Chmod Calculator: Octal, Symbolic & Linux Permissions

How Unix permissions add up

Every file on Linux and macOS has three sets of permissions: owner, group and others. Each set has three switches: read, write and execute. Read is worth 4, write 2, execute 1. Add the switches you want and you get one digit from 0 to 7. Three digits, one per set, is the octal mode. That is the whole trick.

So 755 means owner 7 (4+2+1, everything), group 5 (4+1, read and execute), others 5. And 644 means owner 6 (read and write), group 4 and others 4 (read only). Tick the boxes above and the digits update, or type a number and the boxes follow.

Execute means different things for files and directories. On a file it means you can run it. On a directory it means you can enter it and reach the files inside. A directory with read but no execute lets you list names but not open anything, which is almost never what you want. Directories almost always need x wherever they have r.

The modes you will actually use

644 for ordinary files: HTML, config, images. You can edit, everyone else can read. 755 for scripts and directories. 600 for secrets like .env files and API keys: only you can read or write. 700 for private directories such as ~/.ssh. 400 for SSH private keys. OpenSSH refuses a private key that group or others can read and prints the familiar UNPROTECTED PRIVATE KEY FILE warning. chmod 400 or 600 fixes it.

777 is the one to avoid. It lets every user on the machine write to the file. On a shared or web server that means any compromised process can replace your code. If a tutorial tells you to chmod 777 to fix an error, the real fix is almost always the right owner (chown) plus 755 or 775. The explanation line under the calculator warns you whenever others have write access.

Symbolic mode, the other syntax

chmod also takes letters. u is the owner, g the group, o others, a all three. = sets exactly, + adds, - removes. So chmod u=rwx,g=rx,o=rx is 755, and chmod go-w removes write from group and others without touching anything else. That relative form is the reason symbolic mode exists: you can change one bit without knowing the rest.

The symbolic box above accepts both styles. Type rwxr-xr-x (what ls -l shows) and it converts. Type a clause like g+w or a-x and it is applied to the current mode, exactly as chmod would. Capital X adds execute only if something is already executable, which is how chmod -R a+X makes directories traversable without marking every text file as a program.

Setuid, setgid and the sticky bit

The optional fourth digit sits in front: 4 for setuid, 2 for setgid, 1 for sticky. They show up in ls -l as s or t in the execute column. A capital S or T means the special bit is set but execute is not, which is usually a mistake.

Setuid (4755) makes a program run as its owner instead of whoever launched it. /usr/bin/passwd uses it to write the password file. It is a classic privilege-escalation target, so never set it on your own scripts; Linux ignores setuid on interpreted scripts anyway. Setgid on a directory (2775) makes new files inherit the directory's group, which is the clean way to run a shared team folder. The sticky bit on a directory (1777, like /tmp) lets anyone create files but only the owner delete them.

Pitfalls

chmod -R 644 on a directory tree strips execute from the directories too, and suddenly nothing inside is reachable. Set directories and files separately: find . -type d -exec chmod 755 {} + and find . -type f -exec chmod 644 {} +.

Permissions are not the only gate. Ownership decides who counts as the owner, ACLs (getfacl) can grant extra access, and macOS adds its own flags. If the mode looks right and access still fails, check ls -l for the owner and group, then look for a + at the end of the permission string, which means an ACL is in play.

Your umask decides the default. New files usually start as 666 minus the umask, so a umask of 022 gives 644. If every new file comes out wrong, fix the umask instead of chmodding after the fact.