chmod Calculator — Linux File Permissions
Convert Linux file permissions between octal (755, 644) and rwx symbols. Get chmod commands, spot risky settings like 777 — free, right in your browser.
| Read (4) | Write (2) | Execute (1) | Digit | rwx | |
|---|---|---|---|---|---|
| Owner (u) | 7 | rwx | |||
| Group (g) | 5 | r-x | |||
| Others (o) | 5 | r-x |
- Numeric (absolute) mode
chmod 755 file- Symbolic mode
chmod u=rwx,go=rx file- Recursive (-R)
chmod -R 755 dir- Directories only
find dir -type d -exec chmod 755 {} +- Files only
find dir -type f -exec chmod 644 {} +
Tip: chmod -R u+rwX adds execute only to directories and to files that are already executable — safer than blanket -R 755.
On Linux, a numeric chmod like 755 keeps an existing setuid/setgid on directories — clear them explicitly with 00755, =755 or u-s,g-s (BSD/macOS clears them by default).
Current mode of a file: stat -c '%a' file (Linux) · stat -f '%Lp' file (macOS)
umask Calculator
effective = base & ~umask
Linux File Permissions Chart: Common chmod Values
| Octal | Symbolic | Typical use | Owner | Group | Others |
|---|---|---|---|---|---|
| 400 | r-------- | SSH private key (read-only) | r-- | --- | --- |
| 600 | rw------- | Private files, SSH keys | rw- | --- | --- |
| 644 | rw-r--r-- | Web pages, config files | rw- | r-- | r-- |
| 664 | rw-rw-r-- | Group-editable files | rw- | rw- | r-- |
| 666 | rw-rw-rw- | Anyone can edit — avoid | rw- | rw- | rw- |
| 700 | rwx------ | Private directories | rwx | --- | --- |
| 755 | rwxr-xr-x | Scripts, web directories | rwx | r-x | r-x |
| 775 | rwxrwxr-x | Group-shared directories | rwx | rwx | r-x |
| 777 | rwxrwxrwx | Anyone can do anything — avoid | rwx | rwx | rwx |
| 1777 | rwxrwxrwt | Shared temp dirs (/tmp) | rwx | rwx | rwt |
Permission Digits 0-7 at a Glance
| Digit | Binary | rwx | Meaning |
|---|---|---|---|
| 0 | 000 | --- | No permissions |
| 1 | 001 | --x | Execute only |
| 2 | 010 | -w- | Write only |
| 3 | 011 | -wx | Write + execute |
| 4 | 100 | r-- | Read only |
| 5 | 101 | r-x | Read + execute |
| 6 | 110 | rw- | Read + write |
| 7 | 111 | rwx | Read + write + execute |
What Is chmod?
chmod — change mode — is the Unix and Linux command that sets who may read, write or execute a file. Every file carries nine permission bits in three groups (owner, group, others), and chmod accepts them either as an octal number in numeric (absolute) mode, like chmod 755, or as letters in symbolic mode, like chmod u=rwx,go=rx. Both describe exactly the same bits; this calculator translates between them live.
The octal shorthand works because each permission is a power of two: read is 4, write is 2, execute is 1, and one digit per class is simply their sum. So 7 is everything (4+2+1), 5 is read plus execute, 6 is read plus write, and 0 is nothing at all. Read rwxr-xr-x left to right in threes and you get 7, 5, 5. A fourth, leading digit encodes the special modes — setuid (4), setgid (2) and the sticky bit (1) — which is how 4755 or 1777 arise; their presence shows up in the symbolic string as s or t in place of x.
Permissions are the first layer of Unix security, and most day-to-day permission problems reduce to a handful of patterns: a script that will not run needs execute (u+x), a directory you cannot enter is missing its x bit, a web asset should be 644 with 755 directories above it, and a private key must be 600 before OpenSSH will touch it. The mistakes cluster the same way — most infamously chmod 777, which "fixes" access errors by handing write access to every account on the machine. This page keeps the arithmetic, the symbols, the ready-to-run commands and the risk warnings in one place, and since octal is just base 8, you can explore the underlying positional arithmetic with the number base converter.
