Chmod Calculator
Tick the permissions you want and get the command to run. Converts between octal modes such as 755 and symbolic ones such as rwxr-xr-x, in both directions.
Your data never leaves your browser. This tool runs entirely on your device.
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner | 7 | |||
| Group | 5 | |||
| Everyone else | 5 |
Command
ls -l shows -rwxr-xr-x
- Owner: read the contents, modify the contents and run it as a program.
- Group: read the contents and run it as a program.
- Everyone else: read the contents and run it as a program.
Works like chmod itself: u+x, go-w, a=rw, u=rwx,go=rx.
Common modes
Why the mode is three digits
Every file carries three separate sets of permissions: one for its owner, one for the group that owns it, and one for everybody else. Each set holds three bits — read, write and execute — and each bit has a value: read is 4, write is 2, execute is 1.
Adding the values of the bits you want gives one digit per class, which is why the mode is written as three digits. 7 is 4 + 2 + 1, so all three; 6 is read and write; 5 is read and execute; 4 is read only. 755 therefore means the owner may do everything, while the group and everyone else may read and execute but not modify.
read 4 + write 2 + execute 1 · owner, group, other
Execute means something different on a directory
On a file, the execute bit means the file can be run as a program. On a directory it means you may enter it and reach what is inside — which is why directories are almost always 755 or 700 rather than 644.
The consequences of the other two bits shift as well. Read on a directory lets you list its entries; write lets you create and delete entries inside it. That last one catches people out: deleting a file depends on write permission on the directory, not on the file itself.
- A directory with r-- lists names but cannot open what it lists.
- A directory with --x reaches a known path inside without being able to list it.
- Write on a directory allows deleting files in it, whatever their own permissions say.
Symbolic changes: u+x and friends
The numeric form replaces the whole mode. The symbolic form changes part of it and leaves the rest alone, which is usually what you want: chmod u+x script.sh makes a script runnable by its owner without touching anything else.
A clause is a class (u, g, o or a), an operator (+, - or =) and the bits. The equals sign is the sharp edge: chmod u=r sets the owner to read only and clears write and execute, whereas u+r would only add.
chmod u+x file · chmod go-w file · chmod u=rwx,go=rx file
The fourth digit: setuid, setgid and sticky
A mode can carry a fourth leading digit built the same way: setuid is 4, setgid is 2, sticky is 1. It appears in place of the execute character in ls output, which is why /usr/bin/passwd shows rwsr-xr-x rather than rwxr-xr-x.
setuid makes a program run with its owner's privileges rather than the caller's — powerful, and a classic route to privilege escalation when it is set on something it should not be. setgid on a directory makes new files inherit the directory's group, which is how shared project folders are built. The sticky bit on a world-writable directory stops people deleting each other's files: that is what makes /tmp usable, and it shows as the t in 1777.
- 4000 setuid — run as the file's owner. Rare and security-sensitive.
- 2000 setgid — run as the owning group; on a directory, entries inherit its group.
- 1000 sticky — on a directory, only a file's owner may delete it.
Which mode to actually use
Almost everything is 644 or 755: read-write for the owner, read-only for others, plus execute where the thing is a directory or a program. Secrets are 600, so nobody but the owner can read them at all; an SSH private key at 644 is rejected by ssh outright.
777 is nearly always a mistake. It is usually reached for when a permissions problem is not understood, and it grants every user on the machine the right to modify the file — including replacing a script that something else runs later. Fixing the owner or the group is the correct repair almost every time.
Common modes
| Mode | Meaning |
|---|---|
| 644 rw-r--r-- | Ordinary file: owner edits, everyone reads |
| 755 rwxr-xr-x | Directory, script or binary anyone may run |
| 600 rw------- | Private file: credentials, tokens, dumps |
| 700 rwx------ | Private directory or owner-only script |
| 664 rw-rw-r-- | File shared with a team through its group |
| 775 rwxrwxr-x | Directory a team writes to through its group |
| 777 rwxrwxrwx | Everyone may do anything — almost always wrong |
| 4755 rwsr-xr-x | setuid binary, running as its owner |
| 1777 rwxrwxrwt | World-writable with the sticky bit, as /tmp is |
Frequently asked questions
What does chmod 755 mean?
The owner may read, write and execute; the group and everyone else may read and execute but not write. It is the usual mode for directories, scripts and programs that all users need to run.
What is the difference between 644 and 755?
Only the execute bit. 644 suits ordinary files such as documents, images and source code; 755 adds execute, which a directory needs to be entered and a script needs to be run.
Is chmod 777 dangerous?
Yes, on any shared machine. It lets every user modify or replace the file, so a script at 777 can be rewritten by anyone and will then run with the privileges of whoever executes it. The real fix is usually to correct the owner or group instead.
What does the fourth digit in 4755 do?
It holds the special bits: 4 is setuid, 2 is setgid, 1 is sticky. 4755 is a setuid binary that runs with its owner's privileges, shown by ls as rwsr-xr-x rather than rwxr-xr-x.
Why does ls show an s or a t instead of an x?
Because a special bit shares that column. A lowercase s or t means the special bit and execute are both set; an uppercase S or T means the special bit is set while execute is not, which is usually a mistake.
How do I make a script executable?
chmod u+x script.sh adds execute for its owner and leaves everything else alone. Use chmod +x when everyone on the machine should be able to run it, and check the shebang line is correct too.
Why did chmod not change anything on my USB drive?
Filesystems such as FAT32 and exFAT do not store Unix permissions. The mount options fix the mode for the whole filesystem, so chmod appears to succeed but nothing changes. NTFS behaves similarly unless mounted with a permissions-aware driver.
Related tools
- Hash GeneratorGenerate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text simultaneously. Everything is computed in your browser.
- Subnet CalculatorEnter an address and a prefix to get the network, broadcast, mask, wildcard, host range and host count — and split the block into equal subnets.
- What Is My IPYour public IP address as the rest of the internet sees it, plus the details your browser reveals to every site you visit.
- Regex TesterTest a regular expression against sample text and see matches highlighted as you type, with capture groups broken out for every match.