Developer Utility Tools

Chmod Calculator

Convert Linux and Unix file permissions between octal (755), symbolic (rwxr-xr-x) and checkboxes, and get a ready-to-run chmod command. Use it to decode ls -l output or pick safe permissions for scripts, keys and shared directories.

Private by design: anything you enter is processed in your browser only. It is never uploaded to or logged on our servers. Share links contain the mode, file name and recursive option.

Permissions

Who Read (4) Write (2) Execute (1) Value
Owner (u) 0
Group (g) 0
Others (o) 0
Special Setuid (4) Setgid (2) Sticky (1)
Flags 0

Result

Numeric command

Symbolic command

ls -l style

Common Presets

About Unix file permissions and chmod

Every file and directory on Linux, macOS and other Unix-like systems has three sets of permissions: one for the owner (user), one for the group, and one for others (everyone else). Each set can grant read (r), write (w) and execute (x) access. The chmod command changes these permissions.

In octal notation each permission has a value — read = 4, write = 2, execute = 1 — and the values are added per set. So 7 (4+2+1) means rwx, 5 (4+1) means r-x and 4 means read-only. The three digits are written owner-group-others, which is why chmod 755 gives the owner full access while everyone else can read and execute. Symbolic notation such as u=rwx,g=rx,o=rx expresses exactly the same thing.

An optional leading fourth digit sets the special bits: setuid (4) runs an executable with the file owner's privileges, setgid (2) runs it with the group's privileges or makes new files in a directory inherit its group, and the sticky bit (1) on a directory such as /tmp only lets users delete their own files. In ls -l output they appear as s/S in the execute slots of owner and group, and t/T in the others slot — lowercase when execute is also set, uppercase when it is not.

For directories, read lets you list contents, write lets you create and delete entries, and execute lets you enter (cd) and access files inside. Typical safe defaults are 644 for regular files, 755 for directories and scripts, and 600 for private keys. Avoid 777: world-writable files can be modified by any user or compromised process on the system.

Permission modes are octal numbers, so each digit is exactly three bits. To see a mode such as 4755 in binary or decimal, paste it into the octal field of the number base converter.

Reference Guide

Each octal digit is the sum of read (4), write (2) and execute (1):

DigitBinarySymbolicMeaning
0000---no access
1001--xexecute only
2010-w-write only
3011-wxwrite and execute
4100r--read only
5101r-xread and execute
6110rw-read and write
7111rwxread, write and execute

Common modes and when to use them:

ModeSymbolicTypical use
644rw-r--r--Regular files: web pages, config files, source code
600rw-------Secrets: SSH private keys, .env files, ~/.ssh/authorized_keys
400r--------Read-only secrets, e.g. a downloaded .pem key
755rwxr-xr-xDirectories, shell scripts and binaries everyone may run
700rwx------Private directories such as ~/.ssh, personal scripts
750rwxr-x---Directories readable by a service group (e.g. the web server) but not by other users
775rwxrwxr-xDirectories shared by a team group, e.g. Laravel storage/
2775rwxrwsr-xShared project directory where new files inherit the directory's group
1777rwxrwxrwtWorld-writable temp directories like /tmp; users can only delete their own files
4755rwsr-xr-xSetuid programs such as /usr/bin/passwd; runs as the file owner

OpenSSH refuses to use a private key that other users can read, with the error "UNPROTECTED PRIVATE KEY FILE". Fix it with chmod 600 ~/.ssh/id_ed25519.

Special bits (the optional leading digit):

BitOctalShown asOn a fileOn a directory
Setuid4000s / S in the owner execute slotRuns with the file owner's privileges. Linux ignores it on shell scripts.No effect on Linux
Setgid2000s / S in the group execute slotRuns with the file's group privilegesNew files and subdirectories inherit the directory's group
Sticky1000t / T in the others execute slotNo effect on modern LinuxOnly the file owner, the directory owner or root can delete or rename entries

A capital S or T means the special bit is set but the matching execute bit is not, which is usually a mistake.

Reading an ls -l line such as -rwxr-xr-x 1 alice staff 1024 Oct 24 09:15 deploy.sh:

FieldExampleMeaning
Type-- file, d directory, l symlink, c/b character/block device, p named pipe, s socket
Permissionsrwxr-xr-xOwner, group and others triplets. A trailing + means extra ACL entries exist.
Links1Number of hard links
Owner and groupalice staffWhose permissions apply as "owner" and "group"
Size1024Size in bytes
ModifiedOct 24 09:15Last modification time
Namedeploy.shFile name

How umask sets default permissions. New files start from 666 and new directories from 777, and every bit set in the umask is removed:

umaskNew filesNew directoriesTypical on
022644 rw-r--r--755 rwxr-xr-xMost Linux distributions and macOS
002664 rw-rw-r--775 rwxrwxr-xSystems with a private group per user
077600 rw-------700 rwx------Hardened servers

The umask removes bits rather than subtracting digits: umask 033 gives files 644, not 633. Files never get execute permission by default.

Tip: chmod -R 755 dir makes every file executable. Use chmod -R u=rwX,go=rX dir instead: capital X adds execute only to directories and files that are already executable.

Example input

Mode:      755
File:      deploy.sh
Command:   chmod 755 deploy.sh

This sample loads automatically when you open the tool. Use Load Sample to bring it back.

Frequently Asked Questions

The owner can read, write and execute (7 = 4+2+1), while the group and others can read and execute (5 = 4+1). It is the usual permission for directories and executable scripts.

644 gives the owner read and write and everyone else read only, which suits regular files. 755 adds execute permission for everyone, which is needed for scripts and to enter directories.

Rarely. 777 lets every user on the system modify and execute the file, which is a common security hole on web servers. Prefer the narrowest permission that works.

They are special permission bits set by a fourth leading octal digit. Setuid (4) runs a program as its owner, setgid (2) runs it as its group or makes new files inherit the directory group, and the sticky bit (1) stops users deleting other users' files in shared directories such as /tmp.