chmod Calculator

How Unix permissions work

Every file and directory has an owner, a group, and nine permission bits: read, write and execute for each of three classes of user. The owner (chmod calls it u, for user), members of the file's group (g), and others, meaning everyone else (o). When you access a file, the system picks the first class that applies to you and uses only that class's bits.

The same three letters mean different things on files and directories:

Deleting a file is a change to its directory, not to the file, so it is the directory's write permission that decides it. A read-only file in a directory you can write to can still be deleted.

Reading octal: what each digit means

Each digit of a numeric mode is one class, in the order owner, group, others. The digit is the sum of read (4), write (2) and execute (1), so 755 is 7 = 4+2+1 for the owner, and 5 = 4+1 for group and others.

Common permission modes

The special bits: setuid, setgid and sticky

A fourth digit in front of the usual three sets the special bits: 4 for setuid, 2 for setgid, 1 for sticky. In ls -l they replace the execute slot of the owner, group and others respectively, in lowercase when execute is also set and in uppercase when it isn't.

• Setuid (4000, rwsr-xr-x). A program runs with its owner's privileges rather than those of whoever started it. This is how passwd can update a file only root may write. Linux ignores setuid on scripts and on directories.
• Setgid (2000, rwxrwsr-x). On a program, it runs with the file's group. On a directory, new files created inside inherit the directory's group, which keeps a shared team directory usable.
• Sticky (1000, rwxrwxrwt). On a directory, people can delete or rename only their own files, even though everyone can write to it. That is why /tmp is 1777.

GNU chmod keeps a directory's setuid and setgid bits when you give it a three- or four-digit mode. To clear them numerically, use five digits such as 00755, or use g-s.

Symbolic chmod syntax

A symbolic argument changes permissions relative to what's already there, which a numeric mode can't do. It reads as who, operator, permissions: go-w removes write from group and others and leaves everything else alone.

Leaving out who (chmod +x) means all three classes, except that chmod then won't touch any bit your umask masks. With the common umask 022, chmod +w adds write for the owner only.

umask: the permissions new files get

Programs usually create files with mode 666 and directories with 777, and the umask then removes bits from that. It works like a mode written in reverse: each 1 bit in the umask is a permission new files won't get. Run umask to see yours.

Mistakes that cause trouble

• chmod -R 777 to fix an error. It makes everything writable by every account on the machine, including a compromised web server. Find which user needs access and grant that, usually through the group.
• Recursive modes that ignore directories. chmod -R 644 dir removes execute from the directories too, and then nobody can enter them. Use chmod -R u=rwX,go=rX dir, where the capital X gives execute to directories only, or set files and directories separately with find (see the FAQ).
• SSH refusing your key. OpenSSH ignores a private key that others can read and says "UNPROTECTED PRIVATE KEY FILE". Use 600 for the key and 700 for ~/.ssh. The server's sshd also refuses authorized_keys if it, ~/.ssh or your home directory is writable by the group or others.
• Giving the owner less than others. With 077 the owner is locked out even though everyone else has full access, because only the owner bits are checked for the owner.
• Forgetting the path. To open /srv/app/config.yml you need execute on /srv and /srv/app as well as read on the file. A permission error often points at a parent directory.
• The mode isn't the whole story. A + at the end of the ls -l column means an ACL grants or denies extra access (getfacl shows it), and a . means SELinux rules apply as well.

FAQ

What does chmod 755 mean?

The owner can read, write and execute (7), and the group and everyone else can read and execute (5). In ls -l it shows as rwxr-xr-x. It's the normal mode for directories and for programs and scripts others need to run.

What's the difference between 644 and 755?

Only execute. 644 (rw-r--r--) suits ordinary files, which don't need to be run. 755 adds execute for everyone, which a directory needs before anyone can enter it and a script needs before it can be run directly.

What does chmod +x do?

It adds execute permission so the file can be run as ./script.sh. Without a who letter, it applies to owner, group and others, minus anything your umask masks, so under the usual umask 022 a 644 file becomes 755. Use chmod u+x to add it for yourself only.

How do I see a file's permissions as a number?

On Linux, stat -c '%a %n' file prints the octal mode. On macOS, use stat -f '%Lp %N' file. ls -l only shows the symbolic form, which you can paste into this calculator.

How do I set files and directories to different modes?

Use find to separate them: find dir -type d -exec chmod 755 {} + for directories and find dir -type f -exec chmod 644 {} + for files.

Related tools

• Cron Expression Explainer — A cron schedule in plain English, with its next 10 run times.
• X.509 Certificate Decoder — Paste a PEM certificate or chain: subject, names, expiry, fingerprints.
• Format Identifier — Paste anything to find out what it is (a JWT, JSON, a certificate, Base64, a cron schedule and more), then open it in the right tool.

Related glossary terms

• Unix file permissions