Chmod Calculator
Unix file permissions live a double life: three digits (755, 644, 600) for the command line, and nine letters (rwxr-xr-x) for the listing, every day, on every server on earth. Fluency is translating between them without counting on your fingers. This calculator converts both ways — enter an octal value like 755, or tick the symbolic permissions — and shows the chmod command, the per-class breakdown, and what the permissions actually allow. It also handles the fourth digit (setuid, setgid, sticky) that most converters quietly omit — because a permission you cannot read is a permission you have already granted by accident.
Three Digits, Nine Switches
The octal notation is a compression scheme: permissions are nine binary switches — read, write, execute for each of owner, group, others — and each class’s three switches read as one octal digit, since read = 4, write = 2, execute = 1 sums uniquely to 0–7. To decode 755 mentally: 7 = 4+2+1 (owner: rwx), 5 = 4+1 (group: r-x), 5 again (others: r-x). To encode: sum each class. The calculator performs and explains both directions because the two skills differ — system audits read symbols (ls -l speaks letters) while configuration acts in digits (chmod speaks octal) — and the working administrator’s fluency is the instant round trip. A leading fourth digit, when present, packs the three special switches the same way: setuid = 4, setgid = 2, sticky = 1, covered in the section below.
Worked Examples: The Canonical Four
The defaults’ 755 is the directory and executable standard: owner does everything; group and others may read and enter/execute but not modify — a public room the owner furnishes. 644 is its file sibling: owner reads and writes (6 = 4+2), everyone else reads (4) — the web’s default document. 600 draws the curtains: owner read/write, group and others nothing at all — the required setting for SSH private keys, which the ssh client will refuse to use at anything more permissive, a rare case of software enforcing this page’s arithmetic. And 777 — everything for everyone — is the internet’s most cargo-culted command: it “fixes” permission errors by abolishing permissions, and its appearance in a tutorial is a reliable signal to stop following it; the correct move is always to find which class actually needs which letter (usually group write, 775 or 664) and grant exactly that.
Files Are Not Directories: The Execute Subtlety
The letters translate differently by object type, and chmod fluency includes the split. On files: read opens the content, write modifies it, execute runs it as a program. On directories: read lists the names inside, write creates/renames/deletes entries, and execute — the subtle one — permits traversing the directory to reach the files within. A directory at 644 is thus a strange beast: its contents are listable but unreachable (no x, no entry), while 711 is a pass-through corridor: files reachable by exact name, listing forbidden — the classic setting for home directories on shared servers, and the reason “permission denied” on a file you own is so often a directory’s missing x three levels up. The calculator reports letters and class-words neutrally; applying them, keep the object in view: the same 755 that is boring on a directory would make a data file executable, which is why creation defaults (umask arithmetic) give files 644 and directories 755 automatically.
The Fourth Digit: Setuid, Setgid, Sticky
Three special switches ride in the optional leading digit, summed like the others. Setuid (4) on an executable runs it with its owner’s privileges rather than the caller’s — the mechanism behind passwd, an ordinary-user program that must edit a root-owned file; powerful, audited, and never to be granted casually. Setgid (2) does the same for the file’s group, and on a directory it makes new files inherit the directory’s group — the collaboration switch for shared project folders (2775 is its canonical full form). Sticky (1) on a directory restricts deletion: files inside may be deleted only by their owners — the reason /tmp is 1777, world-writable yet safe from neighbours deleting each other’s scratch files. Symbolic notation betrays them as s, s and t in the execute positions. The calculator decodes the digit and names its switches; the standing advice is that any 4-digit mode in the wild deserves a deliberate read of which special powers it is actually granting.
