 2.
  • The children of index i are at 2i + 1 and 2i + 2.
  • The root, the most urgent item, is at index 0.

Here is what happens if you insert 5, 3, 8, 1, 9 and 2 into a min-heap, one at a time. The array and the tree below are the same data seen two ways.

132598root = most urgentSAME HEAP STORED AS AN ARRAY1[0]3[1]2[2]5[3]9[4]8[5]parent of i = (i-1)//2 children = 2i+1 and 2i+2
One min-heap, drawn as a tree and stored as an array. Every parent is smaller than its children, but siblings are in no particular order.

Notice that the array [1, 3, 2, 5, 9, 8] is not sorted. The 3 sits before the 2. A heap does not care. It only cares that the 1 at the top is the smallest and that each parent beats its children.

Inserting: sift up

To add an item, append it at the end of the array, which is the next free slot in the tree. Then compare it with its parent. If it is more urgent, swap them. Repeat until it is in a good place or reaches the root. The tree has about log₂(n) levels, so you do at most that many swaps. A million items means roughly twenty levels, not a million moves.

Removing: sift down

The top item is the one you want. Take it out, which leaves a hole at the root. Fill the hole by moving the last array element to the root, then let it sink: compare it with its two children, swap with the more urgent child, and repeat. Again at most about log₂(n) swaps.

1. Start1325982. Last goes to root832593. Swap with smaller child23859Popped value: 1. Result: [2, 3, 8, 5, 9]
Popping the minimum. The last element (8) jumps to the root, then swaps with its smaller child (2). Two steps and the heap rule holds again.

The full implementation is short enough to read in one sitting. I wrote it by hand so you can see the mechanics, though in real projects you would reach for a library.

class MinHeap:
    def __init__(self):
        self.a = []                       # the heap lives in a plain list

    def push(self, x):
        a = self.a
        a.append(x)                       # 1. put it at the end
        i = len(a) - 1
        while i > 0:                      # 2. sift up while smaller than parent
            parent = (i - 1) // 2
            if a[i] >= a[parent]:
                break
            a[i], a[parent] = a[parent], a[i]
            i = parent

    def pop(self):
        a = self.a
        top = a[0]
        last = a.pop()                    # 1. remove the last item
        if a:
            a[0] = last                   # 2. move it to the root
            i, n = 0, len(a)
            while True:                   # 3. sift down
                left, right, small = 2 * i + 1, 2 * i + 2, i
                if left < n and a[left] < a[small]:
                    small = left
                if right < n and a[right] < a[small]:
                    small = right
                if small == i:
                    break
                a[i], a[small] = a[small], a[i]
                i = small
        return top

    def peek(self):
        return self.a[0]

Python ships the same idea in the heapq module, which operates on an ordinary list. Here it is running a small emergency-room queue, where a lower number means a sicker patient.

import heapq
from itertools import count

queue, tie = [], count()                  # tie-breaker keeps arrival order

def add(priority, name):
    heapq.heappush(queue, (priority, next(tie), name))

add(3, "Ana")
add(5, "Ben")
add(2, "Chi")
add(2, "Dev")
add(1, "Eli")

while queue:
    priority, _, name = heapq.heappop(queue)
    print(priority, name)

The output is, in order: Eli (1), Chi (2), Dev (2), Ana (3), Ben (5). Chi and Dev share priority 2 and come out in the order they arrived, thanks to the little counter in the tuple. That detail matters in production, and I will say more about it in the pitfalls section.

The complexity table

Here is how the common ways of building a priority queue compare. N is the number of items stored.

StructureInsertPeekExtractNotes
Unsorted arrayO(1)O(n)O(n)Cheap to fill, slow to query.
Sorted arrayO(n)O(1)O(1)Binary search finds the slot in O(log n), shifting costs O(n).
Sorted linked listO(n)O(1)O(1)No shifting, but finding the slot is a linear walk.
Binary heapO(log n)O(1)O(log n)Building a heap from n items at once takes only O(n).

Read the table by asking which column your program hammers. If you insert once and then extract a million times, the sorted array looks great. If you interleave inserts and extracts all day, the heap’s O(log n) on both sides is the safer bet.

Counting the actual work

Big-O is a promise about growth, not a stopwatch. So I measured. In the experiment below, I generated n random priorities, inserted all of them, and then extracted everything. Instead of timing, I first counted the elementary moves, because counts are the same on every machine.

n itemsSorted array: elements shiftedHeap: swaps while insertingHeap: swaps while extracting
1,000254,9691,1837,343
10,00024,856,19412,840106,757
100,0002,509,367,779127,3391,400,573
10^310^410^510^610^710^810^910^10254,9698,526n = 1,00024,856,194119,597n = 10,0002,509,367,7791,527,912n = 100,000Sorted array shiftsHeap swaps (insert + extract)
Total moves on a logarithmic scale. Each gridline is ten times bigger than the last, so the real gap is far wider than it looks.

At a hundred thousand items, the sorted array shuffled about 2.5 billion elements while the heap made around 1.5 million swaps. That is a gap of roughly 1,600 times. Notice how the sorted array’s cost grows about a hundredfold every time n grows tenfold. That is the quadratic growth you would expect from n inserts that each cost O(n). The heap’s cost grows only a little faster than n itself.

Now the stopwatch, and an honest surprise

Counts are tidy, but you pay in seconds. I timed the same insert-everything-then-extract-everything test using the sorted array above against Python’s heapq. Timings depend on the machine, so treat the shape as the lesson and not the exact digits.

n itemsSorted arrayheapqVerdict
1,0000.31 ms0.20 msHeap 1.6x faster
10,00011.92 ms2.75 msHeap 4.3x faster
100,0001.031 s40.42 msHeap 25.5x faster

The gap opens exactly as theory says. At 100,000 items the sorted array needed about a second and the heap about 0.04 seconds. But look at the small end. At a thousand items both finish in well under a millisecond, and that points to something that surprises many people.

The reason is that shifting elements in a Python list is not a Python loop. It is a single memory-move operation written in C, and modern processors copy contiguous memory astonishingly fast. A heap, on the other hand, does a lot of small comparisons and swaps with a fair amount of overhead per step. When n is small, a very fast O(n) move can beat a slower O(log n) procedure.

To test this properly I ran a second experiment that looks more like a real service: a queue that stays at a steady size while 50,000 insert-then-extract pairs flow through it.

Queue sizeSorted arrayheapqVerdict
1007.79 ms8.95 msAbout equal
1,0009.76 ms11.98 msSorted array 1.2x faster
10,00052.10 ms24.04 msHeap 2.2x faster
100,0000.787 s27.92 msHeap 28.2x faster

This is the part I most want you to take away. For queues holding a hundred or a thousand items, the sorted array was actually a little faster in my run. By ten thousand items the heap was already about twice as fast, and at a hundred thousand it was nearly thirty times faster. The crossover point depends on your language and hardware, but it is real, and it is usually somewhere in the low thousands.

The veteran’s lesson. Complexity tells you what happens as data grows. It does not tell you where the crossover is. When your queue is small and will stay small, the simplest structure that works is often the right call. When it can grow without a ceiling, choose the one that scales.

The same idea in five real settings

Click a tab below to see how priority handling looks in different places. No page reload, nothing to install.

ER triage

Patients arrive all night. A nurse assigns each a severity score, and when a bed opens, the sickest person goes in next.

PrioritySeverity
InsertArrival
ExtractNext patient
TiesBy arrival

Why a heap fits. Interleaved arrivals and calls for the next patient are exactly a heap workload. The tie-breaker matters: two patients with equal severity should be seen in arrival order, which is why the counter sits inside the tuple.

Task scheduler

A background system receives jobs: send email, resize image, rebuild index. Each has a priority or a due time, and a worker asks for the next job to run.

PriorityRun time or rank
InsertNew job
ExtractNext job
ScaleThousands

Why a heap fits. Queues like this can grow long during a traffic spike, and a heap keeps each insert and extract at O(log n) even then. Many job and timer queues are built on heaps for that reason, though the exact structure varies by system.

Dijkstra routing

A map app finds the fastest route. It keeps a frontier of places it could visit next and always expands the closest one first.

PriorityDistance
InsertNew route
ExtractClosest node
Cost(V+E) log V

Why a heap fits. Dijkstra’s algorithm calls extract-min once per node and pushes whenever it finds a shorter path. With a binary heap the total is about O((V + E) log V). Since a heap has no cheap decrease-key, implementations push a duplicate entry and skip the stale one later, the lazy deletion trick from the pitfalls section.

Top-K stream

You scan a stream of millions of game scores and want only the top ten.

Heap sizeK
KeepsK best
CostO(n log k)
Heap typeMin-heap

Why a heap fits. Keep a min-heap of size 10. For each new score, if it beats the smallest of the ten, replace it. The heap never grows past K, so each step costs only O(log K). A sorted array of size 10 would also be fine here, because K is tiny, which is the small-n rule in action.

Merge sorted logs

Twenty servers each write a log already sorted by time. You want one combined, time-ordered log.

Inputsk sorted files
Heap holdsk heads
ExtractEarliest line
Toolheapq.merge

Why a heap fits. Keep a heap holding the current first line of each file. Pop the earliest, write it, and push that file’s next line. The heap never exceeds k items, and Python’s heapq.merge does exactly this lazily, so you can merge files far bigger than memory.

How to choose: a decision table

Your situationBetter pickWhy
Small queue, a few hundred itemsSorted arraySimple, and the fast memory move beats heap overhead at this size.
Fill once, then mostly readSorted arrayYou pay for sorting once and then read in O(1) forever.
You need a full sorted view, ranks or range queriesSorted arrayA heap cannot answer “what is the 5th item?” or list everything in order without extracting it all.
You need both the best and the worst itemSorted arrayBoth ends are directly reachable. A single heap only exposes one end.
Constant mixed inserts and extracts, large nHeapO(log n) on both operations keeps latency predictable.
Queue can grow to hundreds of thousandsHeapThe sorted array’s shifting cost becomes the bottleneck.
Dijkstra, schedulers, event loopsHeapThe textbook workload for a heap: many inserts, many extract-min calls.
Top-K from a huge streamHeapA heap of size K discards the rest cheaply.

Building a heap in one go: heapify

There is a trick worth knowing. If you already have all n items, you do not need to insert them one by one, which would cost O(n log n). Python’s heapq.heapify(list) rearranges the list in place into a valid heap in O(n) time. It works by sifting down every non-leaf node, starting from the bottom, and the maths happens to add up to linear time because most nodes sit near the bottom where there is almost nothing to sift.

The practical rule: when you have the data up front, heapify. When it arrives over time, push one at a time. And if you are going to sort everything anyway, a plain sort is simpler still.

Pitfalls I have seen in production

1. Python’s heapq is a min-heap only

If you want the largest item first, negate the priorities when you push and negate them again when you pop. Forgetting this is a classic source of “why is my queue upside down?” bugs. Java’s PriorityQueue is also a min-heap by default, while C++’s std::priority_queue is a max-heap by default. The defaults differ across languages, so check before you trust.

2. Equal priorities have no guaranteed order

A heap is not stable. Two items with the same priority can come out in either order. If fairness matters, and in a job queue it nearly always does, add a tie-breaker such as an incrementing counter, as we did in the tuple earlier. Also be aware that if your items are not comparable (two dictionaries, say), Python raises an error when priorities tie. The counter in the middle of the tuple prevents that comparison from ever reaching the payload.

