Chmod Calculator
Tick the boxes or type an octal value — the symbolic notation, the octal number and the ready-to-paste command stay in sync, both ways.
How the number is built
A permission is three groups of three bits. Read is 4, write is 2, execute is 1 — add the ones that are set and you get a digit from 0 to 7. Three groups give a three-digit octal number: owner, group, others, in that order.
So 755 is 4+2+1 for the owner, then 4+1 and 4+1
for group and others. In symbolic form that is rwxr-xr-x. A leading fourth digit
carries the setuid (4), setgid (2) and sticky (1) bits, which is why /tmp is
1777.
The same number means different things on files and directories
On a file, x means “can be executed”. On a directory it means “can be entered and
traversed” — listing and opening files inside. That is why directories are usually
755 and files 644, and why a directory with 644 is
effectively unusable even though it looks permissive.
Values you will actually type
| Octal | Symbolic | Typical use |
|---|---|---|
400 | -r-------- | Read-only, owner only |
444 | -r--r--r-- | Read-only for everyone |
600 | -rw------- | Owner read/write — private keys, secrets |
640 | -rw-r----- | Owner read/write, group read |
644 | -rw-r--r-- | The default for files: owner writes, everyone reads |
664 | -rw-rw-r-- | Group may also write |
700 | -rwx------ | Owner-only directory or script |
750 | -rwxr-x--- | Owner full, group read/execute |
755 | -rwxr-xr-x | The default for directories and public scripts |
775 | -rwxrwxr-x | Group may write — shared directories |
777 | -rwxrwxrwx | Everyone may do anything — world-writable, avoid |
4755 | -rwsr-xr-x | setuid: runs as the file owner (e.g. passwd) |
2755 | -rwxr-sr-x | setgid: runs with the group of the file |
1777 | -rwxrwxrwt | Sticky: anyone may create, only owners may delete (/tmp) |
Special bits, briefly
setuid on an executable makes it run with the permissions of its owner rather
than the caller — that is how passwd can edit /etc/shadow. It is also a
classic privilege-escalation route, so it should be rare and audited. setgid does
the same for the group, and on a directory it makes new files inherit the directory's group —
genuinely useful for shared folders. sticky on a directory means only a file's
owner can delete it, which is what makes /tmp safe to leave world-writable.
When s appears in the lowercase position, execute is set as well; an uppercase
S means the special bit is on but execute is not — almost always accidental.
FAQ
Why is 777 dangerous?
Every user on the machine can modify or replace the file. For anything a privileged process runs, that is a direct route to executing arbitrary code as that user. On a web root it means anyone who finds a write path can serve their own content.
What does umask have to do with it?
umask subtracts permissions from the defaults when a file is created. With the usual umask 022, a new file is 666 − 022 = 644 and a new directory is 777 − 022 = 755.
The equivalent umask above is the exact bit complement of the mode — 777 − mode — because a mode only records which bits are set. For 600 that comes out as 177 rather than the 077 people usually quote. Both produce 600 for a new file, since files start at 666 and a umask can only clear bits, never add the execute bit back.
My SSH key is rejected as “too open” — which value?
600 on the private key and 700 on ~/.ssh. OpenSSH refuses a group- or world-readable private key, and the error names the file it dislikes.
Does this apply to Windows and macOS?
The notation is identical on macOS and any Unix. Windows uses ACLs instead, though WSL and Git Bash present a POSIX view. On FAT/exFAT volumes the bits are not stored at all.