A Cheat Sheet in Prose
The modes a working administrator actually meets, gathered: 400 (r−−−−−−−−) — read-only for the owner alone; certificates and keys at rest like it here. 444 — read for all, write for none; published reference files. 600 — the secrets mode of the worked examples. 640 — owner write, group read; the shared-log setting, where the group is the service team. 700 — owner everything, nobody else anything; private scripts and directories whose very listing is information. 755 / 644 — the public pair, directory and file. 775 / 664 — the collaboration pair, group write added — which, with setgid’s 2 in front (2775), is the shared-project standard. Any mode outside this small society should be able to explain itself; the calculator’s breakdowns are the interrogation instrument.
Recursive Changes and the Capital-X Refinement
Two field techniques complete the working kit. chmod -R applies a mode recursively through a tree — powerful and dangerous, because files and directories usually want different modes (644 versus 755), and a recursive octal flattens the distinction, making every data file executable or every directory untraversable. The symbolic form holds the refinement: capital X means “execute, but only for directories and files already executable” — so chmod -R u=rwX,go=rX repairs a mangled tree to owner-led 644/755 sanity in one pass, the X splitting the cases the digits cannot. And the umask companion case, for completeness: umask 027 (a hardened-server default) yields 640 files and 750 directories at creation — the arithmetic of this page, applied by subtraction, before chmod is ever invoked.
Related Tools
More from the Other Calculators hub: the Hamming Code Calculator and Hamming Distance Calculator — computing’s other famous small-number systems — and the live CIDR Calculator for the network side of the terminal.
Frequently Asked Questions
What does chmod 777 really do, and why avoid it?
It grants read, write and execute to owner, group and every other account on the machine (and, on a web root, effectively to the internet’s scripts). The risks are concrete: any compromised process can modify the file, and world-writable executables are a standard persistence mechanism. The correct response to a permission error is diagnostic — identify the user the process runs as and the class it falls into, then grant that class the one letter it lacks (most often group write: 775/664, with group ownership set deliberately).
Why do SSH keys require 600?
Because a private key’s entire security is its privacy: at 644 every account on the machine could read and impersonate it. OpenSSH therefore refuses keys with group/other access — an enforced application of the principle that some files’ correct mode is not a preference. The same logic extends to .env files, credential stores and backups of either: 600 (or 400, read-only) is the mode of secrets.
What is umask, and how does it interact with chmod?
Umask is the creation-time subtractor: new files start from 666 and directories from 777, and the umask’s bits are removed — the common umask 022 yields 644 files and 755 directories automatically. Chmod then sets absolute permissions whenever you run it, overriding whatever creation produced. Fluency is knowing which tool a situation wants: systemic defaults belong to umask; deliberate exceptions belong to chmod; and a file that “keeps reverting” is usually being recreated under a umask, not defying chmod.
How do I read ls -l output like drwxr-sr-x?
Left to right: the first character is the type (d directory, − file, l link); then three letter-triples for owner, group, others — exactly this calculator’s symbolic output — with two dialect marks: s in an execute slot means setuid/setgid is on (capital S: on, but execute is off, usually a mistake), and t in the final slot is the sticky bit. The example reads: a directory, owner rwx, group r-s (setgid, read+execute), others r-x — a shared project folder with group inheritance, 2775 in this page’s digits once the type character is set aside.
Can permissions differ from ownership — who is “the owner”?
Every file has exactly one owner account and one group, stored with it; the three classes are evaluated in order — if you are the owner, the owner triple decides your access and the others are irrelevant to you, even if they look more generous (a famous gotcha: an owner at 400 on their own file cannot write it although group shows rw). Chmod changes the switches; chown changes the names they apply to — different commands, and only the owner (or root) may chmod a file at all.
What about Windows-style ACLs or chmod +x scripts?
The “+x” you meet in every tutorial is the symbolic-mode chmod: u+x grants the owner execute — the minimal, precise way to make a script runnable, contrasted with the octal habit of assigning the full 755. POSIX ACLs (getfacl/setfacl) extend the model with per-user entries beyond the three classes; where they exist, ls shows a “+” after the permissions and the nine-switch model becomes the summary rather than the whole truth. This calculator covers the classic model that everything else extends — including every default you will ever audit.