Chmod Calculator
Tick the permissions and read off the octal mode, the symbolic form and the exact command to paste. Works for files and directories, including the setuid, setgid and sticky bits.
| Class | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | 7 | |||
| Group (g) | 5 | |||
| Others (o) | 5 | |||
| Special | 0 | |||
How the Three Digits Add Up
Each class of user — owner, group, others — gets one digit, and that digit is simply 4 + 2 + 1 for the bits that are on. 755 is not a magic number: it is 7 (read + write + execute = 4+2+1) for the owner, and 5 (read + execute = 4+1) for group and others. A file with 644 is readable by everyone but writable only by its owner.
The symbolic form is the same information written out: the leading - means a regular file (d for a directory, l for a symlink), then three triplets. rwxr-xr-x and 755 are two spellings of one mode, which is why chmod 755 and chmod u=rwx,go=rx do the same thing.
Read, Write and Execute Mean Different Things on a Directory
- r on a directory lets you list the names inside it. Nothing more — you get the names but no metadata and no access.
- x on a directory lets you traverse it:
cdinto it,stata known path inside it, open a file whose name you already know. This is the bit people forget — a directory withr--shows you filenames that you cannot open. - w on a directory lets you create, rename and delete entries in it. Deleting a file depends on write permission on the parent directory, not on the file itself.
That last point explains the most common permission puzzle: rm some-file fails with "Permission denied" even though the file is 777, because the directory it lives in is not writable by you.
The Special Bits
- setuid (4) on an executable runs it with the file owner's identity instead of the caller's — how
passwdwrites to a root-owned file. - setgid (2) on a directory makes new files inherit the directory's group, which is the standard way to build a shared team folder (
2775, thenumask 002). - sticky (1) on a directory means only a file's owner (or root) may delete it — that is what protects
/tmp(1777).
In symbolic output a set bit replaces the x: rwsr-xr-x means setuid with execute, and a capital S means the bit is set but execute is not (a red flag on most systems).
Why Your Files Keep Coming Back as 644 and 755
chmod changes existing files; umask decides what new ones get. The shell subtracts the umask from the maximum: with umask 022 a new file is 666 − 022 = 644 and a new directory is 777 − 022 = 755. If a deployment step re-creates a config file, your chmod 600 is silently reverted — fix the umask (or the service's UMask= in systemd), not the file.
Common Modes Worth Memorising
600— private file: SSH private keys,.env, credentials.644— normal file: HTML, images, config read by a web server.755— executable, and the default for directories.700— private directory:~/.ssh, per-user data.664/775— group-writable file / directory for a shared team.2775— setgid shared directory: new files keep the group.1777— sticky world-writable directory such as/tmp.
Avoid chmod -R 755 on a mixed tree: it makes every regular file executable. Use find . -type d -exec chmod 755 {} + and find . -type f -exec chmod 644 {} + instead, then fix the handful of scripts that really need the execute bit.
Frequently Asked Questions
Why can I not delete a file that is 777?
Because deletion is a directory operation. The kernel checks write and execute permission on the directory containing the entry, then removes the name — the file's own mode is never consulted. Check ls -ld $(dirname path); if the directory is not writable by you, the file's 777 is irrelevant.
Does 777 mean everyone has access?
It means every class has every traditional bit, and that is often still not access. SELinux or AppArmor can deny it, an ACL can grant or restrict beyond the nine bits (a + in ls -l), the filesystem may be mounted ro or noexec, immutable attributes (chattr +i) win outright, and a container's user namespace can have no matching UID at all. 777 is also a poor default because it lets any local process rewrite the file.
I set the execute bit but the script still will not run.
Four usual causes, in order: the filesystem is mounted noexec (very common for /tmp and for mounted data volumes); the interpreter in the shebang does not exist or has Windows line endings, so the kernel reports "bad interpreter"; the script is being invoked through a path that resolves to a directory; or it is a symlink whose target lacks the bit. Run ls -l and mount | grep noexec, then execute it explicitly, e.g. bash script.sh, to separate "no execute bit" from "broken script".
What do the capital S and T in ls -l mean?
A capital S or T means the special bit is set where the corresponding execute bit is not: rws is setuid with execute, rwS is setuid without it. A setuid bit with no execute permission does nothing useful on Linux, so S on a binary usually signals a broken packaging step. The same logic applies to t versus T for the sticky bit.
How do I read permissions in octal from ls -l output?
Convert each triplet by adding 4 for r, 2 for w and 1 for x: rw-r--r-- becomes 6, 4, 4. ls -l itself does not print the octal mode; stat -c '%a %n' file (Linux) or stat -f '%Lp %N' file (macOS) does, which is the quickest way to confirm what chmod actually applied.
Is it safe to chmod a symlink?
On Linux, chmod follows the symlink and changes the target's mode — symlink permissions themselves are ignored by the kernel. If you want to change the mode of a link without touching its target, that is not possible on Linux; on macOS use chmod -h to affect the link. In either case, know which side of the link you are editing before running a recursive chmod.