Programming languages

HTML wraps content in tags, such as <h1> for the main heading, <a> for a link and <form> for a form, and the browser turns that markup into a page. Strictly it is a markup language rather than a programming language: it says what each piece of content is, while CSS decides how it looks and JavaScript makes it respond.

Choosing the right element (semantic HTML such as <nav>, <main>, <button> and <label>) matters more than it looks. Screen readers, search engines, keyboard navigation and reader modes all depend on it, and a real <button> works with the keyboard for free where a styled <div> does not. HTML is a living standard maintained by WHATWG, so features such as dialogs and lazy-loaded images arrive without big numbered versions.

A CSS rule picks elements with a selector and sets properties on them, such as making every link blue or laying out a product list as a grid. 'Cascading' describes how the browser settles conflicts when several rules apply: the more specific rule wins, and among equals the later one. That cascade is powerful, and also the usual reason a style mysteriously refuses to apply.

Modern CSS handles work that once needed JavaScript or add-on tools: Flexbox and Grid for layout, media and container queries for responsive design, custom properties (variables), nesting, the :has() selector, transitions and animations. Other tools build on CSS rather than replace it: Sass adds extra syntax, and Tailwind CSS generates small utility classes that you combine in the HTML.

JavaScript is the only programming language browsers run directly, apart from WebAssembly. It reacts to clicks and typing, changes the page through the DOM, fetches data from APIs, and powers frameworks such as React, Vue and Svelte. It was created at Netscape in 1995 and is standardised as ECMAScript, which gains a new edition every year.

It is dynamically typed: a variable can hold a number now and text later, and type mistakes surface only when the code runs. Work that waits, such as a network request, runs asynchronously on an event loop with promises and async/await, so one slow task does not freeze the page. Node.js, Deno and Bun run the same language on servers, so one team can use one language across the whole product.

Its package registry, npm, holds millions of packages. The flip side is a sprawling ecosystem where tools and fashions change quickly, and a few historical quirks, such as loose equality with == and automatic type conversion, that catch newcomers out.

TypeScript, released by Microsoft in 2012, is a superset of JavaScript: any JavaScript file is a valid starting point, and you add type annotations such as name: string where they help. The compiler checks that values are used consistently, then strips the types and outputs plain JavaScript, so browsers and servers never see TypeScript itself.

Types are inferred wherever possible, so much of the code needs no annotations at all. The payoff shows up in the editor: precise autocomplete, safe renaming across files and errors underlined as you type. Most popular libraries ship their own types, and tools such as Zod, Prisma and tRPC use them to carry one definition from the database to the screen.

Deno and Bun run .ts files directly, and recent Node.js versions can strip the types and run them too. In larger builds, fast tools such as esbuild and SWC remove the types while the tsc compiler does the checking, often only in the editor and in CI.

WebAssembly (Wasm) is rarely written by hand. Compilers turn Rust, C, C++, Go, Kotlin, C# and other languages into a .wasm file, which the browser loads, checks and runs inside the same security sandbox as JavaScript. It became a W3C standard in 2019 and runs in every major browser.

It suits heavy, well-defined work: image and video editing, games, CAD, codecs and encryption, or bringing an existing C++ library to the web; Figma and Photoshop on the web rely on it. Wasm cannot touch the page directly, so it works alongside JavaScript, which handles the DOM. Outside the browser, WASI and runtimes such as Wasmtime run Wasm modules on servers, and edge platforms such as Cloudflare Workers can run them too.

PHP runs on the server: when a page is requested, PHP code builds the HTML (or JSON) and sends it back. Each request starts fresh and shares nothing with the last, which keeps hosting simple and stops one broken page from taking down the rest. It began in 1994 as a few tools for a personal home page and grew into a full language.

Modern PHP is far from its messy reputation. Versions 7 and 8 brought large speed gains, type declarations, enums, attributes and a JIT compiler, and Composer manages packages. Laravel and Symfony are the main frameworks, and WordPress, Drupal, WooCommerce and Magento are all written in PHP.

