Chmod permissions calculator
Tick a permission grid to get the octal and symbolic mode, the setuid, setgid and sticky bits, and copy-ready chmod commands.
- Runs in your browser
- Nothing you enter is sent
- Free, no account
| Who | Read (r) | Write (w) | Execute (x) | Digit |
|---|---|---|---|---|
Owner The user who owns the file | 6 | |||
Group Members of the file’s group | 4 | |||
Others Everyone else on the system | 4 |
Runs with the owner’s identity, not the caller’s
Runs as the group; on a directory, new files inherit that group
In a shared directory, only the owner of a file may delete it
Three digits, or four with the special bits in front.
Nine characters as ls -l prints them, with or without the leading type character.
chmod 644 file.txtchmod u=rw,g=r,o=r file.txtchmod -R 644 file.txt- Owner can open and read the contents, modify or truncate the file.
- Group can open and read the contents.
- Others can open and read the contents.
Owner r=4 + w=2 = 6 Group r=4 = 4 Others r=4 = 4 chmod 644
Three classes, three permissions
Unix permissions answer nine yes/no questions: for the owner, the group and everyone else, may they read, write and execute? Each permission has a value — read 4, write 2, execute 1 — and each class gets the sum of its own permissions as one octal digit.
rwx = 4 + 2 + 1 = 7
rw- = 4 + 2 = 6
r-x = 4 + 1 = 5
r-- = 4 = 4Three digits, one per class, and you have the familiar 644, 755 or 600.
What the permissions mean on a directory
This is the part that confuses people, because the same three letters mean something quite different:
| Bit | On a file | On a directory |
|---|---|---|
| read (r) | Open and read the contents | List the names inside — but not read them |
| write (w) | Modify or truncate the file | Create, rename and delete entries inside |
| execute (x) | Run it as a program | Traverse it, to reach anything inside |
Two consequences follow. First, a directory needs execute to be useful at all — read alone lets you see names and open nothing. Second, deleting a file depends on the write permission of its directory, not the file: you can delete a read-only file you do not own if you can write to the folder it sits in. The sticky bit exists to close exactly that gap.
The special bits
| Bit | Octal | On an executable | On a directory |
|---|---|---|---|
| setuid | 4000 | Runs as the file's owner, whoever starts it | No effect on Linux |
| setgid | 2000 | Runs as the file's group | New entries inherit the directory's group |
| sticky | 1000 | Historic, now ignored | Only the owner of an entry may delete it |
In ls -l these replace the execute character: s where execute is also
set, capital S where it is not, and t or T in the same
way for sticky. Seeing a capital S usually means a mistake — a setuid bit on a
file nobody can execute.
Why 777 keeps appearing, and why it is wrong
It is the fastest way to make a permission error go away, which is why forum answers reach for it. What it actually does is let every account on the machine — including any compromised service — rewrite the file. On a web root that turns a minor vulnerability into remote code execution.
The correct fix is almost always ownership. Set the file's group to the one the web server runs as, then use 664 for files and 775 for directories. If you cannot change ownership, that is a deployment problem worth solving rather than routing around.
Modes you will actually use
| Mode | Symbolic | For |
|---|---|---|
| 644 | rw-r--r-- | Ordinary files: documents, HTML, images |
| 755 | rwxr-xr-x | Scripts, binaries and directories |
| 600 | rw------- | SSH private keys, .env files — SSH refuses anything looser |
| 700 | rwx------ | ~/.ssh and other private directories |
| 664 / 775 | rw-rw-r-- / rwxrwxr-x | Shared group editing |
| 1777 | rwxrwxrwt | /tmp: everyone writes, only owners delete |
| 2775 | rwxrwsr-x | A project directory where new files keep the team group |
Symbolic notation
chmod u+x script.sh adds execute for the owner and leaves everything else alone.
chmod u=rwx,go=rx script.sh sets each class exactly, clearing anything not listed.
The equals form is what this page generates, because it produces the same result no matter what
the file started with — which is what you want in a script or a runbook.
One warning about recursion: chmod -R 755 makes every file executable, including
documents and images. The idiomatic fix is chmod -R u=rwX,go=rX, where the capital
X sets execute only on directories and on files that already had it.
Questions
What do 644 and 755 mean?
644 is read and write for the owner, read for everyone else — the normal mode for a file. 755 adds execute for all three classes, which a script needs to run and a directory needs to be entered.
Why is 777 a bad idea?
Every account on the machine can then modify the file. On a web server that means any compromised process can rewrite your code. Fix ownership with chown, or grant the group write access instead.
What does execute mean on a directory?
Permission to traverse it — to reach the files inside. Read without execute lets you list the names but not open anything; execute without read lets you open a file whose exact name you already know.
When would I use the sticky bit?
On a shared writable directory such as /tmp. With the sticky bit set, users can create files but only the owner of a file may delete it, which stops one user removing another's work.
What is the difference between chmod u+x and chmod u=rwx?
The plus form adds a permission and leaves the rest alone. The equals form sets that class exactly, clearing anything not listed. This page generates the equals form because it is unambiguous.