Chmod Calculator – Linux File Permissions
Tick who may read, write and execute a file to get the chmod number (such as 755 or 644) and the rwx string. Or type a number, paste an ls -l string, or try a change such as u+x. Everything runs in your browser.
| Who | Read | Write | Execute |
|---|
Type what you would write after chmod. It is applied to the permissions above, the same way GNU chmod on Linux does it.
022, see the umask calculator).
The umask removes permissions from new files and directories. Files start from 666, directories from 777.
umask -S: u=rwx,g=rx,o=rx
How to use this chmod calculator
- Tick the boxes for what the owner, the group and everyone else may do. The octal number, the
rwxstring and the chmod commands update at once. - Or decode a value: type a number such as
640in the Octal box, or paste a string fromls -l, such as-rw-r-----ordrwxrwsr-x, in the Symbolic box. A wholels -lline works too. - Choose File or Directory. Read, write and execute mean different things for a directory, and the explanation changes with it.
- Copy the command, for example
chmod 640 config.yml. Type the real name in the name box first if you want it in the command. - Try a change such as
u+xorgo-wto see what it does to the current permissions before you run it on a server.
Use Copy link to share a result: the mode is kept in the link (for example ?mode=750). Nothing you type is sent to a server.
How Linux file permissions work
Every file and directory on Linux, macOS and other Unix systems has an owner (a user), a group, and three sets of permissions: one for the owner (u), one for members of the group (g) and one for all other users (o). Each set has three permissions: read (r), write (w) and execute (x).
Linux checks only one set: if you are the owner, the owner set counts, even if the group or others have more. The root user can read and write everything anyway.
| Permission | On a file | On a directory |
|---|---|---|
r read (4) | Open and read the content | List the names inside (ls) |
w write (2) | Change or empty the content | Create, delete and rename entries (needs x too) |
x execute (1) | Run it as a program or script | Enter it (cd) and open files inside by name |
Note that deleting a file needs write permission on the directory, not on the file itself.
Octal numbers: how 755 is made
Each permission has a value: read = 4, write = 2, execute = 1. Add them up for each set and write the three sums in the order owner, group, others. So rwx = 4 + 2 + 1 = 7, r-x = 4 + 1 = 5, and rwxr-xr-x = 755.
| Digit | rwx | Meaning |
|---|---|---|
0 | --- | No permission |
1 | --x | Execute only |
2 | -w- | Write only |
3 | -wx | Write and execute |
4 | r-- | Read only |
5 | r-x | Read and execute |
6 | rw- | Read and write |
7 | rwx | Read, write and execute |
A fourth digit in front holds the special bits (setuid = 4, setgid = 2, sticky = 1), so 2775 is 775 plus setgid. When you write only three digits, that fourth digit is 0.
Common chmod values
| Mode | Typical use | |
|---|---|---|
644 | Normal files: web pages, images, configuration without secrets | |
755 | Directories, scripts and programs | |
600 | Private files: SSH private keys, .env, passwords | |
700 | Private directories such as ~/.ssh, private scripts | |
640 | Config or log files a service group must read | |
750 | Directories for the owner and one group only | |
664 | Files a team (group) edits together | |
775 | Shared team directories | |
400 | Read-only for the owner, for example a cloud .pem key | |
777 | Everyone can do everything. Almost never right | |
1777 | Shared temp directories like /tmp (sticky bit) | |
2775 | Team directories where new files keep the group (setgid) | |
4755 | Programs that run as their owner, like /usr/bin/passwd |
Setuid, setgid and the sticky bit
Setuid (4000, shown as s in the owner place)
An executable file with setuid runs with the rights of its owner, not of the user who starts it. /usr/bin/passwd is rwsr-xr-x and owned by root, so any user can change their own password. Setuid is a common way to attack a system, so set it only when you are sure. Linux ignores it on shell scripts and on directories.
Setgid (2000, shown as s in the group place)
On a file, the program runs with the rights of the file's group. On a directory it is very useful: new files and subdirectories get the directory's group instead of the creator's main group. That is how shared team folders stay readable by the whole team (chmod 2775).
