Chmod Calculator

About Chmod Calculator

This tool converts Unix file permissions between three views: octal numbers like 755, the symbolic string ls -l prints (rwxr-xr-x), and individual bits you can toggle. A four-digit octal value such as 4755 or 1777 is read with its first digit as the setuid/setgid/sticky bits, and you can paste the permission part of an ls -l line including the file-type letter (-rwsr-xr-x).

Knowing how the numbers are built is quicker than memorising them. Below: the octal arithmetic, how special bits show up as s, t, S and T, what 777 actually opens up, and how umask decides the permissions of files you have not created yet.

One octal digit is three bits

Each digit is the sum of read = 4, write = 2 and execute = 1. So 7 = rwx, 6 = rw-, 5 = r-x, 4 = r--. The three digits are owner, group and others, in that order: 755 is "owner can do anything, everyone else can read and execute", and 640 is "owner reads and writes, group reads, others get nothing".

Octal is used because three bits fit exactly in one octal digit. That is also a classic bug source. chmod 755 means binary 111 101 101, not decimal seven hundred fifty-five. If code passes a mode as a plain number and forgets the octal prefix (0o755 in Python, 0755 in C or Perl), it gets decimal 755, which is octal 1363: a strange mode with the sticky bit set and no read permission for the owner.

On directories, r, w and x mean something else

For a directory, r lets you list the names inside, w lets you create, delete and rename entries in it, and x lets you pass through it as part of a path. With r but no x you can see names with ls but cannot open the files; with x but no r you can open a file only if you already know its exact name.

Whether you can delete a file depends on write permission on the directory holding it, not on the file itself. A read-only 444 file in a directory you can write to can still be removed. The sticky bit, below, exists to close that gap.

Special bits: setuid 4, setgid 2, sticky 1

The leading digit of a four-digit mode holds the special bits. The symbolic form has no separate column for them, so they replace the execute position of the relevant class: lowercase (s, t) when execute is also set, uppercase (S, T) when it is not. Uppercase usually signals a mistake. 4644 shows as rwSr--r--, and setuid on a file nobody can execute does nothing.

• setuid (4000): an executable runs with the file owner's privileges instead of the caller's. That is how passwd, owned by root and mode -rwsr-xr-x, lets ordinary users update the shadow password file. Linux ignores setuid on interpreted scripts such as shell scripts.
• setgid (2000): on an executable, runs with the file's group; on a directory, makes new files inside inherit the directory's group rather than the creator's primary group. That is why shared project folders are often 2775 or 2770.
• sticky (1000): on a directory, only a file's owner (or the directory's owner, or root) may delete or rename that file, even if others can write to the directory. /tmp is 1777, drwxrwxrwt, for exactly this reason.

What chmod 777 really opens

"Got a permission error, set it to 777, now it works" is a common fix, and what it does is grant write access to every account and every process on the machine. An upload directory at 777 lets another site on a shared host, or a compromised plugin, drop an executable script into it. A config file at 666 or 777 lets anyone rewrite the database password in it.

Most permission errors are not caused by the "others" bits being too tight but by the wrong owner or group. If the web server user (www-data, nginx and so on) must write to a folder, change the group with chown and use 775, or 2775 to keep the group on new files. Some programs refuse to work with loose permissions at all: OpenSSH will not use a private key file that is readable by group or others, which is why keys live at 600.

umask masks bits, it does not subtract

A new file's mode is what the program asked for (typically 666 for files and 777 for directories) with the umask bits switched off. With umask 022, files come out 644 and directories 755. It looks like subtraction, but it is a bitwise mask (requested AND NOT umask), and subtraction gives wrong answers in some cases. With umask 033, a new file is 644, not 666 − 033 = 633, because the execute bits it would "subtract" were never set.

Enter a umask (such as 022 or 0027) in the umask calculator at the bottom of the tool and it shows the resulting mode for a new file (from 666) and a new directory (from 777), in octal and rwx form. Remember too that umask applies only at creation time; existing files keep their mode until you chmod them.

Worked examples

How to use it

1. Enter an octal mode (755, 4755) or a symbolic one (rwxr-xr-x, or the start of an ls -l line).
2. Toggle individual bits; both notations update together.
3. Copy the generated chmod command.

Frequently asked questions