Chmod Calculator
Convert file permissions between checkbox, octal and symbolic forms, decode ls -l strings, and copy the exact chmod command — entirely on this device.
Editing any field updates the others
| Read | Write | Execute | |
|---|---|---|---|
| Owner | |||
| Group | |||
| Others | |||
| Special |
| Octal | 755 | |
|---|---|---|
| 4-digit octal | 0755 | |
| Symbolic | u=rwx,g=rx,o=rx | |
| Mode string | rwxr-xr-x | |
| chmod command | chmod 755 file | |
| Symbolic command | chmod u=rwx,go=rx file | |
| X — execute on directories only | — |
Press ? for shortcuts
Permission values
30 curated modes, each verified against the system chmod and stat — every row shows the value in all three spellings the calculator reads.
| Octal | Mode string | Symbolic | Meaning | Security note |
|---|---|---|---|---|
000 | --------- | u=,g=,o= | No permissions for anyone.Used for: Temporarily locking a file out of use | 000: no access at all — even the owner must change the mode before reading or writing |
111 | --x--x--x | u=x,g=x,o=x | Everyone may execute; no one may read or modify.Used for: Directories others may traverse but not list · Execute-only binaries (rare) | — |
400 | r-------- | u=r,g=,o= | Owner may read; no one may write or execute.Used for: SSH private keys · Read-only credential files | 400: owner read-only — SSH refuses private keys that group or others can read; 400 satisfies its check |
440 | r--r----- | u=r,g=r,o= | Owner and group may read; no writes, no execution.Used for: Files under /etc/sudoers.d (shipped as 440) · Read-only secrets shared with one group | — |
444 | r--r--r-- | u=r,g=r,o=r | Everyone may read; no one may write.Used for: World-readable reference data · Protecting generated files from edits | — |
500 | r-x------ | u=rx,g=,o= | Owner may read and execute; nothing is writable.Used for: Guarding a script against accidental edits | — |
550 | r-xr-x--- | u=rx,g=rx,o= | Owner and group may read and execute.Used for: Read-only tool directories for one group | — |
555 | r-xr-xr-x | u=rx,g=rx,o=rx | Everyone may read and execute; no one may write.Used for: Read-only public directories · Immutable deployed binaries | — |
600 | rw------- | u=rw,g=,o= | Owner may read and write; group and others get nothing.Used for: SSH private keys (600 or 400) · Credential and token files · Mail spools | 600: owner-only — the standard mode for private keys, tokens and other secrets |
640 | rw-r----- | u=rw,g=r,o= | Owner reads and writes; group reads; others get nothing.Used for: Log files readable by an admin group · Configs shared with a service group | — |
644 | rw-r--r-- | u=rw,g=r,o=r | Owner reads and writes; everyone else reads.Used for: Web pages and static assets · Source files and documents · Most configuration files | — |
660 | rw-rw---- | u=rw,g=rw,o= | Owner and group read and write; others get nothing.Used for: Data files shared by one service group · Group-owned device nodes | — |
664 | rw-rw-r-- | u=rw,g=rw,o=r | Owner and group read and write; others read.Used for: Group-edited documents · Shared source trees with a common group | — |
666 | rw-rw-rw- | u=rw,g=rw,o=rw | Everyone reads and writes.Used for: Device nodes like /dev/null · Scratch files intended for every user | 666: world-writable — any user on the system can modify this file; consider 644 |
700 | rwx------ | u=rwx,g=,o= | Owner has full control; no one else has any access.Used for: The ~/.ssh directory · Private scripts and working directories | — |
711 | rwx--x--x | u=rwx,g=x,o=x | Owner has full control; others may only execute or traverse.Used for: Home directories others may traverse but not list · Binaries runnable but not readable | — |
740 | rwxr----- | u=rwx,g=r,o= | Owner has full control; group may read; others get nothing.Used for: Scripts a group may audit but not run | — |
750 | rwxr-x--- | u=rwx,g=rx,o= | Owner has full control; group reads and executes; others get nothing.Used for: Deploy directories for a service group · Group-shared executables | — |
754 | rwxr-xr-- | u=rwx,g=rx,o=r | Owner has full control; group reads and executes; others only read.Used for: Scripts others may read but not run | — |
755 | rwxr-xr-x | u=rwx,g=rx,o=rx | Owner has full control; everyone else reads and executes.Used for: Directories · Executables and scripts · Web server document roots | — |
770 | rwxrwx--- | u=rwx,g=rwx,o= | Owner and group have full control; others get nothing.Used for: Team-shared working directories | — |
775 | rwxrwxr-x | u=rwx,g=rwx,o=rx | Owner and group have full control; others read and execute.Used for: Group-managed web roots · Shared build directories | — |
777 | rwxrwxrwx | u=rwx,g=rwx,o=rwx | Everyone has full control.Used for: Diagnosing permission problems (briefly) · Shared scratch directories — prefer 1777 | 777: world-writable — almost never what you want; consider 755 |
1777 | rwxrwxrwt | u=rwx,g=rwx,o=rwx,a+t | World-writable, but the sticky bit restricts deletion to each file's owner.Used for: /tmp and /var/tmp · Shared upload or drop directories | 1777: world-writable — the sticky bit means only a file's owner, the directory's owner or root can delete it, like /tmp |
