How the Web Actually Works · Module 2 · The moving parts you can't see
Client, server, and where the code runs
6 min read · lesson 4 of 4
'Front-end' and 'back-end' name where code runs: in the user's browser, or on the developer's server. The split decides what each side can see, trust and do.
Client-side (your browser)
- Runs on the visitor's device — you can read all of it in DevTools.
- Great for instant interaction: animations, form validation, offline tools.
- Never trust it with secrets: anything in browser code or localStorage is public.
Server-side (the site's server)
- Runs where the developer controls the machine — visitors can't see the code.
- Owns the database, secrets and anything that must be enforced (payments, permissions).
- Responds over HTTP with data (JSON) or whole pages (HTML).
Rule of thumb: enforce every rule that matters on the server. Anything checked only in the browser can be bypassed by the user.
Practice
Open DevTools on any site and read 30 seconds of its client-side code. Then imagine trying to hide an API key there — that's why it must live server-side.