Chmod Calculator

How octal permissions work

Each file has three sets of permissions: one for its owner (u), one for its group (g) and one for others (o), everyone else. Each set is three bits — read, write and execute — and an octal digit is simply their sum: read is 4, write is 2 and execute is 1. So 7 is rwx (4+2+1), 6 is rw- (4+2), 5 is r-x (4+1) and 4 is r-- on its own.

Three digits make the whole mode, in the order owner, group, others. chmod 755 therefore gives the owner rwx and everyone else r-x, written rwxr-xr-x, while chmod 644 gives the owner rw- and everyone else r--, written rw-r--r--. A fourth digit in front holds the special bits: 4 for setuid, 2 for setgid and 1 for sticky, as in chmod 1777.

Common chmod values

644 (rw-r--r--)

The default for ordinary files: the owner can edit, everyone can read. Right for HTML, images and most configuration.

755 (rwxr-xr-x)

The default for directories and for scripts and programs: everyone can read and run, only the owner can change.

600 (rw-------)

Private files only the owner can read: SSH private keys, .env files, credentials. ssh refuses a private key that others can read.

700 (rwx------)

A private directory, such as ~/.ssh, that only its owner can enter.

664 / 775

Like 644 and 755, but the group can write too: for shared project folders where colleagues share a group.

777 (rwxrwxrwx)

Anyone can read, change and run. Almost never the right fix for a permission error, and a security risk on a web server.

1777 (rwxrwxrwt)

World-writable with the sticky bit, as on /tmp: everyone can create files, but only a file's owner can delete it.

Permissions on directories

On a directory the three letters mean something different. Read lets you list the names inside it; write lets you create, rename and delete entries in it; execute (often called search) lets you enter it with cd and reach the files inside by name. Write and read are of little use without execute, which is why directories almost always have x wherever they have r — 755 rather than 644.

Deleting a file is a change to its directory, not to the file. Anyone with write and execute permission on a directory can delete any file in it, even a read-only file they do not own — unless the directory has the sticky bit.

Setuid, setgid and the sticky bit

In the symbolic form the special bits replace the execute letter: s when execute is also set and S when it is not, and t or T for the sticky bit. A capital letter usually means a mistake, because a setuid program nobody can execute does nothing.

One GNU coreutils quirk: chmod 755 on a directory keeps an existing setuid or setgid bit. To clear them with a number, write five digits — chmod 00755 — or use chmod g-s.

Setuid (4000, u+s)

An executable runs with its owner's privileges rather than the caller's. passwd uses it to write /etc/shadow as root. Linux ignores it on scripts and on directories.

Setgid (2000, g+s)

An executable runs with its group's privileges. On a directory, new files inside inherit the directory's group instead of the creator's primary group — the usual setup for shared team folders (2775).

Sticky bit (1000, +t)

On a directory, only a file's owner, the directory's owner or root can delete or rename the files in it. Modern Linux ignores it on files.

Numeric or symbolic chmod?

A numeric mode such as chmod 644 file sets every bit at once, which is what you want when you know the final state. The symbolic form is more flexible: chmod u=rw,g=r,o=r file sets the same thing, while chmod g+w file or chmod o-rwx file change only the bits named and leave the rest alone.

Be careful with chmod -R: one mode for every file and directory in a tree usually gives files execute bits they should not have. Use find . -type d -exec chmod 755 {} + and find . -type f -exec chmod 644 {} + to treat them separately, or the capital X in chmod -R u=rwX,go=rX, which adds execute only to directories and to files that already had it. New files get their starting permissions from the umask: a umask of 022 gives 644 files and 755 directories. To match file names in shell scripts, try the regex tester.