Python reads almost like plain English and groups code by indentation instead of braces, which is one reason it is so often the first language people learn. Guido van Rossum released it in 1991, and Python 3 is the only version still maintained. The standard library covers files, networking, JSON, dates and much more before anything is installed.

Its reach comes from libraries: NumPy and pandas for data, PyTorch and scikit-learn for machine learning, Django, Flask and FastAPI for web backends, and countless packages for automation. Packages come from PyPI through pip, or through uv, a much faster newer tool, usually inside a separate virtual environment for each project.

The standard interpreter is slow at pure-Python loops, which is why data and AI libraries do their heavy lifting in C, C++ or Rust underneath. The global interpreter lock (GIL) has long stopped threads running Python code in parallel; recent versions offer an optional build without it. Type hints are optional and checked by tools such as mypy and Pyright rather than by Python itself.

Java code compiles to bytecode that runs on the Java Virtual Machine (JVM), so the same program runs on Windows, macOS, Linux and servers alike: the original 'write once, run anywhere' promise. It is statically typed and object-oriented, with automatic memory management (garbage collection). Sun Microsystems released it in 1995; Oracle owns it now, and development happens in the open-source OpenJDK project.

It is a workhorse of enterprise software: banks, insurers, retailers and governments run huge Java systems, often on Spring Boot, and data tools such as Kafka, Hadoop and Elasticsearch are built on the JVM. Android apps were written in Java for their first decade, and Android still runs Java libraries, although Kotlin is now Google's recommended language.

Java was long criticised as verbose, and modern releases have steadily trimmed that with records, pattern matching, text blocks, the var keyword and lightweight virtual threads for handling many requests at once. A long-term support (LTS) release arrives every two years.

C# is statically typed and object-oriented, with a garbage collector, and it has absorbed good ideas steadily: LINQ queries, async/await (which C# popularised), pattern matching and records. Microsoft introduced it in 2000; its lead designer, Anders Hejlsberg, later led the design of TypeScript. It runs on .NET, open source and cross-platform since 2016, so C# apps run on Linux servers and Macs as well as Windows.

ASP.NET Core is a fast framework for web APIs and sites, and Blazor runs C# in the browser through WebAssembly. .NET MAUI targets phones and desktops, Unity uses C# for game scripting, and a great deal of corporate software on Windows is written in it.

Kotlin runs on the JVM and works hand in hand with Java: a project can mix both, and Kotlin calls any Java library directly. It removes much of Java's ceremony with type inference, data classes, extension functions and smart casts, and its type system separates values that may be null from values that cannot, which prevents a very common cause of crashes in Java apps.

Google made Kotlin an official Android language in 2017 and declared Android development 'Kotlin-first' in 2019. Jetpack Compose, the modern way to build Android screens, is Kotlin-only, and coroutines and Flow handle background work and streams of data without tangles of callbacks.

Beyond Android, Kotlin runs servers with Ktor or Spring Boot, and Kotlin Multiplatform shares business logic (and, with Compose Multiplatform, screens) across Android, iOS, desktop and the web.

Apple introduced Swift in 2014 as the successor to Objective-C and made it open source in 2015. It is statically typed and compiles to fast native code, and memory is managed by automatic reference counting (ARC) rather than a garbage collector. Optionals force code to handle missing values explicitly, closing off a common source of crashes.

Nearly all new Apple-platform work is written in Swift, and SwiftUI builds interfaces declaratively in it. Recent versions check concurrent code for data races at compile time, using async/await and actors. Swift also runs on Linux and Windows, with server frameworks such as Vapor, but its community is centred on Apple.

In practice, building and publishing iPhone apps needs Xcode, which runs only on macOS, so a Mac is part of the kit.

Dart looks familiar to anyone who knows Java, C# or JavaScript: classes, async/await, generics and sound null safety, meaning the compiler guarantees that a value declared non-null never is. Google introduced it in 2011, and nearly all of its popularity today comes from Flutter.

Its compiler is built around the way Flutter works. During development, code runs in a virtual machine with hot reload, so a change appears in the running app within a second or so without losing its state. For release, Dart compiles ahead of time to native ARM or x64 code for phones and desktops, and to JavaScript or WebAssembly for the web.