3. There is no cheap way to change a priority

Say a task becomes more urgent after it is queued. Finding an arbitrary item inside a heap takes O(n), because the heap only organises the top. The common workaround, used in Dijkstra implementations everywhere, is lazy deletion: push a new entry with the better priority, and when you pop a stale entry later, notice it is outdated and skip it.

4. A heap is not sorted

Printing the underlying list gives you something that looks almost sorted, which tempts people to iterate over it directly. Do not. The only guaranteed position is index 0. To get everything in order you must pop repeatedly, or just sort a copy.

5. Thread safety is on you

Neither structure is safe for concurrent writers. Wrap access in a lock, or use a purpose-built concurrent queue such as Python’s queue.PriorityQueue, which is a heap plus locking.

What the standard libraries give you

You will rarely write a heap by hand outside of an interview or a learning exercise. Python gives you heapq for lists and queue.PriorityQueue for threads. Java gives you PriorityQueue. C++ gives you std::priority_queue. JavaScript has no built-in priority queue, so people either write a small heap or pull in a package. All of these are heaps underneath. For a sorted array in Python, bisect is the standard tool, and the third-party sortedcontainers package offers a sorted list with much better insertion behaviour for large sizes.

Common mistakes when comparing the two

  • Benchmarking only big inputs. You will miss the small-n region where the simple option wins.
  • Benchmarking only small inputs. Your prototype works fine and then collapses on production data.
  • Forgetting the workload mix. Insert-heavy, extract-heavy and balanced workloads can favour different structures.
  • Using sort() in a loop. Re-sorting after every insertion is O(n log n) per insert. Insert with bisect or use a heap instead.
  • Ignoring the tie rule. Equal priorities need a decision, not a surprise.

Test yourself

Tap a question to reveal the answer. The correct option is marked.

In a binary heap stored in an array, where are the children of the item at index 2?
  1. Indexes 1 and 2
  2. Indexes 3 and 4
  3. Indexes 5 and 6
  4. Index 4 only

Children of index i are at 2i + 1 and 2i + 2. For i = 2 that gives 5 and 6.

Why is inserting into a sorted array O(n) even though binary search is O(log n)?
  1. Binary search is actually O(n)
  2. Later elements must shift to make room
  3. The array must be re-sorted afterwards
  4. Arrays cannot grow

Binary search only finds the slot. Opening a gap there requires moving, on average, half the array.

You push two tasks with equal priority into heapq as plain (priority, task) tuples and the tasks cannot be compared. What can happen?
  1. A TypeError when the priorities tie
  2. The first task is silently dropped
  3. They are sorted alphabetically
  4. Nothing, it always works

On a tie Python compares the next tuple element. If that is not comparable, it raises an error. A counter in the middle prevents it and keeps FIFO order.

Which situation most favours a sorted array over a heap?
  1. Millions of mixed inserts and extracts
  2. Dijkstra on a huge graph
  3. A scheduler with a growing backlog
  4. A small collection you also need to read in sorted order or by rank

A sorted array gives instant sorted iteration, ranks and both ends. A heap only guarantees its top item.

What is the time complexity of building a heap from n existing items with heapify?
  1. O(n log n)
  2. O(log n)
  3. O(n)
  4. O(n squared)

Most nodes are near the bottom and barely move, so the total work adds up to linear time.

Frequently asked questions

What is a priority queue?

A queue where items leave in order of priority instead of arrival time. It supports insert, peek and extract, and can be built on a heap, a sorted array or other structures.

Is a heap the same as a sorted array?

No. A heap only guarantees that each parent is at least as urgent as its children, so the top item is correct but the rest is only partly ordered. A sorted array is fully ordered.

Why does Python only offer a min-heap?

It is a design choice for simplicity. For a max-heap, negate numeric priorities when pushing and negate again after popping, or wrap items in a class with reversed comparison.

Is heapsort related to this?

Yes. Heapsort builds a heap and then extracts the top item repeatedly, which gives an O(n log n) sort that works in place.

When should I use sortedcontainers instead of bisect?

When the list can grow large and you insert often. Its SortedList avoids the full-array shifting of a plain list and stays fast at sizes where bisect.insort becomes slow.

Can a heap find an arbitrary item quickly?

No. Searching a heap is O(n) because only the top is organised. If you need lookups by key as well as priority, pair the heap with a dictionary or use an indexed priority queue.

Key takeaways

  • A priority queue serves the most urgent item first, not the oldest.
  • A sorted array reads in O(1) but pays O(n) to insert because items must shift.
  • A binary heap keeps only a partial order and pays about log n for both insert and extract.
  • At 100,000 items the heap made roughly 1,600 times fewer moves and ran about 25 times faster in my test.
  • At a few hundred items, the sorted array can be just as quick or quicker. Match the structure to the size and the workload.
  • Add a counter tie-breaker, remember heapq is a min-heap, and use lazy deletion to change priorities.
heapsorted arraypriority queuedata structuresheapqtime complexityPython

The post Heap vs Sorted Array for Priority Handling appeared first on Learn With Examples.

]]>
https://learnwithexamples.org/heap-vs-sorted-array-for-priority-handling/feed/ 0 960
LRU Cache: Build One With a Hash Map and a Linked List https://learnwithexamples.org/lru-cache-build/ https://learnwithexamples.org/lru-cache-build/#respond Mon, 05 Oct 2026 08:34:16 +0000 https://learnwithexamples.org/?p=957 Your phone keeps the apps you used recently and quietly drops the ones you have ignored. Your browser, your database and your CPU do the same thing with data. The…

The post LRU Cache: Build One With a Hash Map and a Linked List appeared first on Learn With Examples.

]]>

Your phone keeps the apps you used recently and quietly drops the ones you have ignored. Your browser, your database and your CPU do the same thing with data. The rule behind it is called Least Recently Used, and building it yourself is one of the most satisfying exercises in programming: two simple data structures, each weak on its own, snapped together into something that runs in constant time.

Why this problem shows up everywhere

If you have ever sat through a software interview, you have probably met this question: “Design a data structure that follows a Least Recently Used cache.” It is a favourite of interviewers for good reason. It is short to state, it cannot be solved with a single built-in structure, and the solution reveals whether you understand how data structures complement each other.

But it is far more than an interview trick. I have used LRU caches to speed up image thumbnails, to keep recent database lookups in memory, and to throttle expensive API calls. The idea is so useful that it appears at almost every level of computing, from the cache inside your processor to the apps in your phone’s switcher.

In this article we will build an LRU cache from scratch. I will explain the idea with everyday examples, show why each simple approach fails, then assemble the real solution step by step with working code you can paste and run. There are diagrams, a traced example, a simulation comparing LRU with other policies, and a quiz.

The one-sentence version. An LRU cache stores a limited number of items, and when it is full it throws away the item that has gone unused for the longest time. It is built from a hash map (for instant lookup) and a doubly linked list (to track order of use).

What is a cache, and why does it need to forget?

A cache is a small, fast store that holds copies of things that are slow to get. If you read the same record from a database a thousand times, it makes sense to keep the answer in memory rather than asking the database again.

The catch is that fast storage is small. Memory is limited, so the cache must have a maximum size, called its capacity. Once it is full and a new item arrives, something has to go. Deciding what to remove is the job of the eviction policy.

Think of a small desk. You can keep ten books on it. Whenever you need an eleventh book, you must send one back to the shelf. Which one? You would probably return the book you have not touched for the longest time, because you are least likely to need it soon. That intuition is the entire LRU policy.

Eviction policies compared

LRU is not the only choice. Here are the common ones in plain words.

PolicyEvictsWorks well whenWeak spot
LRUThe item unused for the longest timeRecent use predicts future useOne-time scans and big loops
LFUThe item used the fewest timesSome items are long-term favouritesSlow to adapt when tastes change
FIFOThe oldest item insertedSimplicity matters mostIgnores how useful an item is
RandomAny item at allCheap approximation is fineNo intelligence at all

LRU strikes a very good balance. It is easy to explain, it adapts quickly to changing behaviour, and as we will see in a simulation, it beats FIFO and random eviction on realistic access patterns.

The job description: what our cache must do

We need a class with two operations:

  • get(key) returns the stored value, or -1 if the key is not there. If it is there, it counts as a use.
  • put(key, value) stores or updates a value. If the cache is already at capacity and the key is new, it first evicts the least recently used item.

And here is the demanding part: both operations must run in O(1) time, meaning constant time no matter how many items are cached. That requirement is what makes the problem interesting.

Why one data structure is not enough

Let us test the obvious ideas first, because the failures teach you the design.

Attempt 1: just a hash map

A hash map (a dictionary in Python, an object or Map in JavaScript) finds a value by key in constant time. Perfect for get. But a plain hash map has no useful notion of “least recently used.” When the cache is full, you would have to scan every entry to find the oldest. That makes eviction O(n).

Attempt 2: just a list or array

Keep items in an array, most recent at the front. Now the order is explicit and the least recent is always at the end. But finding a key means searching the array, which is O(n). And moving an item to the front means shifting the others. Both are slow.

The insight

The hash map is excellent at finding things and terrible at order. The list is excellent at order and terrible at finding things. So use both: the hash map finds the item instantly, and the list tracks order. To connect them, the hash map does not store values directly. It stores a pointer to the item’s node in the list.

Why a doubly linked list

A linked list is a chain of nodes where each node points to the next. In a singly linked list you can only move forward. A doubly linked list also keeps a pointer to the previous node.

That second pointer is the whole trick. When the hash map hands us a node in the middle of the list, we want to cut it out and move it to the front. Cutting out requires updating the previous node’s next pointer and the following node’s prev pointer. With a doubly linked list, the node already knows both neighbours, so removal takes a few assignments, with no searching. That is O(1).

We also add two dummy nodes, a head and a tail, that never hold data. They sit at the two ends so we never have to write special code for an empty list or for the first and last real node. This small habit eliminates a whole class of bugs.

HASH MAP: key to node (instant lookup)ACDDOUBLY LINKED LIST: order of useHEADdummyD:4nodeA:1nodeC:3nodeTAILdummymost recent sideleast recent sidewhen full, drop the node just before TAIL
The map points into the list. The list orders items from most recent (next to HEAD) to least recent (next to TAIL).

Notice that the hash map keys (A, C, D) are in no particular order, and the lines cross. That is fine. The map only answers “where is this item?” The list answers “which item is oldest?”

The four moves

Every operation reduces to a handful of pointer moves.

Move 1: get on a hit

Look up the node through the map, unlink it from where it is, and insert it right after HEAD. Return its value.

Before get(A)CBAAfter get(A)ACBA was used, so it moves to the front. Nothing is deleted.
Using A makes it the most recent. Others slide back by one place.

Move 2: get on a miss

If the key is not in the map, return -1. The order does not change.

Move 3: put on an existing key

Update the stored value, then move the node to the front, because writing counts as a use.

Move 4: put on a new key

If the cache is full, remove the node just before TAIL, and delete its key from the map. Then create a new node, add it to the map, and insert it after HEAD.

Before put(D,4)ACBAfter put(D,4)DACCache was full (capacity 3). B was least recent, so B is evicted.
The cache was full, so the least recently used node was evicted before the new one went in.

