How to use the chmod calculator
- Checkbox grid: tick read/write/execute for owner, group and others. Octal, symbolic and the command below update immediately.
- Octal: type a mode directly, e.g.
755or, with special bits,4755. - Symbolic: type a 9-character mode like
rwxr-xr-x, or 10 with a file-type character likedrwxr-sr-x. - Parse ls -l: paste a mode string or a full
ls -lline and it decodes the type, permissions and special bits. - Command: set a target filename, pick octal or symbolic style, and optionally
-Rfor recursive, to get a ready-to-runchmodcommand.
How Unix and Linux file permissions work
Every file and directory on a Unix-like system has an owner (a user) and a group, plus three permission sets: what the owner can do, what members of the group can do, and what everyone else ("others") can do. Each set has three independent bits — read (view a file's contents, or list a directory), write (modify a file, or add/remove entries in a directory) and execute (run a file as a program, or enter — cd into — a directory).
Those nine bits are usually written two ways: as three octal digits (0–7, one per owner/group/others) or as a symbolic string of nine characters, three rwx triples. rwxr-xr-x and 755 mean exactly the same thing.
How to calculate chmod permissions (octal)
Each permission has a fixed value — read = 4, write = 2, execute = 1 — and a group's digit is the sum of whichever it has:
| Permissions | Sum | Digit |
|---|---|---|
| read, write, execute | 4+2+1 | 7 |
| read, write | 4+2 | 6 |
| read, execute | 4+1 | 5 |
| read only | 4 | 4 |
| write, execute | 2+1 | 3 |
| write only | 2 | 2 |
| execute only | 1 | 1 |
| none | 0 | 0 |
Put the owner, group and others digits in that order — rwxr-xr-x is 7 (owner: all three), 5 (group: read+execute), 5 (others: read+execute) = 755.
Octal notation and special permissions
A fourth digit, written in front (e.g. 4755), sets three special bits the same way: setuid (4) runs a program with its owner's privileges no matter who starts it — passwd uses this to let any user change their own password despite the password file being owned by root. Setgid (2) on a program does the same for the group; on a directory it makes every new file created inside inherit that directory's group (drwxrwsr-x), which is the usual way to set up a shared team folder. Sticky (1) on a directory (rwxrwxrwt, the mode /tmp uses) lets any user create files but restricts deleting or renaming a file to its owner and root, even though the directory itself is world-writable.
In symbolic form these show as a lowercase s or t when the matching execute bit is also on, or an uppercase S / T when it isn't (e.g. setuid with no owner-execute bit is S, a state that has no effect and usually indicates a mistake).
Common permission modes
| Octal | Symbolic | What it means |
|---|---|---|
755 | rwxr-xr-x | Owner: read/write/execute. Group and others: read/execute. Typical for scripts, binaries and directories you want others to enter and list. |
644 | rw-r--r-- | Owner: read/write. Group and others: read only. The default for most files: web pages, configs, documents others may read but not change. |
600 | rw------- | Owner: read/write. Group and others: no access. Private files: SSH keys, credentials, personal notes. |
700 | rwx------ | Owner: read/write/execute. Group and others: no access. Private scripts and directories, such as ~/.ssh. |
777 | rwxrwxrwx | Everyone: read/write/execute. Almost always too permissive — any user on the system can modify or (for a directory) delete the contents. |
775 | rwxrwxr-x | Owner and group: read/write/execute. Others: read/execute. Shared team directories where a group collaborates. |
664 | rw-rw-r-- | Owner and group: read/write. Others: read only. Shared files a group edits together, such as a group-writable log. |
400 | r-------- | Owner: read only. Group and others: no access. Read-only secrets, e.g. a private key you never want accidentally overwritten. |
444 | r--r--r-- | Everyone: read only. No one, including the owner, can write without first changing the mode. |
555 | r-xr-xr-x | Everyone: read/execute. No write access for anyone — a locked-down script or directory listing. |
711 | rwx--x--x | Owner: full access. Group and others: execute only (can enter a directory and access known filenames, but not list its contents). |
2775 | rwxrwsr-x | Like 775, plus setgid: new files created inside inherit the directory’s group. Common for shared project directories. |
4755 | rwsr-xr-x | Like 755, plus setuid: the program runs with the file owner’s privileges (e.g. passwd). Use sparingly — it is a common privilege-escalation target. |
1777 | rwxrwxrwt | Like 777, plus the sticky bit: anyone can create files, but only the owner (or root) can delete or rename their own — used for /tmp. |
Reading ls -l output
Running ls -l shows a 10-character mode string: a file-type character followed by three rwx triples. drwxr-sr-x is a directory (d) with mode 2755 — owner has full access, group has read/execute plus setgid (the s), others have read/execute. The type character is one of - (regular file), d (directory), l (symbolic link), c/b (character/block device), p (named pipe) or s (socket). Paste the whole line — the parser above ignores the owner, group, size, date and filename columns that follow.