2750 | rwxr-s--- | u=rwx,g=rxs,o= | Like 750 with setgid: new files in the directory keep its group.Used for: Group-owned deploy directories where new files must keep the group | — |
2755 | rwxr-sr-x | u=rwx,g=rxs,o=rx | Like 755 with setgid: executables run with the file's group; directories pass their group to new files.Used for: Setgid system binaries · Directories that must keep their group | 2755: setgid — executables run with the file's group ID; check what that group can reach |
2775 | rwxrwsr-x | u=rwx,g=rwxs,o=rx | Like 775 with setgid: group members share the directory and new files keep its group.Used for: Shared project directories · Group-shared git repositories (core.sharedRepository) | 2775: group-writable with setgid — anyone in the group can modify contents; new files inherit the group |
4750 | rwsr-x--- | u=rwxs,g=rx,o= | Setuid: runs as the file owner; only the group may execute it.Used for: Privileged helpers restricted to one group | 4750: setuid — runs with the file owner's privileges; only group members can execute it, so keep that group tight |
4754 | rwsr-xr-- | u=rwxs,g=rx,o=r | Setuid: runs as the file owner; group executes; others may only read.Used for: Setuid helpers whose code others may inspect but not run | 4754: setuid — executables with this mode run with the file owner's privileges; audit them carefully |
4755 | rwsr-xr-x | u=rwxs,g=rx,o=rx | Setuid: anyone may run it, and it runs with the file owner's privileges.Used for: System binaries like passwd · Any executable that must act as its owner | 4755: setuid — runs with the file owner's privileges for every user; a classic privilege-escalation surface, audit carefully |
umask — why new files are not 777
chmod sets the bits an existing file has; umask withholds bits from files as they are created. Most tools create directories from 777 and files from 666, and every bit in the umask is cleared from that start (mode & ~umask) — which is why new files never arrive executable.
| umask | New directories | New files |
|---|---|---|
022 | 755 | 644 |
002 | 775 | 664 |
027 | 750 | 640 |
077 | 700 | 600 |
chmod itself consults umask in exactly one case: a who-less clause like a bare +w — the calculator above flags it when you write one.
Do it offline:$ stat -c '%a %A' file
How to use it
- Edit any surface: tick matrix checkboxes, type 1–4 octal digits, write a symbolic mode like u=rwx,g=rx,o=rx or u+x, or paste ls -l output. Editing one updates the rest.
- Read the result card: both octal spellings, symbolic form, mode string, a plain-English sentence, and a security line for risky values.
- Toggle Recursive (-R) for the directory caveat and the capital-X variant that keeps plain files non-executable.
- Copy the command or any line, share the state as a link, or download the .txt summary.
Set the nine permission bits with checkboxes, type an octal value, write a symbolic clause, or paste a line straight from ls -l — every surface stays in sync, and the page shows the matching octal, symbolic and mode-string forms together with the exact chmod command to copy. Special bits, capital S and T, and ACL suffixes are decoded and explained. Everything runs in this tab; nothing you paste is sent anywhere.
How it works
A Unix file mode is twelve bits: read, write and execute for the owning user, the owning group and everyone else, plus three special bits — setuid, setgid and sticky. ls draws the nine as rwx triplets and folds the special bits into the execute columns. This calculator holds the twelve bits as one number; every surface on the page is a spelling of it.
Octal fits the grid because each class is one digit: read counts 4, write 2, execute 1 — rwx is 7, r-x is 5, so rwxr-xr-x is 755. An optional leading digit carries the special bits with the same weights (setuid 4, setgid 2, sticky 1); 4755 is a setuid 755. chmod also pads short input on the left — a bare 7 means 0007 — flagged here as a chip.
The special bits read differently by context. On an executable, setuid runs the program as the file's owner, setgid as its group. On a directory, setgid makes new entries inherit the group (shared trees are often 2775) and sticky limits deletion to each file's owner (/tmp is 1777). Lowercase s or t means bit plus execute; capital S or T means the bit without execute — decoded here rather than rejected.
On a directory, execute means enter — pass through and reach the names inside — while read means list those names. That is why serving a file needs x on every directory of its path, why a 711 home directory allows traversal without browsing, and why recursive changes want capital X: it grants execute to directories and only to files that already had it.
Examples
644rw-r--r--Decoded live: "The owner can read and write; the group can read; others can read." — the usual mode for configs.
drwxr-xr-x755The d and the three x columns mark a directory anyone may enter but only the owner may change.
u+xs,g+x4754u+xs adds execute and setuid together — u+s alone leaves capital S (4644, rwSr--r--). 4754: setuid — executables with this mode run with the file owner's privileges; audit them carefully
755chmod -R u=rwX,go=rX fileDirectories become 755 while a 644 file keeps 644 — X never adds execute to a plain file that had none.