The full Python implementation

Here is the whole thing. It is about fifty lines, and I have tested it against a second implementation on thousands of random operations.

class Node:
    __slots__ = ("key", "value", "prev", "next")

    def __init__(self, key=0, value=0):
        self.key = key
        self.value = value
        self.prev = None
        self.next = None


class LRUCache:
    def __init__(self, capacity):
        self.capacity = capacity
        self.map = {}                 # key -> Node
        self.head = Node()            # dummy node on the "most recent" side
        self.tail = Node()            # dummy node on the "least recent" side
        self.head.next = self.tail
        self.tail.prev = self.head

    def _remove(self, node):          # unlink a node from the list
        node.prev.next = node.next
        node.next.prev = node.prev

    def _add_front(self, node):       # insert right after head
        node.prev = self.head
        node.next = self.head.next
        self.head.next.prev = node
        self.head.next = node

    def get(self, key):
        node = self.map.get(key)
        if node is None:
            return -1
        self._remove(node)            # it was just used,
        self._add_front(node)         # so move it to the front
        return node.value

    def put(self, key, value):
        if self.capacity <= 0:
            return
        node = self.map.get(key)
        if node is not None:          # key exists: update and refresh
            node.value = value
            self._remove(node)
            self._add_front(node)
            return
        if len(self.map) >= self.capacity:
            lru = self.tail.prev      # least recently used node
            self._remove(lru)
            del self.map[lru.key]     # this is why nodes store their key
        node = Node(key, value)
        self.map[key] = node
        self._add_front(node)

    def order(self):                  # helper for demos: most recent first
        out, cur = [], self.head.next
        while cur is not self.tail:
            out.append(cur.key)
            cur = cur.next
        return out

Let us walk through the key details.

  • Dummy head and tail: the real nodes always live between them, so _remove and _add_front never meet a null neighbour.
  • _remove and _add_front: these two helpers do all the pointer surgery. Every public method is built from them, which keeps the code short and the bugs few.
  • Storing the key in the node: when we evict the tail node, we only have the node in our hand. We need its key to delete the matching entry from the map. Forget this and the map slowly fills with stale entries.
  • Order of operations in put: check for an existing key first, then evict if full, then insert. Mixing the order leads to evicting the very key you are about to update.
  • Capacity guard: a capacity of zero or less simply stores nothing.

Tracing it by hand

Code is easier to trust when you have watched it work. Here is a run with capacity 3. The last column shows the list from most recent to least recent after each step. I generated this table by actually running the code above.

StepOperationReturnsOrder (recent to old)What happened
1put(A,1)–AA inserted
2put(B,2)–B → AB inserted
3put(C,3)–C → B → AC inserted. Cache is now full
4get(A)1A → C → BHit. A moves to the front
5put(D,4)–D → A → CFull, so B (least recent) is evicted
6get(B)-1D → A → CMiss. B was evicted earlier
7put(C,30)–C → D → AC updated to 30 and refreshed
8get(D)4D → C → AHit. D moves to the front
9put(E,5)–E → D → CFull, so A (least recent) is evicted
10get(A)-1E → D → CMiss. A was evicted earlier
11get(C)30C → E → DHit. C moves to the front

Look at step 5. The cache holds A, C, B with B at the back, so adding D evicts B. At step 6 we ask for B and get -1, because it was evicted. Step 7 updates C, and step 9 evicts A, which has not been touched since step 4. Every eviction was the item that had waited longest.

The shortcut: OrderedDict in Python

Python gives you a dictionary that remembers insertion order and can move items to the end in constant time. That means you can write an LRU cache in about fifteen lines.

from collections import OrderedDict

class LRUCache:
    def __init__(self, capacity):
        self.capacity = capacity
        self.data = OrderedDict()

    def get(self, key):
        if key not in self.data:
            return -1
        self.data.move_to_end(key)          # mark as most recently used
        return self.data[key]

    def put(self, key, value):
        if self.capacity <= 0:
            return
        if key in self.data:
            self.data.move_to_end(key)
        self.data[key] = value
        if len(self.data) > self.capacity:
            self.data.popitem(last=False)   # drop the oldest entry

This version is shorter, and in real projects it is usually the right choice. But in an interview, or when you want to understand the machinery, build the manual version first. Interviewers often use the OrderedDict version as a follow-up: “Great, now tell me how that works inside.” The answer is that it is a hash map plus a doubly linked list, exactly like ours.

There is also a ready-made option for caching function results. The functools.lru_cache decorator wraps a function and remembers its most recent calls, discarding the least recently used when it hits its limit.

The same idea in JavaScript

JavaScript’s Map remembers insertion order too. Delete and re-insert a key to make it the most recent, and the first key in the map is always the least recent.

class LRUCache {
  constructor(capacity) {
    this.capacity = capacity;
    this.map = new Map();               // Map remembers insertion order
  }
  get(key) {
    if (!this.map.has(key)) return -1;
    const value = this.map.get(key);
    this.map.delete(key);
    this.map.set(key, value);           // re-insert = most recent
    return value;
  }
  put(key, value) {
    if (this.capacity <= 0) return;
    if (this.map.has(key)) this.map.delete(key);
    this.map.set(key, value);
    if (this.map.size > this.capacity) {
      const oldest = this.map.keys().next().value;
      this.map.delete(oldest);          // first key = least recent
    }
  }
}

This is neat for small caches. For very large or very hot caches, a hand-built linked list can have better performance characteristics, since the delete-and-reinsert approach relies on the engine’s implementation details. For most web applications, this version is perfectly good.

Why it is O(1)

Step inside get or putCost
Look up key in hash mapO(1) on average
Unlink a node (doubly linked)O(1), a few pointer assignments
Insert after headO(1), a few pointer assignments
Find least recent (tail’s previous)O(1), no scanning
Delete from hash mapO(1) on average

Every step is constant time, so get and put are O(1) on average. The memory cost is O(capacity), because we store at most that many nodes and map entries.

Where LRU caches live in the real world

Tap through five places you already rely on, each with the reasoning behind it.

Phone app switcher

You open ten apps during the day. Later you return to a map app you used this morning, and it restarts from scratch while the app you used five minutes ago is still there.

PolicyLRU-like
EvictsOldest app
TriggerLow memory
You seeApp reloads

Why LRU. Mobile systems keep recently used apps in memory and reclaim the ones untouched for longest when memory runs low. It is not a pure LRU cache, since other factors matter too, but the intuition is the same: the app you just used is the one you are most likely to use again.

Redis or Memcached

A website caches user profiles in memory. The cache has a fixed size, and new profiles keep arriving.

maxmemory 100mb
maxmemory-policy allkeys-lru
Settingmaxmemory
Policyallkeys-lru
EvictsCold keys
NoteApproximate

Why LRU. When memory is full, Redis can evict keys using an LRU policy. In practice, Redis uses an approximated LRU: it samples a few keys and removes the best candidate, which avoids the cost of tracking exact order for millions of keys. The result is close to true LRU at a fraction of the bookkeeping.

CPU and operating system

Your processor keeps recently used memory lines close, and your operating system keeps recently read disk pages in RAM.

LevelCaches, pages
PolicyPseudo-LRU
WhyHardware cost
Exact LRURare

Why LRU. Exact LRU needs bookkeeping on every access, which is expensive in hardware and in kernels, so real systems use cheaper approximations such as pseudo-LRU in CPU caches and clock-style algorithms for memory pages. The goal is the same as ours, only the implementation is trimmed for speed.

Database buffer pool

A database keeps frequently read table pages in memory. Then someone runs a huge report that reads every row once.

HoldsDisk pages
PolicyLRU variants
DangerBig scans
FixMidpoint insert

Why LRU. A plain LRU would let that one-time scan push out all the genuinely hot pages. Many databases therefore use LRU variants. MySQL’s InnoDB, for example, inserts new pages at a midpoint of its list, so one-off reads do not instantly displace pages that are used repeatedly.

Python lru_cache

A function computes something slow, like fetching an exchange rate, and the same inputs keep coming back.

from functools import lru_cache

@lru_cache(maxsize=128)
def get_rate(currency):
    ...  # slow work here

get_rate("USD")
print(get_rate.cache_info())
Importfunctools
Argmaxsize
UsePure functions
Checkcache_info()

Why LRU. The standard library already ships an LRU cache as a decorator. It remembers the results of the last 128 distinct calls and evicts the least recently used one when a new call arrives. Building your own, as in this article, is how you learn what it does under the hood.

Notice how often real systems use an approximation of LRU. Perfect order tracking costs memory and time on every access, so engineers trade a little accuracy for a lot of speed. Understanding the exact version, which is what we built, is what lets you reason about those approximations.

Does LRU actually beat the alternatives? A simulation

Claims are cheap, so I ran an experiment. I generated 20,000 requests over 200 different keys, with some keys far more popular than others, which is how real traffic tends to behave. Then I replayed the same requests against LRU, FIFO and random eviction at four cache sizes.

322828size 10464040size 20625655size 40777273size 80LRUFIFORandomHit rate (%) on 20,000 requests over 200 keys, popular keys requested most.
Same requests, three policies. LRU wins at every size in this test.
Cache sizeLRU hit rateFIFO hit rateRandom hit rate
1031.8%27.8%28.0%
2046.2%40.5%40.2%
4061.5%55.6%55.4%
8077.4%72.2%72.6%

LRU gets roughly four to six percentage points more hits than FIFO and random eviction at each size. That may sound modest, but remember what a hit means: a request answered from fast memory instead of a slow database or network call. Across millions of requests, those extra hits add up to real money and real seconds.

The result also shows something else: bigger caches help a lot. Going from 10 slots to 80 lifts LRU from about 32% to about 77%. Eviction policy matters, but capacity matters more.

When LRU fails

I would be misleading you if I presented LRU as perfect. It has two classic weaknesses, and knowing them is the mark of someone who has used caches in production.

The looping worst case

Suppose your cache holds 10 items and your program loops over 11 different keys, again and again. Every time you ask for a key, it has just been evicted, because it was the least recently used. The result: a hit rate of exactly 0%. I confirmed this by running it: with a loop of 11 keys and a capacity of 10, both LRU and FIFO miss on every single request after the first pass.

The big scan

Imagine a database that caches popular rows, and then someone runs a report that reads every row once. Each of those one-time reads enters the cache as the “most recently used” and pushes out the genuinely popular items, which are never used again by the scan. This is called cache pollution. Variants such as 2Q, LRU-K and ARC, or a midpoint-insertion scheme, exist specifically to resist it.

The lesson is not to avoid LRU. It is to know that no policy is best for every workload, and to measure your own traffic before deciding.

Testing your implementation

When I review an LRU cache, I look for these cases. They catch most bugs.

  • Missing key: get on an empty cache returns -1.
  • Capacity of one: every new put evicts the previous key.
  • Update an existing key: the value changes, the size does not, and the key becomes most recent.
  • Get refreshes recency: after a successful get, that key must survive the next eviction.
  • Zero capacity: nothing is stored, and nothing crashes.
  • Randomised comparison: run thousands of random operations against a trusted version, such as the OrderedDict one, and compare every result.

The randomised check is my favourite. It finds the strange edge cases you did not think to write by hand.

Six mistakes people make (tap to open)

1. Forgetting that get counts as a use

If get does not move the node to the front, you have built a FIFO cache, not an LRU cache.

