Chmod Calculator
Work out Unix permissions as octal, symbolic and plain English.
- Runs in your browser
- Nothing is uploaded
- Free, no sign-up
| Read | Write | Execute | |
|---|---|---|---|
| Owner | |||
| Group | |||
| Everyone else |
chmod 755 filechmod u=rwx,g=rx,o=rx file
- The owner can read, modify and run it.
- Members of the group can read and run it.
- Everyone else can read and run it.
About this tool
Tick the permissions you want and read off the octal number, the symbolic string and the chmod command. Or type a mode you have seen, such as 640 or rwxr-sr-x, and have it explained in plain English.
How to use it
- Tick read, write and execute for the owner, the group and everyone else.
- Add setuid, setgid or sticky if you need them, and say whether it is a file or a directory.
- Copy the chmod command. You can also edit the octal or symbolic field directly.
How the three digits work
Each permission has a value: read is 4, write is 2, execute is 1. Add up what you want for each of owner, group and everyone else, and write the three sums side by side.
755 is 7 (4+2+1, read, write and execute) for the owner, then 5 (4+1, read and execute) for the group and for everyone else. In symbolic form that is rwxr-xr-x.
| Mode | Symbolic | Typical use |
|---|---|---|
644 |
rw-r--r-- |
Ordinary files that others may read |
755 |
rwxr-xr-x |
Programs, scripts and public directories |
600 |
rw------- |
Private keys and credentials |
700 |
rwx------ |
Private directories such as ~/.ssh |
664 |
rw-rw-r-- |
Files a group edits together |
777 |
rwxrwxrwx |
Almost never the right answer |
Directories read the bits differently
For a directory, read lets you list the names inside it, write lets you create, delete and rename entries, and execute lets you enter it and reach the files within. Write only works together with execute.
That is why directories are usually 755 and files 644: the execute bit on a directory is not about running anything, it is about being allowed in. A directory that can be read but not entered, such as 644, is almost always a mistake.
Setuid, setgid and the sticky bit
A fourth, leading digit holds three special bits: 4 is setuid, 2 is setgid and 1 is sticky.
- Setuid on a program makes it run with its owner's privileges, whoever starts it. It is how
passwdcan edit a file you cannot, and why setuid programs need extreme care. - Setgid on a program does the same for its group. On a directory, new files inside inherit the directory's group, which is what you want for a shared project folder.
- Sticky on a directory means only a file's owner can delete or rename it, even if others can write there.
/tmpis1777for this reason.
A capital S or T in the symbolic form means the special bit is set but the execute bit beneath it is not.
Mistakes that cause real damage
Running chmod -R 777 to make an error go away. It removes the protection from every file below, and on a web server turns every upload into something anyone can overwrite. Find the owner or group that needs access and grant that instead.
Recursing with one mode. chmod -R 644 dir strips the execute bit from the directories, locking you out of them. Set files and directories separately:
find dir -type d -exec chmod 755 {} +
find dir -type f -exec chmod 644 {} +
Loose key permissions. SSH refuses a private key that others can read, with an "unprotected private key file" error. The fix is chmod 600 on the key and 700 on ~/.ssh.
Frequently asked questions
What does chmod 755 mean?
The owner can read, write and execute; the group and everyone else can read and execute. It is the usual mode for programs and for directories that others need to enter.
What is the difference between 644 and 664?
The second digit. 664 also lets members of the file's group write to it, which suits files edited by a team but is unnecessary for most files.
Why is the first digit sometimes a fourth number?
A four-digit mode starts with the special bits: setuid (4), setgid (2) and sticky (1). A three-digit mode is the same as four digits with a leading zero.
Does this apply to Windows?
It applies to Linux, macOS, BSD and Windows Subsystem for Linux. Native Windows files use access control lists, which are not expressed as a mode.
Related tools
Number Base Converter
Convert integers between binary, octal, decimal, hex and any base to 36.
Subnet Calculator
Network, broadcast, host range and mask for any IPv4 or IPv6 CIDR block.
.env File Generator
Build a .env file and generate a safe .env.example alongside it.
Cron Expression Generator
Build a cron schedule and read it back in plain English.