# Make a script executable, then verify with ls -l $ ls -l deploy.sh -rw-r--r-- 1 jack staff 512 Jul 17 10:00 deploy.sh $ chmod 755 deploy.sh $ ls -l deploy.sh -rwxr-xr-x 1 jack staff 512 Jul 17 10:00 deploy.sh # The symbolic equivalent of 755 $ chmod u=rwx,go=rx deploy.sh # Read the current mode as a number $ stat -c '%a' deploy.sh # Linux → 755 $ stat -f '%Lp' deploy.sh # macOS → 755
Key Features
Three views, one state
The checkbox matrix, the octal number and the symbolic rwx string are all live inputs — edit any of them and the other two follow instantly, in both directions.
Special bits done right
setuid, setgid and the sticky bit are first-class: the fourth octal digit, the s/S and t/T casing rules, and the correct symbolic clauses (u+s, g+s, a+t) all render exactly as chmod understands them.
Paste ls -l straight in
Drop a whole ls -l line into the symbolic field — the file-type character, SELinux dot, ACL plus or macOS @ are handled — and get the octal mode back without any manual trimming.
Commands you can actually run
Numeric, symbolic, recursive and the safer find -type d / find -type f pair, each with a copy button — plus the stat command to read a file's current mode, and the GNU note about clearing setuid on directories.
Risk alerts as you type
World-writable modes light up immediately: 777 and 666 are called out, any others-write bit raises a flag, and 1777 is correctly recognised as the sticky-bit pattern for shared directories rather than an error.
umask, charts and permalinks
An integrated umask calculator shows what new files and directories will get, two reference tables cover common modes and the digits 0-7, and Copy link shares the exact state — all 100% in your browser.
chmod Permission Examples
755 — the standard for scripts and web directories
755
rwxr-xr-x — chmod 755 file · chmod u=rwx,go=rx file
Mode 755 gives the owner full control (read + write + execute = 4 + 2 + 1 = 7) while group and others can read and execute but never modify (4 + 1 = 5). That is exactly what a deploy script or a public web directory needs: the server can traverse and serve the content, but only the owner can change it. The calculator shows both command forms — numeric 755 and the symbolic equivalent u=rwx,go=rx — and the files-only recipe drops to 644 automatically, because regular files should not carry execute bits they do not need.
600 — lock a private file down to its owner
600
rw------- — owner reads and writes, everyone else sees nothing
Mode 600 (rw-------) is the correct setting for SSH private keys, .env files, API credentials and anything else that no other account on the machine should be able to open. OpenSSH actively enforces it: a key readable by group or others is refused with the famous 'Permissions 0644 ... are too open' error. Load the 600 chip, copy chmod 600 file, and the risk panel stays silent — this is the least-privilege baseline done right.
4755 — setuid anatomy: why the x becomes an s
4755
rwsr-xr-x — the owner's execute slot shows s instead of x
The leading 4 is the setuid bit: whoever runs the program, it executes with the file owner's privileges — this is how passwd can update a root-owned file for a normal user. In symbolic form the owner's execute position changes from x to s (a lowercase s means execute is also set; a capital S would mean setuid without execute, which is almost always a mistake). The calculator renders the fourth octal digit, checks the setuid box, and raises an advisory alert, because setuid executables deserve deliberate review.
Decode ls -l output — paste the whole line
drwxr-xr-x 5 jack staff 160 Jul 17 dist
755
Copy a line straight out of ls -l and paste it into the symbolic field — no trimming needed. The tool reads the first token drwxr-xr-x, recognises the leading d as the file-type character (directory) rather than a permission, tolerates the SELinux dot, ACL plus sign or macOS @ that some systems append, and converts the remaining nine characters to octal 755. This is the fastest way to answer 'what number is this permission?' during a code review or an incident, and it works with the l of symlinks and the - of regular files just the same.
How to Use the chmod Calculator
- 1
Set permissions any way you like
Tick the read, write and execute boxes per class, type an octal mode like 755 or 4755, or start from one of the preset chips — SSH key 400, private file 600, web file 644, script 755 and more.