2. Not storing the key inside the node

When you evict the tail node you need its key to remove the map entry. Without it, you cannot clean up the dictionary.

3. Forgetting to refresh on put of an existing key

Updating a value is also a use. Update the value and move the node to the front.

4. Using a singly linked list

You cannot remove a middle node in constant time because you cannot reach its predecessor. That breaks the O(1) requirement.

5. Skipping the dummy head and tail

Without sentinels you need special cases for empty lists and for the first and last real nodes. Those special cases are where bugs hide.

6. Ignoring thread safety

The cache is not safe when several threads call it at once. Wrap operations in a lock, or choose a library built for concurrency.

Quick quiz: test yourself

Tap each question to reveal the answer and its reasoning.

Why does an LRU cache use a doubly linked list instead of a singly linked list?
  1. Doubly linked lists use less memory
  2. Singly linked lists cannot be traversed
  3. Removing a node from the middle in O(1) needs access to its previous node
  4. The hash map requires it

To unlink a node you must update the previous node’s next pointer. A prev pointer lets you do that without walking the list.

Why does each node store its key as well as its value?
  1. For printing
  2. So the evicted node’s entry can be removed from the hash map
  3. To sort the list
  4. Python requires it

When you evict the tail node, you must delete that key from the map too, and the node is the only place that knows it.

Capacity is 2. You run put(1,1), put(2,2), get(1), put(3,3). What does get(2) return?
  1. -1
  2. 2
  3. 1
  4. 3

After get(1), key 1 is most recent, so put(3,3) evicts key 2. Then get(2) is a miss, returning -1.

What is the time complexity of get and put in the hash map plus linked list design?
  1. O(n) for both
  2. O(log n) for both
  3. O(n) for get, O(1) for put
  4. O(1) on average for both

The hash map finds the node in O(1) on average, and the linked list moves or removes it in O(1).

Which access pattern is the classic worst case for LRU?
  1. Repeatedly reading the same key
  2. Looping over one more key than the cache can hold
  3. Reading keys in random order
  4. Only writing keys

With capacity N and a repeating loop over N + 1 keys, each key is evicted just before it is needed again, so every access misses.

Frequently asked questions

What does LRU stand for?

Least Recently Used. When the cache is full, the entry that has gone unused for the longest time is removed first.

Why use a hash map and a linked list together?

A hash map gives instant lookup but remembers no order. A linked list remembers order and lets you reorder in constant time, but searching it is slow. Combined, each covers the other’s weakness.

Can I build an LRU cache with only OrderedDict?

Yes. In Python, OrderedDict has move_to_end and popitem(last=False), which give you the whole behaviour in a few lines. Interviewers often ask for the manual version to see whether you understand how it works.

Is LRU always the best eviction policy?

No. It does well when recent use predicts future use. It does poorly with large one-time scans and with loops slightly bigger than the cache. LFU, 2Q and ARC are alternatives that handle some of those cases.

Is this implementation thread safe?

No. Concurrent get and put calls could corrupt the list. In multi-threaded code, protect every operation with a lock, or use a library designed for concurrency.

What is the difference between LRU and LFU?

LRU evicts what was used least recently. LFU (Least Frequently Used) evicts what has been used the fewest times in total. LFU favours long-term favourites, while LRU adapts faster to changing interests.

The takeaway

An LRU cache is two ideas working together: a hash map that finds any item instantly, and a doubly linked list that keeps items in order of use. The map points into the list, the list tells you who is oldest, and every operation is a few pointer moves.

Build it once from scratch, test it with a randomised comparison, and you will understand not just this cache but the habit behind many great data structures: when one tool is weak where another is strong, connect them.

LRU cachehash mapdoubly linked listdata structurescache evictioncoding interview

The post LRU Cache: Build One With a Hash Map and a Linked List appeared first on Learn With Examples.

]]>
https://learnwithexamples.org/lru-cache-build/feed/ 0 957
Git and GitHub Explained for Beginners (With Real Examples) https://learnwithexamples.org/git-and-github-explained/ https://learnwithexamples.org/git-and-github-explained/#respond Sat, 03 Oct 2026 12:37:11 +0000 https://learnwithexamples.org/?p=948 Version control · Beginner guide · Hands-on If you have ever saved a file as report_final_v2_REAL_final.docx, you already understand why Git exists. It is the grown-up version of that habit:…

The post Git and GitHub Explained for Beginners (With Real Examples) appeared first on Learn With Examples.

]]>
Version control · Beginner guide · Hands-on

If you have ever saved a file as report_final_v2_REAL_final.docx, you already understand why Git exists. It is the grown-up version of that habit: a tool that remembers every version of your work, lets you travel back in time, and lets a team edit the same project without overwriting each other. GitHub is where those projects usually live online. This guide explains both from zero.

Reading time: about 18 minutesLevel: complete beginnerTools: a terminal and a free GitHub account

The problem Git solves

I started programming long before Git was everywhere, and I remember what folders looked like in those days. site_backup, site_backup_old, site_NEW, site_NEW_fixed, and one called site_dont_touch. Nobody knew which was current. When a client said “the version from last Tuesday was better,” the honest answer was often “I think I overwrote it.”

Now picture a team of five editing the same files. Two people change the same paragraph. Someone emails a zip file. Someone else works from an older copy. Merging all of that by hand is miserable, and mistakes are guaranteed.

Version control is the fix. Instead of copying folders, you tell a tool when you have reached a meaningful point, and it stores a snapshot. The most popular version control system in the world is Git, created in 2005 by Linus Torvalds for the Linux kernel. Today it is used by solo students, small studios and the largest software companies alike.

The one-sentence version. Git is a tool on your computer that records snapshots of your project over time. GitHub is a website that stores your Git projects online so you can back them up, share them and collaborate.

Git vs GitHub: the part everyone mixes up

Beginners often use the two names as if they were one thing. They are not, and the difference matters.

  • Git is software that runs on your own computer. It works offline. It does the actual tracking of changes.
  • GitHub is a company’s website (owned by Microsoft) that hosts Git repositories in the cloud and adds features around them: pull requests, issue tracking, code review and project pages.

The analogy I use in workshops: Git is a camera, and GitHub is the photo-sharing site. You can take photos without ever uploading them, but the website makes it easy to back them up and show them to others. Similar sites exist, including GitLab and Bitbucket. They all speak Git.

QuestionGitGitHub
What is it?A version-control programA hosting website and platform
Where does it run?On your computerOnline, in the cloud
Needs internet?NoYes
Main jobTrack and organise your changesStore, share and review them with others
AlternativesMercurial, SubversionGitLab, Bitbucket

The vocabulary you need (and nothing more)

Git has a reputation for jargon. In reality, you need about eight words, and each has a plain-English meaning.

TermPlain meaningEveryday analogy
repositoryA project folder that Git tracks, with its full historyA filing cabinet with every past version
commitA saved snapshot with a messageA save point in a video game
branchA separate line of workA parallel draft you can experiment in
mergeCombining one branch into anotherPasting your draft into the main document
cloneCopying a repository to your computerDownloading the whole cabinet
remoteA copy of the repository hosted elsewhereThe cloud backup
push / pullSend your commits up / bring others’ commits downUpload and download
pull requestA request to merge your branch, with review“Please check my work before it goes in”

How a change travels through Git

This is the single most useful mental model in the whole subject, and almost every beginner tutorial skips it. A change passes through four places.

Working folderfiles you editStaging areawhat goes nextLocal repoyour saved historyGitHubcopy in the cloudaddcommitpushpullThe first three live on your computer. Only the fourth is online.YOUR COMPUTER
Edit in the working folder, stage what you want, commit it to history, then push it online.
  • Working folder: the files you see and edit on your computer.
  • Staging area: a waiting room where you choose exactly which changes go into the next snapshot.
  • Local repository: the saved history of commits, stored in a hidden .git folder.
  • Remote (GitHub): the copy online that teammates can reach.

The staging area surprises people. Why not save everything at once? Because it lets you craft tidy commits. Imagine you fixed a typo and also started a risky new feature in the same afternoon. Staging lets you commit the typo fix by itself, with a clear message, and leave the unfinished feature for later.

Setting up: install and introduce yourself

Download Git from the official site (git-scm.com) or install it with your system’s package manager. Then check that it works.

git --version

Next, tell Git who you are. Every commit carries a name and email, so this is a one-time setup.

git config --global user.name "Your Name"
git config --global user.email "[email protected]"
git config --global init.defaultBranch main

The last line makes new repositories start with a branch called main, which matches what GitHub uses today. Older installs may still default to master, so setting it avoids confusion.

Your first repository, step by step

Let us track a small recipe collection. Open a terminal, make a folder and start Git inside it.

mkdir recipes
cd recipes
git init

Git replies with something like:

Initialized empty Git repository in /home/you/recipes/.git/

Now create a file called pasta.txt with three lines of text in any editor, then ask Git what it sees.

git status

On branch main

No commits yet

Untracked files:
  (use "git add <file>..." to include in what will be committed)
	pasta.txt

nothing added to commit but untracked files present (use "git add" to track)

“Untracked” means Git sees the file but is not recording it yet. git status is your best friend: run it constantly, especially when confused. Now stage the file and commit it.

git add pasta.txt
git commit -m "Add pasta recipe"

[main (root-commit) a1b2c3d] Add pasta recipe
 1 file changed, 3 insertions(+)
 create mode 100644 pasta.txt

Congratulations, you have made your first snapshot. The odd string a1b2c3d is the start of a commit’s unique ID. (Yours will look different; the examples here use made-up IDs.) Add a sauce recipe and a typo fix the same way, and your history looks like this.

git log --oneline

1f2e3d4 (HEAD -> main) Add dessert
7c8d9e0 Fix typo
e4f5a6b Add sauce
a1b2c3d Add pasta recipe
a1b2c3dAdd pastae4f5a6bAdd sauce7c8d9e0Fix typo1f2e3d4Add dessertmain ← HEAD
Each commit points back to the one before it. HEAD marks where you are now.

Every dot in that chain is a version you can return to. That is the whole magic: history becomes a thing you can read, search and travel through.

Writing commit messages people will thank you for

A commit message is a note to your future self, and to everybody else. Compare these two histories:

  • “stuff”, “fix”, “fix 2”, “asdf”
  • “Add login form validation”, “Fix crash when email is empty”, “Remove unused styles”

The second tells a story. A few habits help: write in the imperative (“Add”, not “Added”), keep the first line under about 50 characters, and describe what and why, not how. Six months later, when something breaks, you will be searching that history for answers, and clear messages turn a two-hour hunt into a two-minute one.

Telling Git what to ignore

Not every file belongs in version control. Passwords, API keys, temporary files and huge generated folders should stay out. Create a plain text file named .gitignore and list patterns.

.env
node_modules/
*.log
.DS_Store

This is more than tidiness. Never commit secrets such as API keys or passwords. Once something is pushed to a public repository, bots can find it within minutes. If it happens, rotate the key immediately. Deleting the file later does not erase it from history.