Every example on this page is executed against the same engine that powers the tool, on every build.
Gotchas worth knowing
Capital S or T: the bit is set, execute is not
The case of s and t is data: lowercase means special bit plus execute, uppercase means the bit alone. 4644 renders as rwSr--r-- — setuid on a file nobody can run, usually the residue of chmod u+s on a non-executable file.
A fourth octal digit is the special bits
0755 is just 755 — a leading zero adds nothing. A leading 4, 2 or 1 adds setuid, setgid or sticky, and they sum: 6755 sets both id bits. The result card prints both spellings.
chmod -R with x makes documents executable
A recursive 755 marks every plain file executable, which is rarely meant. Capital X in u=rwX,go=rX grants execute to directories and only to files that already had an execute bit.
umask shapes new files; chmod changes existing ones
A process's umask withholds bits from newly created files; chmod sets bits on existing ones explicitly — except that a who-less clause like a bare +x is filtered through umask by chmod itself, a case this page flags. The accordion under the value table walks the arithmetic.
A trailing +, @ or . is metadata, not a permission
An eleventh character after the mode string means an ACL (+), macOS extended attributes (@) or a SELinux context (.). The paste field decodes the bits and explains the suffix — with an ACL, the nine bits are not the whole story; getfacl shows the rest.
Short octal pads from the left
chmod reads 7 as 0007 and 55 as 0055: digits fill from the others side, so 7 yields ------rwx, not rwx------. The octal field accepts short forms for fidelity and raises a padding chip under three digits.
Common errors
Digit 3 is 8 — octal uses digits 0–7- Octal has no 8 or 9 — each digit sums read 4, write 2 and execute 1, so 7 is the ceiling. The message anchors the offending position; fix that digit.
17777 is larger than 7777 — a file mode has only twelve bits- Twelve mode bits top out at 7777; a larger number names bits that do not exist in a file mode, and chmod itself would refuse it.
`q` is not a permission — use r, w, x, X, s or t- Symbolic modes use u, g, o or a for the class; one of + - =; then r, w, x, X, s or t. Anything else is refused with its position — guessing would write the wrong bits.
Position 7 is `q` — it should be r or -- A mode string is strictly positional: after the type character come three triplets, each column with its own legal letters. The parser names the first column that breaks the pattern.
The mode field is 7 characters — ls prints 10: one type character and nine permission columns- The mode field is ten characters — one type character plus nine columns — optionally followed by +, @ or a dot. A different length means a clipped paste; repasting the whole ls -l line works, since only the first field is read as the mode.
FAQ
What does chmod 777 mean?
Read, write and execute for the owner, the group and everyone else. The security line here says it plainly — 777: world-writable — almost never what you want; consider 755. Any local account can rewrite a 777 file. For shared writing, prefer 775 with a common group, or a sticky 1777 directory.
What is the difference between chmod 755 and 644?
One bit per class: execute. 755 is rwxr-xr-x — full owner control, read-and-execute for the rest; 644 is rw-r--r--, the same reach minus execute. Directories, scripts and binaries take 755, since entering a directory and running a program both need x; plain data takes 644.
What is chmod 400 used for?
400 is r--------: the owner may read, and nobody may write — the owner included, until the mode is changed back. That is the credentials posture: ssh refuses a private key other accounts can read, so key files live at 400 or 600. The write ban also blocks accidental edits.
What does drwxr-xr-x mean?
The leading d marks a directory; then rwx for the owner, r-x for the group, r-x for others — octal 755. The owner may create and delete entries; everyone else may list and enter. Pasting it above reproduces this breakdown live.
How do I chmod recursively without making every file executable?
Use capital X: chmod -R u=rwX,go=rX target. Lowercase x would mark every file executable, documents included; X applies execute to directories and only to files that already had an execute bit somewhere. The Recursive toggle on this page prints this exact form.
What are setuid, setgid and the sticky bit?
The optional leading digit: setuid 4, setgid 2, sticky 1. A setuid executable runs with its owner's identity — passwd ships as 4755 on typical Linux systems. Setgid runs with the file's group, and on a directory hands that group to new entries. Sticky on a directory limits deletion to each file's owner — /tmp is 1777.
What is umask, and how does it relate to chmod?
umask is the creation-time counterpart: a per-process mask of bits that new files never receive. With the common 022, directories arrive as 755 and files as 644 — creation starts from 666, never granting execute. chmod edits existing modes explicitly; the one overlap is a who-less clause like a bare +x, which chmod filters through umask — flagged here when you write one.
Keyboard shortcuts
- ⌘/Ctrl + C
- Copy the generated chmod command when nothing is selected; a real selection copies itself.
- ⌘/Ctrl + Shift + C
- Copy the generated command regardless of selection.
- ⌘/Ctrl + S
- Download the .txt summary of every representation.
- t
- Switch the color theme; inert while a field has focus.
- ? or ⌘/Ctrl + /
- Open the shortcut help overlay.
- Esc
- Close the topmost overlay.