Rust offers the speed and low-level control of C and C++, but its compiler enforces rules about ownership: every value has one owner, and the 'borrow checker' makes sure memory is freed exactly once and never used after it is gone. Data races between threads are ruled out the same way, so mistakes that would be security holes in C become compile errors.

It began at Mozilla and reached 1.0 in 2015. Cargo, its build tool and package manager, handles dependencies, builds, tests and documentation, and packages (crates) come from crates.io. Rust now runs inside the Linux kernel, Windows, Android, Firefox and Cloudflare's network, and tools such as Tauri, ripgrep and uv are written in it.

The price is a steep learning curve and slow compiles: the compiler rejects code until it can prove it safe, which frustrates newcomers, even though its error messages are unusually helpful.

Go was designed at Google by Robert Griesemer, Rob Pike and Ken Thompson, announced in 2009 and stable since 1.0 in 2012. Its feature set is small on purpose, so most Go code looks alike and is easy to read. It compiles in seconds to a single self-contained binary, which makes deployment as simple as copying one file, and a garbage collector tuned for short pauses manages memory.

Concurrency is part of the language: a goroutine is a very lightweight thread, thousands can run at once, and channels pass data between them safely. That suits network servers, which is why so much cloud infrastructure is written in Go, including Docker, Kubernetes, Terraform, Prometheus and Caddy.

Generics arrived only in 2022, and errors are handled with explicit if err != nil checks rather than exceptions, which some find tedious and others find clear.

C was created at Bell Labs in the early 1970s to write Unix, and it is still the language of operating system kernels (Linux, and much of Windows and macOS), embedded devices and core libraries such as SQLite and PostgreSQL. It is small, maps closely to what the hardware does, and leaves memory management to the programmer.

C++, started by Bjarne Stroustrup in 1979 and first released in 1985, adds classes, templates and a large standard library on top of C. It powers Chrome, Firefox and most game engines, including Unreal, as well as trading systems, databases and audio and video software. A new standard every three years keeps it evolving.

Both compile to very fast machine code, but neither stops a program from reading past the end of an array or using memory after it has been freed. Microsoft and Google have each reported that most of their serious security bugs are memory-safety mistakes of this kind, which is why more new systems code now starts in Rust.

SQL is declarative: you describe the result you want, such as all paid orders from last week with each customer's name, and the database works out how to fetch it. SELECT reads data, INSERT, UPDATE and DELETE change it, JOIN combines tables, GROUP BY summarises, and CREATE TABLE defines the structure.

It grew out of IBM research in the 1970s, based on Edgar Codd's relational model, and has been an ANSI and ISO standard since the 1980s. Every database adds its own dialect (T-SQL in SQL Server, PL/pgSQL in PostgreSQL), so the basics transfer everywhere while advanced features differ. Analysts and product managers use it as much as developers, and data warehouses such as BigQuery and Snowflake speak it too.

Building SQL by pasting user input into a string invites SQL injection, a long-standing and serious attack, so apps pass values separately as parameters, or use an ORM or query builder that does it for them.

A shell is the program that reads the commands typed into a terminal. A shell script saves those commands in a file, with variables, loops and conditions, so a job of twenty manual steps becomes one command. Bash is the standard on Linux servers, Zsh is the default on macOS, and plain POSIX sh is the lowest common denominator that runs almost anywhere.

Scripts glue other programs together: a pipe sends one command's output into the next (find the files, filter them with grep, count them with wc), which is why so many CI pipelines, Dockerfiles, deploy steps and cron jobs are shell. On Windows, PowerShell plays the same role but passes structured objects between commands instead of plain text; it is open source and runs on macOS and Linux too.

Shell is easy to start and easy to get wrong: unquoted variables break on file names with spaces, and failed commands are ignored unless the script opts in to stopping, for example with set -euo pipefail. The ShellCheck linter catches most of these mistakes. Once a script grows past a page or two, Python is usually the better tool.