Branches: safe places to experiment

A branch is simply a movable label on a line of commits. Your main branch holds the version that works. When you want to try something, you create a new branch, work there, and leave main untouched.

git switch -c feature/bigger-portions
# edit files, then
git add pasta.txt
git commit -m "Increase pasta portion size"

Think of it as photocopying a document to scribble on, with the guarantee that the original stays clean. If the idea works, you merge it in. If it does not, you delete the branch and nothing is lost.

mainfeature/searchmerge commitWork on the side, then join it back. Main stays safe in the meantime.
A feature branch splits off main, collects its own commits, and merges back.

When you are ready, switch back to main and merge.

git switch main
git merge feature/bigger-portions

Merge conflicts are not scary

Sometimes two branches change the same line. Git cannot guess which you want, so it stops and asks you to decide. It marks the file like this.

<<<<<<< HEAD
Use 200g of spaghetti
=======
Use 250g of spaghetti
>>>>>>> feature/bigger-portions

The top part is your current branch, the bottom part is the incoming one. Edit the file to keep what you want (and delete the marker lines), then git add it and git commit. A conflict is just Git being polite and asking a question. In teams, conflicts become rare once people commit small changes often and pull regularly.

Bringing in GitHub

So far everything has lived on your computer. Now let us put it online. Create a free account at github.com, click the button to create a new repository, and name it recipes. GitHub will show you the web address of your empty repository. Connect your local project to it and upload.

git remote add origin https://github.com/YOU/recipes.git
git branch -M main
git push -u origin main

Here origin is just the nickname Git gives to your main remote. The -u flag remembers the connection so that later you can type only git push and git pull.

A practical note on logging in: GitHub no longer accepts your account password for Git operations over HTTPS. Use a personal access token, set up SSH keys, or install the GitHub CLI or Git Credential Manager, which handle sign-in for you. Their setup pages walk through it in a few minutes.

To get a project that already exists on GitHub onto your machine, you clone it.

git clone https://github.com/YOU/recipes.git

That downloads every file and the whole history, and sets up origin automatically.

Pull requests: how teams actually work

On a team, nobody pushes straight to main. Instead, the loop looks like this.

1 Branchgit switch -c2 Commitgit commit3 Pushgit push4 Pull requestreview5 Mergethen pullThe loop almost every team repeats several times a day.
Branch, commit, push, open a pull request, merge. Repeat.

A pull request (often shortened to PR) is a page on GitHub that shows exactly what changed between your branch and main. Teammates can comment on specific lines, request changes and approve. When everyone is happy, someone clicks Merge. Automated checks, such as tests, can run on the PR too, so a broken change is caught before it reaches the shared code.

I have watched this process save projects. A new developer once pushed a change that would have deleted a customer table. Two people spotted it in review because the diff showed hundreds of red lines where there should have been five. Without a pull request, that change would have gone straight to production.

Five real situations, five workflows

Tap through the tabs. Each one shows a realistic scenario with the actual commands.

Solo project

You are writing a small recipe book as text files and want a safety net. No team, no internet needed.

git init
git add pasta.txt
git commit -m "Add pasta recipe"
git log --oneline
Commands4
RiskNone
WhereYour PC
Needs GitHubNo

Why it works. Each commit is a snapshot you can return to. After a month of edits you can look back and see exactly when the sauce recipe changed, and why.

Undo mistakes

You edited the wrong file, or committed something you regret. Git has a different tool for each size of mistake.

# discard edits you have not committed
git restore pasta.txt

# take a file back out of the staging area
git restore --staged pasta.txt

# undo a commit by adding a new opposite commit
git revert 7c8d9e0
Safestrestore
Safe on sharedrevert
Dangerousreset –hard
TimeSeconds

Why it works. Use restore for uncommitted edits, and revert when the commit has already been shared, because it leaves history intact. Treat reset –hard as the sharp knife: it can throw work away.

Team feature

You and three colleagues are adding a search bar to a website. Nobody should break the working version.

git switch -c feature/search
# ...edit files...
git add .
git commit -m "Add search box"
git push -u origin feature/search
# open a pull request on GitHub, get a review, merge
git switch main
git pull
Branches1 each
ReviewPull request
Safe mainYes
People2 to 20

Why it works. Everyone works on their own branch, then proposes changes with a pull request. A teammate reads the changes before they reach main. That review step catches more bugs than most people expect.

Open source

You found a typo in a popular project’s documentation and want to fix it, but you are not a maintainer.

# click Fork on GitHub, then:
git clone https://github.com/YOU/project.git
cd project
git switch -c fix-typo
# fix the typo, then
git commit -am "Fix typo in README"
git push -u origin fix-typo
# open a pull request to the original project
Step oneFork
Step twoClone
ThenBranch
FinishPull request

Why it works. A fork is your personal copy of someone else’s repository on GitHub. You change your copy and ask the owners to pull your change in. This is how thousands of strangers contribute to the same project.

Publish a site

You built a one-page portfolio and want it online without paying for hosting.

git add index.html
git commit -m "Launch portfolio"
git push origin main
# On GitHub: Settings, Pages, deploy from branch main
HostGitHub Pages
CostFree tier
Filesindex.html
Updategit push

Why it works. GitHub Pages serves static files straight from a repository. After setup, every push updates the live site. Your history doubles as a deployment log.

You will notice the same handful of commands appearing in every tab. That is the good news: the entire daily workflow of most developers is built from perhaps ten commands.

A beginner’s cheat sheet

CommandWhat it doesWhen to use it
git statusShows what has changed and what is stagedConstantly. Any time you are unsure.
git add <file>Stages a file for the next commitBefore every commit
git commit -m “msg”Saves a snapshot of staged changesAfter each small, finished step
git log –onelineLists past commits in short formTo see history
git diffShows exact line changes not yet stagedBefore staging, to review your work
git switch -c nameCreates and switches to a new branchStarting a new task
git merge nameMerges a branch into the current oneFinishing a task locally
git pushUploads commits to the remoteSharing or backing up your work
git pullDownloads and merges remote changesStart of your working day
git clone <url>Copies a remote repository to your computerJoining an existing project
git restore <file>Discards uncommitted edits to a fileWhen an experiment went wrong
git revert <id>Undoes a commit by adding an opposite oneUndoing something already shared

A daily routine you can copy

  • Morning: run git switch main and git pull so you start from the latest version.
  • Before starting a task: create a branch with git switch -c and a descriptive name.
  • While working: run git status and git diff often, and commit each small finished step.
  • When done: push the branch and open a pull request.
  • After the merge: switch back to main, pull, and delete the old branch.

It feels like a lot at first, and then one day you realise you have stopped thinking about it. That is when Git becomes a superpower instead of a chore.

Seven mistakes beginners make (tap to open)

1. Committing everything with a vague message

Messages like “update” tell nobody anything. Take ten seconds to describe the change. Your future self is the main beneficiary.

2. Committing secrets and API keys

Add sensitive files to .gitignore from day one. If a key leaks, revoke it immediately; deleting the file later does not remove it from history.

3. Working directly on main

Even solo, branches give you a safe place to experiment. On teams, working on main is how broken code reaches everyone.

4. Forgetting to pull before pushing

If a teammate has pushed since you last pulled, your push may be rejected. Pull first, resolve any conflicts, then push.

5. Using git reset –hard without thinking

It can destroy uncommitted work permanently. Prefer git restore for single files and git revert for shared commits unless you are certain.

6. Giant commits that mix unrelated changes

A commit with a bug fix, a refactor and a new feature is hard to review and hard to undo. Stage and commit them separately.

7. Panicking at a merge conflict

A conflict is a question, not a failure. Read the markers, choose what to keep, remove the markers, add, and commit.

Quick quiz: test yourself

Tap each question to reveal the answer and the reasoning.

What is the difference between Git and GitHub?
  1. They are the same thing
  2. Git is a website and GitHub is a program
  3. Git is the version-control tool on your computer, GitHub is an online home for Git repositories
  4. GitHub is only for photographers

Git tracks changes locally. GitHub hosts repositories online and adds collaboration features such as pull requests.

Which command moves changes from the working folder into the staging area?
  1. git add
  2. git commit
  3. git push
  4. git clone

git add stages changes. git commit then saves the staged snapshot into history.

You edited a file but have not committed. How do you throw those edits away safely?
  1. git push –force
  2. git restore <file>
  3. git merge
  4. git fork

git restore puts the file back to its last committed state. Be sure you want to lose those edits first.

What is a pull request?
  1. A command that downloads files
  2. A way to delete a branch
  3. A backup of your computer
  4. A proposal to merge your branch, with a place for review and discussion

A pull request asks the project to pull your changes in, and lets teammates review them first.

Which file stops Git from tracking things like passwords and build folders?
  1. README.md
  2. LICENSE
  3. .gitignore
  4. package.json

List patterns in .gitignore for files Git should leave alone. Secrets that were already committed need extra steps, so never commit them in the first place.

Frequently asked questions

Do I need GitHub to use Git?

No. Git works completely on your own computer. GitHub is optional, but it makes backup, sharing and teamwork much easier. GitLab and Bitbucket are alternatives.

What is a repository?

A repository, or repo, is a project folder that Git tracks, along with the full history of its changes stored in a hidden .git folder.

What is the difference between git pull and git fetch?

git fetch downloads new history from the remote without changing your files. git pull fetches and then merges it into your current branch.

What does git clone do?

It copies an entire repository from a remote location such as GitHub to your computer, including its history, and sets up the connection called origin.

How often should I commit?

Commit whenever you finish a small, meaningful step that you could describe in one sentence. Small commits are easier to review and easier to undo.

What if I committed a password by mistake?

Treat it as compromised: change the password or revoke the key right away. Removing it from history is a separate, harder job, so rotating the secret comes first.

The takeaway

Git remembers every version of your project, GitHub keeps a copy online and helps people work together, and the daily routine boils down to a few commands: status, add, commit, push, pull, and switch. You do not need to master everything. You need to commit small, write clear messages, work on branches and never commit secrets.

Make a practice repository today. Add three files, make five commits, create a branch, merge it, push it to GitHub. An hour of doing beats a week of reading, and you will never again have a folder called “final_v2_REAL_final.”

GitGitHubversion controlgit commandspull requestfor beginners

The post Git and GitHub Explained for Beginners (With Real Examples) appeared first on Learn With Examples.

]]>
https://learnwithexamples.org/git-and-github-explained/feed/ 0 948
Ransomware: How It Works and How It Spreads https://learnwithexamples.org/ransomware-how-it-works-spreads/ https://learnwithexamples.org/ransomware-how-it-works-spreads/#respond Tue, 04 Aug 2026 17:40:10 +0000 https://learnwithexamples.org/?p=848 Learn With Examples It almost never starts with a hacker in a hoodie breaking down a digital door. It starts with one password, one unpatched server, or one convincing email…

The post Ransomware: How It Works and How It Spreads appeared first on Learn With Examples.

]]>

Learn With Examples

It almost never starts with a hacker in a hoodie breaking down a digital door. It starts with one password, one unpatched server, or one convincing email — and by the time the ransom note appears, the attackers have often been inside for weeks.

Reading time13 min
LevelBeginner friendly
Includes5 real case files

Picture a Friday afternoon at a mid-sized logistics company. An accounts clerk gets an email that looks like an unpaid invoice from a supplier she deals with weekly. She opens the attachment. Nothing visibly happens, so she carries on with her day and goes home.

