CHMOD Calculator

How the CHMOD Calculator works

Every file and directory on Linux, macOS and other Unix systems carries a permission mode that decides who can read it, change it and run it. Get it wrong one way and a deploy fails with "permission denied"; get it wrong the other way and a private key or a config file full of passwords is readable by every account on the server. This calculator shows every way of writing the same mode, so you can check what a number means before you type it.

How the chmod calculator adds up

A mode has nine basic bits in three groups: the file's owner, the file's group, and public (everyone else, which chmod calls "other"). Each group has read, write and execute, worth 4, 2 and 1. Add them and each group becomes one octal digit, from 0 to 7:

• 7 = read, write and execute (4 + 2 + 1)
• 6 = read and write
• 5 = read and execute
• 4 = read only
• 0 = nothing

Write the three digits side by side and you have the number chmod expects. So 644 means owner read and write, group read, public read, and 755 adds execute for all three.

The rwxr-xr-x string that ls -l prints is the same nine bits spelled out. Read it in threes: rwx r-x r-x is owner, group, public, and a dash means the bit is off. A tenth character at the front is the file type, not a permission: d for a directory, - for a regular file and l for a symlink. You can paste either form into the input box, dash-prefixed or not.

Files and directories read the bits differently

On a file, execute means it can be run as a program or script. On a directory, execute means you can traverse it, entering it and reaching the files inside by name. Read on a directory only lets you list the names. A directory with read but no execute shows its contents and then refuses to open any of them, which is the classic "I can see it but I get permission denied". That is why directories are almost always 755 or 750, while the files inside are 644 or 640.

Where the common modes are used

OpenSSH enforces some of this: it refuses to use a private key that group or public can read, with the warning "UNPROTECTED PRIVATE KEY FILE". chmod 600 ~/.ssh/id_ed25519 is the fix.

The special bits

A fourth leading digit carries three more bits.

• Setuid (4000) makes an executable run as its owner instead of as whoever launched it. It is how passwd can update a root-owned file. On anything you did not write it is a real security risk, and most systems ignore it on scripts.
• Setgid (2000) does the same for the group. On a directory it makes new files inherit the directory's group, which keeps shared project folders shared.
• Sticky (1000) on a directory means only a file's owner can delete or rename it, even when everyone can write to the directory. That is why /tmp is 1777.

In the long string these bits replace the execute letter: s when execute is also on, capital S when it is off, and t or T in the public column. A capital letter usually signals a mistake, since setuid without execute does nothing useful.

Reading the result

• Octal is the three-digit mode, the one most people quote.
• Long string is what ls -l will show after the change.
• 4-digit octal includes the special bits, for example 0755 or 1777.
• Symbolic is the normalised form, such as u=rwx,g=rx,o=rx, which is useful in scripts and Ansible tasks where you want the intent to be readable.
• Command is ready to paste. It uses the four-digit form only when a special bit is set.

Symbolic input is relative. Typing go-w or u+x changes the boxes that are currently ticked, exactly as chmod changes a file's current mode. For example, start from 644, apply u+x and you get 744. The = form is absolute for the groups it names, so u=rwx,go=rx is always 755. Capital X adds execute only if some execute bit is already set, which is how chmod -R a+X makes directories traversable without making every file executable.

Tips and pitfalls

• 777 is not a fix. It lets every account on the machine, including a compromised web process, rewrite the file. Permission errors are almost always about the file's owner or group, so check ls -l and use chown before widening the mode.
• Recursive changes hit files and directories alike. chmod -R 755 makes every file executable. Use find . -type d -exec chmod 755 {} + and a matching -type f pass with 644.
• umask sets the starting point. New files are created as 666 minus the umask, so a umask of 022 gives 644, and new directories get 755.
• Some filesystems ignore modes. FAT, exFAT and many network shares fake the bits, so a chmod there can appear to succeed and change nothing.

Octal is just base 8, so the base converter will show a mode in binary if you want to see the bits laid out. For scheduling the scripts you have just made executable, try the cron expression tool.

Related tools