Sticky bit (1000, shown as t in the others place)
On a directory, users can delete or rename only their own files, even if everyone has write permission. /tmp is drwxrwxrwt (1777) for this reason. On files Linux ignores it.
A capital S or T in ls -l means the special bit is set but the execute bit under it is not, which usually means a mistake.
One surprise on directories: GNU chmod keeps setuid and setgid on a directory when you give a 3- or 4-digit number, so chmod 755 on a 2775 directory leaves it at 2755. To clear the bit, use chmod g-s dir or five digits: chmod 00755 dir.
Symbolic mode: chmod u+x, go-w and friends
Instead of a number you can describe a change: who (u owner, g group, o others, a all), an operator (+ add, - remove, = set exactly) and the permissions (r w x, plus X, s, t). Separate several changes with commas. A symbolic change keeps every bit you do not mention, which a number cannot do.
| Command | What it does |
|---|---|
chmod u+x run.sh | Lets the owner run the script; nothing else changes |
chmod +x run.sh | Adds execute for everyone (minus what the umask blocks) |
chmod go-w file | Takes write away from group and others |
chmod a=r file | Read-only for everyone (444) |
chmod o= file | Removes all rights for others |
chmod g=u file | Gives the group the same rights as the owner |
chmod -R u=rwX,go=rX dir | Directories 755, files 644 (or 755 if already executable), in one command |
chmod g+s dir | Sets setgid on a directory |
Directories 755 and files 644, recursively
chmod -R 755 dir also makes every file executable, which is usually wrong. Use find to treat them separately:
find /var/www/site -type d -exec chmod 755 {} +find /var/www/site -type f -exec chmod 644 {} +
Frequently asked questions
What does chmod 755 mean?
755 is rwxr-xr-x. The owner (7 = 4 + 2 + 1) can read, write and execute. The group (5 = 4 + 1) and everyone else (5) can read and execute, but not change the file. It is the usual mode for programs, scripts and directories.
What does chmod 644 mean?
644 is rw-r--r--. The owner can read and write the file, and the group and everyone else can only read it. It is the usual mode for normal files such as HTML pages, images and configuration files that are not secret.
Why is chmod 777 dangerous?
777 (rwxrwxrwx) lets every user on the system read, change and run the file. On a web server that means any other account or any hacked process can change your code or upload a script and run it. Fix the owner with chown instead, and use 755 for directories and 644 for files.
What is the difference between 644 and 755?
The only difference is the execute bit. 755 gives execute to everyone, 644 gives it to no one. Use 755 for directories (execute lets you open a directory) and for scripts and programs, and 644 for ordinary files.
What does chmod +x do?
chmod +x file adds the execute bit so the file can be run as a program, for example ./script.sh. With no u, g, o or a in front, GNU chmod adds execute for owner, group and others but skips the bits blocked by your umask. Use chmod u+x to add it for the owner only.
How do I chmod only directories or only files recursively?
chmod -R changes files and directories the same way. To give directories 755 and files 644, use find: find /path -type d -exec chmod 755 {} + and find /path -type f -exec chmod 644 {} +. Another way is chmod -R u=rwX,go=rX /path, where the capital X adds execute only to directories and to files that are already executable.
What do s and t mean in rwsr-xr-x or rwxrwxrwt?
An s in the owner place is the setuid bit (the program runs as its owner, like /usr/bin/passwd), an s in the group place is setgid, and a t in the others place is the sticky bit (in /tmp, users can only delete their own files). A capital S or T means the special bit is set but the execute bit under it is not.
How do I fix "Permissions 0644 for id_rsa are too open"?
SSH refuses a private key that other users can read. Run chmod 600 ~/.ssh/id_rsa (rw-------, only you can read and write it) and chmod 700 ~/.ssh. The public key (id_rsa.pub) can stay 644, and ~/.ssh/authorized_keys should be 600.