Nineteen days later, at 2:14 on a Sunday morning, every file server in the company locks simultaneously. Spreadsheets, delivery schedules, the customer database, even the backups on the network drive — all replaced with scrambled files and a text document explaining where to send the Bitcoin.

Those nineteen days are the part almost nobody pictures. Ransomware is not a bomb that goes off when you click. It is a burglary that ends with the locks being changed — and the burglary itself takes days or weeks, during which the intruders are quietly reading your email, finding your backups, and stealing your data before a single file is ever encrypted.

This article explains what actually happens in those weeks, how the infection gets in, and what five of the most damaging real-world attacks teach us. Everything here is defensive knowledge: how the attack chain works, so you can recognise and break it.

In one paragraph

What ransomware is

Ransomware is malicious software that makes your data unusable and sells it back to you. It scrambles your files with strong encryption, and the key needed to unscramble them is held by the attacker until you pay. Modern attacks add a second lever: before encrypting anything, they copy your sensitive data out and threaten to publish it. So even a company with perfect backups still faces a leak.

The important part for defenders: encryption is the last step. Everything before it — the break-in, the spread, the theft — is where an attack can still be stopped.

Why it stopped being about locked files

Early ransomware was crude and indiscriminate: infect as many home computers as possible, demand a few hundred dollars each, hope enough people pay. Then criminals noticed that a hospital or a factory will pay vastly more than a thousand individuals, and the whole model changed.

  • 2013 — 2015 · SPRAY AND PRAYMass email campaigns hitting individuals for a few hundred dollars. Good backups were a complete defence.
  • 2016 — 2018 · BIG GAME HUNTINGAttackers begin targeting organisations deliberately, studying revenue and pricing the ransom to fit. Demands jump into six and seven figures.
  • 2019 · DOUBLE EXTORTIONThe pivotal change: steal the data first, then encrypt. Now backups alone don’t save you — refusing to pay means your customers’ data gets published.
  • 2020 onwards · RANSOMWARE AS A SERVICEThe criminal ecosystem specialises. One group writes the software, others break into networks, others negotiate. You no longer need technical skill to run an attack.
  • 2023 onwards · EXTORTION WITHOUT ENCRYPTIONSome groups skip the encryption entirely. Stealing the data and threatening to leak it is quieter, faster, and often just as profitable.

That progression matters because it changes what “being prepared” means. Backups answer the 2015 problem. They do nothing about the 2019 one. A company today needs to survive both losing access to its data and having that data published.

The attack chain, stage by stage

Nearly every serious ransomware incident follows the same six stages. Tap through them — each stage is a place where the attack could still be caught, and knowing that is the entire point of learning the sequence.

The six stages

tap a stage
Stage 1 · Initial access

Getting through the front door

Three routes account for the overwhelming majority of break-ins: a stolen or guessed password on a remote access system without multi-factor authentication, an unpatched internet-facing server, and a convincing email that persuades someone to open something.

Real example: the Colonial Pipeline attackers in 2021 didn’t need anything sophisticated. They used a password for a disused VPN account that appeared in a batch of leaked credentials. That account had no multi-factor authentication on it.

Where it breaks: MFA everywhere, prompt patching of anything reachable from the internet, and shutting down accounts nobody uses.

Stage 2 · Establishing a foothold

Making sure they can get back in

The first thing an intruder does is make their access durable. They set up a second and third way back into the network, so losing one doesn’t lock them out. Increasingly they use ordinary administration tools that already exist on your systems, precisely because those tools don’t look suspicious.

Why it matters: this is why “we changed that password” is not a fix. If someone has been inside for two weeks, the door they came through is rarely the only one still open.

Where it breaks: endpoint monitoring that flags unusual use of legitimate admin tools, and alerting on new accounts or scheduled tasks appearing.

Stage 3 · Reconnaissance

Reading your organisation

Now they explore. Where are the file servers? Which systems would hurt most if they stopped? Where are the backups, and are they connected to the network? They read finance documents to work out what you can afford, and they check whether you have cyber insurance — because that tells them your ceiling.

The uncomfortable statistic: attackers commonly spend days to weeks inside a network before triggering anything. During that window there is nothing to see unless you are looking.

Where it breaks: network segmentation, so that compromising one laptop doesn’t grant a tour of everything, and monitoring for unusual internal scanning.

Stage 4 · Privilege escalation

Becoming the administrator

One ordinary user account isn’t enough to encrypt a company. The goal is domain administrator — the keys to everything. Attackers get there by harvesting credentials left in memory on shared machines, exploiting misconfigured permissions, or simply finding a password in a document called something like server-passwords.xlsx.

Real example: in the 2023 attack on MGM Resorts, attackers reportedly phoned the IT help desk, impersonated an employee, and talked their way into a credential reset. No exploit required — just a convincing phone call.

Where it breaks: least privilege, separate accounts for admin work, and strict identity verification for help-desk resets.

Stage 5 · Data theft

Copying everything out first

Before anything is locked, the valuable data leaves — customer records, contracts, HR files, source code. Often it is uploaded to ordinary cloud storage services, because that traffic blends in with normal business use.

Why this stage exists: it is the insurance policy against your backups. If you restore everything and refuse to pay, they still hold your data and can publish it. This is what turned ransomware from an IT problem into a legal and reputational one.

Where it breaks: monitoring for large outbound transfers, and controls on which cloud services can be reached from inside the network.

Stage 6 · Encryption and extortion

The part everybody pictures

Only now do files get encrypted, usually at night or over a holiday weekend when nobody is watching. Backups are deliberately destroyed or encrypted first. Then the ransom note appears, typically with a countdown and a link to a private chat with the attackers.

The timing is deliberate: attacks cluster around Friday nights, public holidays, and long weekends. Fewer staff, slower detection, more hours to finish the job.

Where it breaks: offline or immutable backups that cannot be reached from the network, and a tested recovery plan — the emphasis being firmly on tested.

Stages 1 to 5 are invisible to most organisations. Stage 6 is impossible to miss. Nearly all the opportunity to prevent a disaster sits in the part nobody sees.

By the time you can see ransomware, you are not preventing an attack any more. You are recovering from one that finished.

How it actually spreads

Two different questions get muddled here: how attackers get into an organisation, and how the infection moves within one. They have different answers.

Getting in: the three doors

Where attacks begin

industry incident reports, broadly consistent year to year
Stolen credentials & exposed remote accesslargest single category
Unpatched internet-facing softwarevery large
Phishing & malicious attachmentsvery large
Supply chain & trusted software updatesrarer, far bigger blast radius

Proportions vary between reports and years, but the ranking is stubbornly stable: credentials and unpatched internet-facing systems consistently beat phishing as the way in.

That last point surprises people, because security training focuses so heavily on suspicious emails. Phishing is a genuine and major route — but a remote access portal with no multi-factor authentication is a permanently open door that requires no one to make a mistake at all. It just needs one password to appear in any of the billions already circulating from previous breaches.

Moving inside: how one machine becomes five hundred

METHOD 01

Stolen credentials

The most common by far. With an administrator password, attackers simply log in to other machines. Nothing is “hacked” — they use the same tools your IT team does.

METHOD 02

Management tools

Software built to push updates to every computer at once is perfect for pushing ransomware to every computer at once. Attackers actively hunt for it.

METHOD 03

Network shares

Mapped drives are a gift. Anything a compromised user can write to, ransomware can encrypt — including that “backup” folder on the shared server.

METHOD 04

Worm-like exploits

Rare but devastating. A flaw needing no human interaction lets the infection jump machine to machine automatically, in minutes rather than days.

The backup trap. A backup drive that is permanently connected and writable is not a backup as far as ransomware is concerned — it is just more files to encrypt. Attackers look for backups deliberately and destroy them first, because a company that can restore is a company that won’t pay. Backups must be offline, immutable, or in a separate account the compromised network cannot reach.

Five real attacks, and what each one teaches

These are the incidents worth knowing, not because they were the most sophisticated, but because each exposed a different weakness.

Case files

tap a case
May 2017 · global

WannaCry — the patch nobody applied

WannaCry spread itself. It used a flaw in an old Windows file-sharing protocol that let it jump from machine to machine with no human involvement, infecting well over 200,000 computers across 150 countries in a couple of days. Britain’s NHS was hit hard: ambulances diverted, thousands of appointments and operations cancelled.

The detail that stings: Microsoft had released the patch two months earlier. Every organisation that applied updates promptly was immune. The outbreak was eventually slowed when a researcher registered a domain name found in the code that acted as an accidental kill switch.

Lesson: patching internet-facing and networked systems is not administrative housekeeping. It is the single highest-return security activity most organisations can do.

June 2017 · global

NotPetya — the one that wasn’t really ransomware

NotPetya arrived through a poisoned update to a Ukrainian tax accounting package that most companies doing business in Ukraine were required to use. It looked like ransomware and demanded payment — but the encryption was designed to be irreversible. Paying achieved nothing. It was destruction dressed as extortion.

Shipping giant Maersk lost virtually its entire global IT estate and rebuilt roughly 4,000 servers and 45,000 computers in about ten days. Total worldwide damages have been estimated at around $10 billion, making it the costliest cyberattack in history.

Lesson: software you trust and update automatically is a route into your network. And a “ransom” is not always a real offer — recovery capability matters more than negotiating ability.

May 2021 · United States

Colonial Pipeline — one password, one country queuing for fuel

The largest fuel pipeline in the US, carrying nearly half the East Coast’s supply, shut down for around six days. Panic buying emptied filling stations across several states and a state of emergency was declared.

The entry point was a single VPN account that was no longer in use, protected by a password that had leaked in an earlier breach elsewhere, with no multi-factor authentication. The company paid roughly $4.4 million in Bitcoin; US authorities later recovered a substantial portion of it. Notably, the pipeline itself was shut down as a precaution — the billing systems were the ones affected.

Lesson: disused accounts are live doors, reused passwords eventually surface in a leak, and MFA on remote access would have ended this attack before it began.

July 2021 · global

Kaseya — attacking a thousand companies at once

Rather than break into companies one by one, attackers compromised a tool that IT service providers use to manage their clients’ computers remotely. The ransomware was then pushed out through that trusted channel to roughly 1,500 downstream businesses in a single stroke — including a Swedish supermarket chain that had to close around 800 stores because its tills stopped working.

The attack landed on the Friday of a long holiday weekend in the US, when response teams were thinnest. That timing was not a coincidence.

Lesson: your security includes your suppliers’ security. Any vendor with remote access into your systems is part of your attack surface.

February 2024 · United States

Change Healthcare — the most expensive lesson in MFA

Change Healthcare processes a large share of American medical claims. When it was hit, pharmacies could not verify insurance, providers could not bill, and parts of the healthcare payment system stalled for weeks. Parent company UnitedHealth ultimately reported costs running into billions of dollars, and the breach affected the data of well over a hundred million people.

The way in was a remote access portal without multi-factor authentication. A $22 million ransom was paid for a promise to delete the stolen data — then the criminal group collapsed in an apparent exit scam, the stolen data moved to a second gang, and a fresh extortion demand followed.

Lesson: paying buys a promise from criminals, not a guarantee. And when one company sits at the centre of an industry, its security is everyone’s problem.

Why it keeps happening: the business behind it

Ransomware persists because it has become an industry with specialised roles, not a hobby for lone hackers.

