Code & data · file permissionsFile permission calculator (chmod)
Work out Unix permissions in every form — with checkboxes, in numbers (755) or in symbols (rwxr-xr-x) — paste a line from ls -l and get the chmod command ready to run. With a plain-language explanation and warnings about risky modes.
Everything is computed in your browser — the ls -l line and the path are never sent anywhere
checkboxes, digits, symbols and the ls -l line — all tied together
Who can do what
Readr = 4
Writew = 2
Executex = 1
Owner7
Group5
Others5
Special bits
Ready-made modes
Result
Octal0755
Symbolicrwxr-xr-x
ls -l line-rwxr-xr-x
Command
chmod 755 deploy.sh
What this means
7
Owner
Read the contents, change and save it, run it.
5
Group
Read the contents, run it.
5
Others
Read the contents, run it.
No risky bits — this set looks safe
02
Common modes
pick a mode and it goes into the calculator
ModeSymbolicWhen to use it
644→rw-r--r--an ordinary file: the owner edits, everyone else readsThe default for text, images, configs and web pages. Nobody needs the execute bit: the file is not a program.
755→rwxr-xr-xa directory, a script, a file served by a web serverThe owner edits, everyone else reads and enters. A directory needs the x bit to be entered, a script needs it to run.
600→rw-------a private file: an SSH key, .env, a tokenNobody but the owner can even read it. For a private key that is not advice: ssh refuses a key wider than 600.
700→rwx------a private directory for the owner only: ~/.ssh, ~/.gnupgOutsiders can neither enter nor list it. The counterpart to 600: the key itself 600, the directory around it 700.
640rw-r-----a file readable by its own groupThe owner edits, the group reads, outsiders see nothing. Typical for configs a service reads under its own group.
750rwxr-x---a directory for the owner and their groupThe group enters and reads but creates nothing; outsiders stay out. The directory counterpart to 640.
400r--------read-only: a key, protection from an accidental editEven the owner cannot change it without restoring the write bit. Protection from your own mistake, not from someone else.
775rwxrwxr-xa shared group directory with write accessThe group creates and deletes files alongside the owner. Usually paired with setgid (2775), or new files land in the author's own group.
1777→rwxrwxrwt/tmp: everyone writes, only the file's owner deletesWriting is open to all, but the sticky bit forbids touching other people's files. Without it a shared directory lets anyone delete anything.
4755rwsr-xr-xsetuid: runs with the owner's rights (passwd)The program executes as its owner rather than the caller. System utilities like passwd need it; your own scripts almost never do.
777→rwxrwxrwxdo not use: full access for absolutely everyoneAny user on the system can change or replace the file. It gets set «to make it work» — and then it works for outsiders too; 755 or 644 is what is actually needed.
03
About file permissions
In Unix every file has three classes — owner, group and others — and three rights for each: read (4), write (2) and execute (1). Their sum within a class gives one octal digit, and three digits give the familiar 755 or 644. The same permissions are also written in symbols (rwxr-xr-x) and applied with the chmod command.
Classes and rights
Basics
r = 4 · w = 2 · x = 1
Three classes — owner, group, others — and three rights for each. The rights inside a class add up to one digit: rwx = 4+2+1 = 7, r-x = 5, rw- = 6.
Digits and symbols
Notation
755 = rwxr-xr-x
The same permissions are written in octal (755 — compact) or in symbols (rwxr-xr-x — explicit). The chmod command understands both; ls -l shows the second.
Special bits
4th digit
4755 · rwsr-xr-x
setuid, setgid and sticky add a leading digit and turn x into s, S, t or T. A capital letter means the special bit is set while the execute bit is not — nearly always a mistake.
File or directory
The catch
x = enter
On a file «execute» means running a program; on a directory it means the right to enter. «Reading» a directory lists the names, not the contents. Hence the rule: a directory needs x wherever it has r.
Security
Risks
777 · 600
777 opens writing to everyone and almost always means the real cause was never found. Private keys are kept at 600 — ssh simply refuses to work with anything wider.
umask
Defaults
022 → 644 / 755
umask does not set permissions, it subtracts them from the base: 666 for files and 777 for directories. With umask 022 a file is created as 644 and a directory as 755.
umask · permissions of new filesumask subtracts rights
New files644rw-r--r--
New directories755rwxr-xr-x
04
Frequently asked questions
The owner gets read, write and execute (`rwx` = 4+2+1 = 7); the group and everyone else get read and execute (`r-x` = 4+1 = 5). These are the ordinary permissions for a directory, a script and a file served by a web server: the owner edits, everyone else reads and enters. Written out, that is `rwxr-xr-x`.
Every right has a number: read 4, write 2, execute 1. They are added up within a class — `rwx` = 7, `r-x` = 5, `rw-` = 6, `r--` = 4. Three digits in a row are the owner, the group and everyone else, in that order. A fourth digit in front, when present, holds the special bits.
777 opens reading, writing and execution to every user on the system: anyone can change or replace the file. Such permissions get set «to finally make it work» — and then it works for outsiders too. What is actually needed is almost always 755 for a directory or script and 644 for an ordinary file.
These are the special bits in the fourth digit: setuid 4, setgid 2, sticky 1. setuid and setgid run a program with the owner's or the group's rights — that is how `passwd` works. The sticky bit on a directory (as on `/tmp`) allows deleting only your own files. In symbolic notation they replace `x` with `s`, `S`, `t` or `T`; a capital letter means the execute bit is not set.
A private key needs 600 and the `~/.ssh` directory around it 700: ssh refuses a key readable by anyone else and says «Permissions are too open». A directory or a script is usually 755, an ordinary file 644, a private directory 700. The other cases are covered in the «Common modes» section.
The bits are the same, but execution means different things. On a file `x` means run it; on a directory it means enter it. And `r` on a directory means list the files rather than read them. That is why a directory nearly always needs `x` wherever it has `r`: without it nobody can get inside, even knowing a file name. The «file / directory» switch changes the explanation to match.