- 2
Read all three views at once
The checkbox matrix, the octal value and the symbolic rwx string stay in sync in every direction, with each row showing its digit and its three-character slice as you work.
- 3
Copy the exact command you need
Five ready-to-run variants update live: numeric mode, the symbolic equivalent with smart grouping, recursive -R, and the safer directories-only / files-only pair built on find -type.
- 4
Decode existing permissions
Paste a full ls -l line — file-type character, ACL markers and all — into the symbolic field and read back the octal value instantly, special bits included.
- 5
Check umask and share your result
The umask section shows what new files and directories will receive, and Copy link captures the current mode in a URL you can drop into a code review or a runbook.
Common chmod Mistakes
Using 777 to "fix" Permission denied
Opening the mode to the world usually masks an ownership problem instead of solving it — and leaves every account on the machine able to modify your files. Fix the owner first; keep the mode tight.
sudo chmod -R 777 /var/www # access works, security is gone
sudo chown -R www-data:www-data /var/www # fix ownership, keep 755/644
Blanket chmod -R on an upload directory
Recursive numeric modes hit files and directories with the same value, so 755 makes every image and document 'executable' and 777 makes them world-writable. Split the recursion by type instead.
chmod -R 777 uploads/
find uploads -type d -exec chmod 755 {} + && find uploads -type f -exec chmod 644 {} + Forgetting that directories need execute
The x bit on a directory means 'may enter and traverse'. A 644 directory cannot be cd'd into even by users who can list it — which produces confusing Permission denied errors one level deeper.
chmod 644 reports/ # cd reports/ → Permission denied
chmod 755 reports/ # directories carry x so they can be entered
Shipping a script without its execute bit
A freshly created file inherits umask defaults like 644, so ./script.sh fails with Permission denied until you add execute for at least the owner. CI runners and Docker entrypoints hit this constantly.
./deploy.sh # bash: ./deploy.sh: Permission denied
chmod u+x deploy.sh && ./deploy.sh
What You Can Do with the chmod Calculator
- Deploy to web servers safely
- Set 755 on directories and 644 on files for nginx or Apache document roots using the generated find commands, and let the risk panel confirm nothing is world-writable before you ship. Pair it with the htpasswd generator when a directory also needs basic-auth protection.
- Fix SSH key permissions
- The 400 and 600 preset chips produce exactly what OpenSSH demands for private keys, and the FAQ walks through the 'Permissions 0644 ... are too open' error message that appears when a key is left readable by the group.
- Decode permissions during incident triage
- Paste ls -l lines from a production shell straight into the symbolic field to turn rwxr-sr-x into 2755 without counting bits in your head — special modes, ACL markers and file-type characters are all understood.
- Get shared hosting and FTP modes right
- Control panels and FTP clients ask for numeric modes: 755 for public_html, 644 for pages, 600 for configuration files with credentials. Load the preset, read the chart, copy the number — no guessing.
- Prepare containers and CI scripts
- Entrypoints and hook scripts need u+x before Docker or a CI runner can execute them, and volume mounts inherit host modes. Generate the exact chmod for each case here, and schedule the jobs that run them with the crontab generator.
How Linux File Permissions Work
- The octal arithmetic: 4 + 2 + 1
- Each class of user gets one octal digit, and the digit is the sum of read = 4, write = 2 and execute = 1. All eight combinations exist: 0 none, 1 execute only, 2 write only, 3 write + execute, 4 read only, 5 read + execute, 6 read + write, 7 all three. A mode like 640 therefore reads as: owner 6 (read + write), group 4 (read only), others 0 (nothing). The digit table on this page lists all eight rows, and the matrix shows the same sum being built as you tick boxes.
- Numeric (absolute) mode vs symbolic mode
- chmod accepts the same bits two ways. Numeric mode states the complete result — chmod 755 file replaces whatever was there before. Symbolic mode describes a change relative to the current state: chmod u=rwx,go=rx file sets classes explicitly, while chmod g+w file flips a single bit and leaves the rest alone. Numeric is ideal for enforcing a known-good state in scripts and deployment; symbolic shines for one-off adjustments like u+x. This calculator emits both, with group classes merged automatically (go=rx, a=rwx) the way experienced admins write them.