RoleWhat they doWhy it matters
DevelopersBuild and maintain the software, run the leak site and payment infrastructureThey rent it out and take a cut — they rarely attack anyone directly
AffiliatesDo the actual break-ins using the rented toolkitYou don’t need technical depth to run an attack any more
Access brokersBreak into networks and sell that access to whoever wants itYour network can be sold as a product before anyone encrypts anything
NegotiatorsHandle the victim chat, apply pressure, arrange paymentProfessionalised, scripted, and experienced at reading desperation

This division of labour explains a lot. It explains why attacks are so consistent in method — affiliates follow playbooks. It explains why groups reappear under new names after being disrupted — the people move, the brand changes. And it explains why paying keeps the machine running: every payment funds the next round of development.

Should victims pay?

This is a decision for the organisation with legal counsel and law enforcement, and the honest position is that there is no clean answer. What can be said factually:

  • Paying buys a decryption key that often works imperfectly — restoration from decryptors is typically slow and incomplete.
  • Paying for deletion of stolen data buys a promise. The Change Healthcare case shows what that promise can be worth.
  • Organisations that pay are disproportionately targeted again, sometimes by the same affiliate.
  • In some jurisdictions, payments to sanctioned groups carry legal exposure of their own.
  • Recovery from clean backups is usually faster than decryption — when those backups exist and have been tested.

Which is why the real decision is made long before the ransom note: an organisation that can restore has options, and an organisation that cannot has only one.

Defending against it, in priority order

Tick these off as you read — they’re ordered by how much protection they buy per unit of effort, and the first three stop the majority of real-world attacks outright.

Defence checklist

tap to tick

If it happens anyway. Isolate affected machines from the network but don’t power them off — useful evidence lives in memory. Don’t delete anything. Contact law enforcement and your cyber insurer early, since both may have resources and requirements you need. Assume data was stolen and plan your notifications accordingly. And resist the urge to restore in a rush: rebuilding into a network the attacker still has access to is a well-trodden way to be encrypted twice.

Four myths worth deleting

“We’re too small to be a target.”

Most attacks aren’t targeted at all — they’re opportunistic, driven by automated scanning for exposed systems and weak credentials. Small organisations are attacked constantly, precisely because they’re less likely to have monitoring, and a smaller ransom is still profit for a group running dozens of attacks a month.

“Our antivirus will catch it.”

Antivirus catches known malicious files. It struggles with an attacker who logs in with valid credentials and uses your own administration tools — which is exactly what most modern intrusions look like. Detection has to cover behaviour, not just files.

“We have backups, so we’re fine.”

Backups solve half the problem, and only if they’re offline and tested. They do nothing about stolen data being published, and connected backups are routinely destroyed by the attacker before encryption begins.

“It happens instantly when someone clicks.”

Encryption is the final act, often days or weeks after the initial break-in. That gap is the defender’s real opportunity — every attack that gets detected during it is an attack you never hear about.

Check yourself

Five questions. Open each to check — the correct option is marked.

1. At what point in a ransomware attack does encryption happen?
  • Immediately when someone clicks a link
  • Last, often days or weeks after the initial break-in
  • Before the attacker gets administrator access
  • Only after the ransom is refused

Encryption is stage six of six. Everything before it is invisible to most organisations, and it’s where the attack can still be stopped.

2. What was the entry point in the Colonial Pipeline attack?
  • A zero-day exploit in industrial control systems
  • A malicious email attachment opened by an executive
  • A disused VPN account with a leaked password and no MFA
  • A compromised software update

No sophistication required. One old account, one reused password, no second factor — and half the US East Coast’s fuel supply stopped moving.

3. Why do attackers steal data before encrypting it?
  • Encryption doesn’t work without a copy
  • So that good backups don’t remove the victim’s reason to pay
  • To test whether the files are valuable
  • It makes the encryption faster

Double extortion is the answer to backups. Restore everything and refuse to pay, and they publish your customers’ data instead.

4. Which single control would have prevented the most cases in this article?
  • Antivirus software
  • Employee phishing training
  • Multi-factor authentication on internet-facing access
  • A stronger firewall

Colonial Pipeline and Change Healthcare both came down to remote access without MFA. It’s unglamorous and it’s the highest-value control most organisations can deploy.

5. Why is a permanently connected backup drive a problem?
  • It wears out faster
  • Ransomware encrypts anything writable, and attackers destroy backups first
  • It slows the network down
  • It isn’t a problem

Attackers hunt for backups deliberately, because a company that can restore is a company that won’t pay. Offline or immutable is the requirement.

Frequently asked questions

How does ransomware get onto a computer?

Most commonly through stolen or guessed credentials on remote access systems without multi-factor authentication, through unpatched internet-facing software, or through a convincing email attachment or link. Less often, through a compromised software update from a trusted supplier.

How long does a ransomware attack take?

The encryption itself takes hours. The intrusion leading up to it commonly takes days to weeks, during which attackers explore the network, escalate their access, and copy data out. The visible part is the very end of a long, quiet process.

Can encrypted files be recovered without paying?

Sometimes. Free decryptors exist for older or flawed ransomware families, and projects like No More Ransom collect them. For current strains with correctly implemented encryption, breaking it is not realistic — recovery means restoring from backups.

Does paying the ransom actually work?

Partially, often. Decryption keys usually work but restoration is typically slow and imperfect, and promises to delete stolen data are unverifiable — the Change Healthcare case ended with a second gang demanding a second ransom for the same data. Paying also marks an organisation as willing to pay.

What should a small business do first?

Turn on multi-factor authentication everywhere, especially email and any remote access. Then get backups that are disconnected from the network and actually test restoring from them. Those two steps cost very little and remove the majority of realistic attack paths.

The takeaway

Ransomware is not really a story about encryption. It’s a story about access — how someone gets in, how far they can move once inside, and how long they can stay before anyone notices. The encryption at the end is just the invoice.

Which is why the defences that matter are so unglamorous. Not clever software, but multi-factor authentication on the front door, patches applied on time, backups the attacker can’t reach, and a plan that has been rehearsed before it’s needed. Colonial Pipeline, Change Healthcare, WannaCry — every one of them turns on something a checklist would have caught.

If you take one action after reading this, make it the smallest one: check whether multi-factor authentication is switched on for your email and any remote access you use. That single setting appears in the story of more prevented attacks than anything else in this article.

ransomwarecybersecuritymalwarephishingdata breachMFA

The post Ransomware: How It Works and How It Spreads appeared first on Learn With Examples.

]]>
https://learnwithexamples.org/ransomware-how-it-works-spreads/feed/ 0 848
Big O Notation Explained with Real Examples https://learnwithexamples.org/big-o-notation-explained/ https://learnwithexamples.org/big-o-notation-explained/#respond Tue, 04 Aug 2026 17:20:21 +0000 https://learnwithexamples.org/?p=842 · Learn With Examples · Big O is not maths for its own sake. It is a one-line answer to the only question that matters when your data grows: does…

The post Big O Notation Explained with Real Examples appeared first on Learn With Examples.

]]>

· Learn With Examples ·

Big O is not maths for its own sake. It is a one-line answer to the only question that matters when your data grows: does this code get a little slower, or does it fall off a cliff?

Reading time13 min
LevelBeginner → Practical
Includes3 explorers

Here’s the moment Big O suddenly makes sense to people. I once watched a junior developer ship a feature that checked a list of orders for duplicates. It worked perfectly. Tests passed, code review passed, demo went beautifully. Three months later the same feature took nine minutes to load and brought a support queue to a standstill.

Nothing had changed in the code. The only thing that changed was the number of orders — from about 300 to about 40,000. His approach compared every order against every other order, so the work grew with the square of the list. Going 130 times bigger made it roughly 17,000 times slower.

Big O notation is how you spot that in advance, in about ten seconds, without running anything. It’s a shorthand for describing how the work an algorithm does grows as its input grows — and once you can read it, that nine-minute disaster becomes something you catch during code review instead of during an outage.

The one-paragraph version

What Big O actually says

Big O describes the growth rate of an algorithm’s work as the input size n increases. It deliberately ignores hardware, programming language, and constant factors, because those change by a factor of two or ten — while growth rates change by a factor of millions.

O(1) means the input size doesn’t matter at all. O(log n) means work barely grows. O(n) means it grows in step. O(n²) means doubling the input quadruples the work. That last one is where systems die.

The idea in one picture

Everything else in this article is detail attached to this one shape. Watch what happens to each line as you move right along the horizontal axis — that axis is your data growing over the life of your product.

input size n → operations → O(n log n) O(n²) O(n) O(log n) O(1)
The same five classes, drawn to scale. Notice that near the left edge they’re all bunched together — which is exactly why a slow algorithm looks fine in testing and only reveals itself in production.

That bunching on the left is the trap. With 20 test records, an O(n²) function and an O(n) function both return instantly. There is no observable difference. The difference only exists at scale, which means you cannot discover it by testing on small data — you have to reason about it. That reasoning is what Big O gives you.

The classes, with examples you’ll recognise

There are only six you meet regularly. Tap through them — each one has a plain-English meaning, a real piece of code, and an everyday analogy that makes the growth rate obvious.

Complexity explorer

tap a class

O(1)  Constant time

The work never changes, no matter how big the input gets. Looking up one item takes the same time in a list of ten or ten million.

Real example: fetching a value from a dictionary or hash map, reading array[500], pushing onto a stack, checking whether a number is even.

Analogy: opening a specific page in a book when you already know the page number. The book’s thickness is irrelevant.

O(log n)  Logarithmic time

Each step throws away half the remaining work. Doubling the input adds just one extra step — which is why this class stays fast at absurd scales.

Real example: binary search in a sorted array, finding a record in a balanced tree index, the depth of a database B-tree.

Analogy: the guessing game. “Is it higher or lower?” finds a number between 1 and a million in 20 guesses, because each guess halves the range.

Bars scaled to their own maximum — notice how the growth flattens out almost immediately.

O(n)  Linear time

Work grows in lockstep with the input. Twice the data, twice the time. Perfectly respectable, and often unavoidable — if you must look at every item, you cannot beat linear.

Real example: finding the largest number in an unsorted list, counting words in a document, validating every row of a CSV.

Analogy: reading every name on a guest list to find one person. A list twice as long takes twice as long.

O(n log n)  Linearithmic time

A linear pass repeated across a logarithmic number of levels. Slightly worse than linear, dramatically better than quadratic, and the practical ceiling for comparison-based sorting.

Real example: merge sort, quicksort on average, and every sort() in every standard library you have ever used.

Analogy: splitting a deck of cards in half repeatedly, then merging the piles back in order. You touch every card at each of about ten levels.

O(n²)  Quadratic time

Every item is compared against every other item. Double the input and the work quadruples. This is the class that quietly kills features six months after launch.

Real example: the duplicate-checking loop from the opening story, bubble sort, comparing every pair of records to find matches, a nested loop over the same list.

Analogy: every guest at a party shaking hands with every other guest. Ten guests means 45 handshakes; a hundred guests means 4,950.

O(2ⁿ)  Exponential time

Adding a single item doubles the work. Usable for tiny inputs and hopeless past roughly 40 items — at n = 60 you are past the age of the universe.

Real example: generating every possible subset, naive recursive Fibonacci, brute-forcing a password, solving the travelling salesman by trying every route.

Analogy: the grain-of-rice-on-a-chessboard story. Doubling per square sounds harmless until square 64 needs more rice than exists on Earth.