The chmod command: octal vs symbolic
Setting a mode outright with a number is the most common form:
chmod 755 deploy.sh
chmod -R 755 public/ # apply to a whole directory treeSymbolic assignment (=) does the same thing spelled out by role, and +/- adjust specific bits without recalculating the rest — useful for a quick fix rather than a full mode change:
chmod u=rwx,g=rx,o=rx deploy.sh # same as chmod 755 deploy.sh
chmod u+x run.sh # add execute for the owner only
chmod go-w shared.log # remove write for group and others
chmod ugo+r,u+w notes.txt # example: 644 built up from a blank file with "+"Other developer and sysadmin tools
- Subnet calculator: the other half of sysadmin work — IPv4/IPv6 subnetting, CIDR and VLSM.
- JWT decoder: decode a JSON Web Token's header, payload and expiry.
- Base64 encode / decode: for files and text you handle alongside server permissions.
Frequently asked questions
What does chmod 755 mean?
755 gives the owner read, write and execute (rwx), and the group and others read and execute (r-x / r-x) — full symbolic form rwxr-xr-x. It's the standard mode for scripts, compiled programs and directories: the owner can edit and run it, everyone else can only run it (or, for a directory, enter and list it).
What does chmod 644 mean?
644 gives the owner read and write, and the group and others read only — symbolic rw-r--r--. It's the default for most files that don't need to run as a program: web pages, configuration, documents, images. Nobody but the owner (or root) can change the file.
Why is chmod 777 usually a bad idea?
777 (symbolic rwxrwxrwx) gives every user on the system full read, write and execute access. It's occasionally used to unblock a stuck permissions error while debugging, but leaving it in place means any user, and any process running as any user, can modify, replace or delete the file — a common target in security audits and a real privilege-escalation risk on a shared or internet-facing server.
What does chmod 444 mean?
444 (symbolic r--r--r--) gives everyone, including the owner, read-only access — nobody can write to the file without first running chmod again to add write permission (even the owner needs +w first). It's used to protect a file from accidental changes, such as a released config or a compiled asset.
How do I calculate chmod permissions?
Score each of read (4), write (2) and execute (1) as on or off and add them up, separately for owner, group and others: read+write+execute = 7, read+write = 6, read+execute = 5, read only = 4, and so on — three digits, one per group, e.g. 6-4-4 for "owner read+write, group read, others read". The checkbox grid above does exactly this arithmetic live as you tick boxes.
What are setuid, setgid and sticky bit?
They're a fourth octal digit in front of the usual three (0–7, added the same way: setuid 4, setgid 2, sticky 1). Setuid (e.g. 4755, symbolic rwsr-xr-x) runs a program with its owner's privileges regardless of who starts it. Setgid on a directory (drwxrwsr-x) makes new files inside inherit the directory's group. Sticky (rwxrwxrwt, used for /tmp) lets anyone create files in a shared directory but only the owner or root delete or rename their own.
How do I read the output of ls -l?
The first character is the file type (d = directory, - = regular file, l = symbolic link), then nine characters in three groups of "rwx" for owner, group and others, e.g. drwxr-sr-x is a directory (2755 in octal) with setgid on. Paste any ls -l line into the parser above and it decodes it automatically.
What is the difference between the octal and symbolic chmod command?
chmod 755 file (octal) sets the mode outright. chmod u=rwx,g=rx,o=rx file (symbolic) sets it explicitly the same way, while chmod u+x file or chmod go-w file adjust specific bits without touching the rest — useful when you only want to add or remove one permission without recomputing the whole mode.
Does chmod affect who can delete a file?
Not directly — deleting or renaming a file needs write permission on its containing directory, not on the file itself (a read-only file in a writable directory can still be deleted). The sticky bit is the exception: on a directory, it restricts deletion to the file’s owner (and root) even though everyone can write to the directory.
Is anything I type into this calculator sent to a server?
No. Every conversion — checkboxes, octal, symbolic, the ls -l parser and the chmod command builder — runs in your browser. Nothing is uploaded or saved, other than your preferred command target, style and recursive option, kept on your device.