- setuid, setgid and the sticky bit
- A fourth, leading octal digit encodes the special modes: setuid = 4000 runs an executable with the file owner's privileges, setgid = 2000 does the same for the group (and makes new files in a directory inherit its group), and the sticky bit = 1000 on a shared directory restricts deletion to each file's owner — /tmp is the canonical 1777. In ls -l they replace the execute slot: lowercase s or t when execute is also set, capital S or T when it is not (usually a misconfiguration worth checking). One GNU/Linux subtlety: numeric chmod deliberately preserves existing setuid/setgid on directories — clear them with a 5-digit mode like 00755, an equals clause like =755, or u-s,g-s, as documented in the GNU coreutils manual. BSD and macOS clear them on numeric modes by default.
- How umask shapes new files
- Freshly created files start from base 666 and directories from 777; the process's umask then switches off the bits it contains — effective mode = base & ~umask. The default umask 022 masks group and others write, yielding the familiar 644 files and 755 directories. A stricter 077 gives 600 and 700, keeping everything private to the owner; a collaborative 002 gives 664 and 775 so the group can write. The umask section on this page runs the calculation live for both bases.
File Permission Best Practices
- Grant the least privilege that works
- Start from the tightest mode and open up only what breaks: 600 for private files, 644 for shared-readable ones, 755 only where execution or traversal is genuinely needed. Every extra write bit is attack surface.
- Default to 644 files inside 755 directories
- This pairing serves almost every web root, repository checkout and shared read scenario. Regular files rarely need execute; directories always need it to be entered — mixing the two up causes most everyday permission errors.
- Recurse with find -type, not a blanket -R
- chmod -R 755 marks every file executable. Use the directories-only and files-only commands this tool generates, or GNU chmod's capital X (u+rwX,go+rX), which adds execute only where it belongs.
- Never leave 777 on anything a server can reach
- World-writable web roots and upload directories are the textbook route to injected files and defaced sites. If several accounts must write, prefer a shared group with 775 or 2775 (setgid keeps group ownership consistent) over opening the mode to the world.
- Keep SSH keys at 600 — or 400 once they are final
- OpenSSH refuses group- or world-readable private keys outright. 600 is the working standard; 400 additionally prevents accidental overwrites of a key you never intend to edit. Public keys and authorized_keys are fine at 644.
chmod Calculator FAQ
What does chmod 777 mean?
Is chmod 777 dangerous?
What is the difference between chmod 755 and 644?
How do I fix "Permissions 0644 for 'id_rsa' are too open"?
What is the difference between chmod and chown?
What does chmod +x do?
How do I chmod all files and folders recursively?
Is my data uploaded when I use this calculator?
Related Tools
View all tools →Number Base Converter — Binary, Hex, Decimal & Octal
Conversion Tools
Convert between binary, hex, decimal, octal and any base (2-36) instantly. Free, private — all processing in your browser.
Color Converter — HEX, RGB, HSL & OKLCH
Conversion Tools
Convert HEX to RGB, HSL, OKLCH, OKLAB and CMYK in your browser — copy any format with one click. Free, no signup, your colors never leave the page.
Hex to CMYK Converter
Conversion Tools
Convert HEX colors to CMYK in your browser. Naive sRGB-based approximation for print previews. Free, no signup, your colors stay local.
Hex to HSL Converter
Conversion Tools
Convert any hex color to HSL in your browser — 3-digit, 6-digit, 8-digit alpha all supported. Free, instant, no signup, your colors never leave the page.
Hex to OKLCH Converter
Conversion Tools
Convert HEX to OKLCH for Tailwind v4 design tokens. Live perceptually-uniform output with Display P3 gamut warnings. Free, browser-only.
Hex to RGB Converter
Conversion Tools
Convert any hex color code to RGB in your browser — 3-digit, 6-digit, and 8-digit alpha hex all supported. Free, instant, no signup, your colors never leave the page.