Why the difference is so violent

Abstract symbols don’t frighten anyone. Actual step counts do. Pick an input size below and look at how the same six classes behave on it.

Steps required, by input size

pick an n
ClassTypical operationSteps for n = 10Time at 1 billion ops/sec
O(1)Look up a key in a hash map1instant
O(log n)Binary search a sorted list3instant
O(n)Scan every item once10instant
O(n log n)A good sort33instant
O(n²)Compare every pair100instant
O(2ⁿ)Try every subset1,0241 microseconds
ClassTypical operationSteps for n = 100Time at 1 billion ops/sec
O(1)Look up a key in a hash map1instant
O(log n)Binary search a sorted list7instant
O(n)Scan every item once100instant
O(n log n)A good sort664instant
O(n²)Compare every pair10,00010 microseconds
O(2ⁿ)Try every subsetbeyond countinglonger than the universe has existed
ClassTypical operationSteps for n = 1,000Time at 1 billion ops/sec
O(1)Look up a key in a hash map1instant
O(log n)Binary search a sorted list10instant
O(n)Scan every item once1,0001 microseconds
O(n log n)A good sort9,96610 microseconds
O(n²)Compare every pair1.0 million1 ms
O(2ⁿ)Try every subsetbeyond countinglonger than the universe has existed
ClassTypical operationSteps for n = 1,000,000Time at 1 billion ops/sec
O(1)Look up a key in a hash map1instant
O(log n)Binary search a sorted list20instant
O(n)Scan every item once1.0 million1 ms
O(n log n)A good sort19.9 million20 ms
O(n²)Compare every pair1 trillion17 minutes
O(2ⁿ)Try every subsetbeyond countinglonger than the universe has existed

Swipe the table sideways on a narrow screen →

One billion operations per second is roughly a fast modern CPU doing simple work. The point is not the exact seconds — it is how violently the bottom two rows change as n grows.

Read across the O(n²) row as you switch sizes. At a thousand items it’s a million steps — a blink. At a million items it’s a trillion steps, and your feature is now a fifteen-minute job that times out. Nothing about the code changed. Only n did.

A faster computer buys you a constant factor. A better algorithm buys you a different curve. Only one of those scales.

The two rules that make Big O readable

Big O deliberately throws information away, and the two things it throws away trip up every beginner. Both rules exist for the same reason: at large n, only the fastest-growing part matters.

Rule 1 — drop the constants

An algorithm that does 3n + 12 operations is written O(n), not O(3n + 12). That looks like cheating, but consider: at a million items, 3n is three million and n² is a trillion. The constant 3 is noise beside that gap. And constants change anyway — a faster CPU, a better compiler, or a different language shifts them freely, while the shape of the curve does not.

Rule 2 — keep only the dominant term

An algorithm costing n² + 500n + 9000 is O(n²). At n = 10, the 500n part is actually bigger. At n = 10,000, the n² term is 100 million and the rest is five million — the square has swallowed everything. Big O describes where things end up, not where they start.

The honest caveat. Those discarded constants sometimes matter enormously in practice. An O(n log n) algorithm with a huge constant can lose to an O(n²) one on lists of thirty items — which is exactly why real sorting libraries switch to insertion sort for small chunks. Big O tells you what happens as data grows. It does not promise which is faster today, on your data, at your size.

How to find the Big O of code you’re looking at

You don’t need to count operations. Four patterns cover almost everything you’ll meet in ordinary application code.

What you seeWhat it meansResult
Statements one after anotherCosts add, then the biggest one winsO(a) + O(b) → the larger of the two
A loop over the inputBody runs n timesn × cost of the body
A loop inside a loopCosts multiplyUsually O(n²)
Input halves each stepOnly log₂n steps possibleO(log n)

Two things people get wrong constantly. First, two loops side by side are not quadratic — they’re n + n = 2n, which is linear. Nesting is what multiplies, not adjacency. Second, a loop with a fixed bound isn’t linear: looping 100 times regardless of input is constant work, because 100 doesn’t grow with n.

Five snippets — guess before you open

Read each one, decide, then open it. These are the shapes that actually appear in real code.

1. Checking a list for duplicates the obvious way
for i in range(len(orders)): for j in range(i + 1, len(orders)): if orders[i].id == orders[j].id: flag(orders[i])

O(n²) — a loop inside a loop over the same list. It runs about n²/2 times, and dropping the constant leaves n². This is the exact code from the opening story. The fix is a set: add each id to a set and check membership, turning it into O(n) with O(n) extra memory. Nine minutes becomes a fraction of a second.

2. Two loops, one after the other
for user in users: send_welcome(user) for user in users: log_signup(user)

O(n) — not O(n²). Sequential loops add: n + n = 2n, and the constant 2 gets dropped. Merging them into one loop makes the code twice as fast in wall-clock terms but leaves the complexity class unchanged. That distinction — real speedup, same Big O — is worth internalising.

3. Halving the search space
lo, hi = 0, len(sorted_items) - 1 while lo <= hi: mid = (lo + hi) // 2 if sorted_items[mid] == target: return mid if sorted_items[mid] < target: lo = mid + 1 else: hi = mid - 1

O(log n) — binary search. Each pass discards half of what’s left, so a billion items takes about 30 passes. The catch is the precondition: the list must already be sorted, and sorting costs O(n log n). Sorting once to search many times is a great trade; sorting once to search once is not.

4. A nested loop that isn’t quadratic
for order in orders: # n orders for tax in TAX_BANDS: # always 7 bands apply(order, tax)

O(n) — linear, despite the nesting. The inner loop’s length is fixed at 7 and never grows with the input, so the total is 7n, and the 7 is a constant. Nesting only multiplies complexity when both loops scale with the input. Judge by what grows, not by indentation.

5. The classic recursive trap
def fib(n): if n <= 1: return n return fib(n - 1) + fib(n - 2)

O(2ⁿ) — each call spawns two more, so the call tree roughly doubles at every level. fib(30) makes about 1.6 million calls; fib(50) would run for days. Caching results (memoisation) collapses it to O(n), because each value is then computed exactly once. Same algorithm on paper, a difference of billions in practice.

Best, average and worst case

One algorithm can have three different complexities depending on what you feed it. Searching an unsorted list for a name: if it’s first, you’re done in one step; if it’s last or missing, you check all n.

Best case

The luckiest possible input. Mostly useless for planning — nobody guarantees you luck.

Average case

What typical data does. The most honest number for everyday performance work.

Worst case

The input designed to hurt you. This is what Big O usually reports, and what you should plan around.

The default assumption when someone says “this is O(n log n)” is worst case, unless they say otherwise. That’s deliberately pessimistic, and it’s the right default: your worst case will eventually arrive, and it tends to arrive at the busiest moment. Quicksort is the cautionary tale — O(n log n) on average, O(n²) when the pivots go badly, and the input that triggers it is the very ordinary case of already-sorted data.

Space complexity counts too

Big O describes memory as readily as time. An in-place sort uses O(1) extra space; merge sort needs a scratch array, so O(n). The duplicate-checking fix above trades memory for speed — building a set of every id costs O(n) space to save you from O(n²) time. That trade is almost always worth taking, and recognising when it’s available is most of practical optimisation.

Where this actually matters

Code review

Spotting a nested loop over two growing collections takes seconds and prevents the outage three months later.

Choosing data structures

Array lookup by index is O(1); searching an array is O(n); a hash map turns that search into O(1). Most real speedups are structure changes, not clever code.

Database work

An index converts an O(n) table scan into an O(log n) lookup. That’s the whole reason indexes exist.

Interviews

“What’s the complexity?” is asked in nearly every technical interview, and the follow-up is always “can you do better?”

Don’t over-apply it. If your list has 50 items and always will, an O(n²) loop is completely fine and probably clearer to read. Big O matters when n can grow — and the real skill is asking “how big can this get?” before optimising anything. Most performance work is wasted on code that was never going to be the bottleneck.

Check yourself

Five questions. Open each to check — the correct option is marked.

1. An algorithm takes 4n + 200 steps. What is its Big O?
  • O(4n + 200)
  • O(n)
  • O(200)
  • O(n²)

Drop constants and lower-order terms — only the growth rate survives, and this one grows linearly.

2. Two separate loops over the same list of n items. Total complexity?
  • O(n²)
  • O(n)
  • O(2n²)
  • O(log n)

Sequential loops add — n + n = 2n, which is O(n). Only nested loops multiply.

3. Which class describes binary search on a sorted array?
  • O(1)
  • O(log n)
  • O(n)
  • O(n log n)

Each comparison eliminates half the remaining candidates, so a billion items needs only about 30 steps.

4. Your O(n²) function handles 1,000 records in one second. Roughly how long for 10,000?
  • 10 seconds
  • About 100 seconds
  • 1 second
  • 3 seconds

Ten times the input means a hundred times the work, because the growth is quadratic. This is the calculation to do before shipping, not after.

5. You replace a nested-loop duplicate check with a hash set. What changed?
  • Time O(n²) → O(n), memory unchanged
  • Time O(n²) → O(n), memory O(1) → O(n)
  • Nothing changes
  • Time gets worse, memory improves

You bought a much better time complexity by spending memory on the set. Recognising that trade is most of practical optimisation.

Frequently asked questions

What is Big O notation in simple terms?

It’s a shorthand for how an algorithm’s work grows as its input grows. O(n) means the work grows in step with the data; O(n²) means doubling the data quadruples the work. It describes the shape of that growth, not a measurement in seconds.

Why do we ignore constants in Big O?

Because constants depend on hardware, language and compiler, and they change by small factors — while growth rates change by factors of millions. At a million items the difference between 3n and n is trivial; the difference between n and n² is a trillion steps.

Is O(1) always faster than O(n)?

Not necessarily at small sizes. A constant-time operation with heavy overhead can lose to a linear scan of ten items. Big O describes behaviour as n grows large, so it’s a statement about trends, not a guarantee about any particular input.

What’s a good Big O to aim for?

O(1) and O(log n) are excellent, O(n) is usually fine and often unavoidable, O(n log n) is the practical target for sorting. Treat O(n²) as a warning sign worth investigating, and anything exponential as unusable beyond tiny inputs.

Do I need Big O if I’m not doing interviews?

Yes, though you’ll use it informally. You don’t need the formal maths, but you do need the instinct that says “this loop is inside that loop, and both grow with the data” — that instinct is what stops a working feature becoming an outage once real data arrives.

The takeaway

Big O answers one question: as your data grows, does this code degrade gently or catastrophically? O(1) and O(log n) barely notice. O(n) and O(n log n) scale honestly. O(n²) and worse are fine on toy data and fatal on real data.

You don’t need to derive it formally. You need to look at a function and ask two questions: what grows here, and is anything nested inside anything else that also grows? That habit catches the overwhelming majority of real performance problems, long before they reach production.

Try it on something you wrote this week. Find your longest loop, ask what its input can realistically grow to, and check whether anything scaling sits inside it. That’s the whole practice — and it takes about thirty seconds once the six shapes above are familiar.

big o notationtime complexityalgorithmsspace complexityperformancecomputer science

The post Big O Notation Explained with Real Examples appeared first on Learn With Examples.

]]>
https://learnwithexamples.org/big-o-notation-explained/feed/ 0 842