Skip to the tool
DevToolBench

Chmod Calculator

Turn file permissions into octal, symbolic form and a command.

Owner
Group
Others
-rw-r--r--

Owner can read and write. Group can read. Everyone else can read.

Common modes:

Everything runs in your browser. Nothing you type is sent to a server.

Found a bug in this tool? Report it.

Share this tool

What this tool does

This chmod calculator keeps the three ways of writing a Unix file mode in sync. Tick read, write and execute for owner, group and others and the octal number, the symbolic string and the ready-to-run chmod command all update together; type an octal mode or paste a rwxr-xr-x string from ls -l and the tick boxes follow. Setuid, setgid and the sticky bit are there too, as the fourth digit most tables leave out.

Below the boxes there is a plain-English sentence describing exactly what the current mode allows. That is the part worth reading before you copy the command.

How to read the number

Each digit is one audience, in a fixed order: owner, group, others. Each digit is the sum of three values — read 4, write 2, execute 1 — so any combination has exactly one number.

  • 7 = 4 + 2 + 1 = read, write and execute
  • 6 = 4 + 2 = read and write
  • 5 = 4 + 1 = read and execute
  • 4 = read only

That is the whole system. 750 is "everything for me, read-and-run for my group, nothing for anyone else", and once the addition is obvious you stop needing a table.

644 or 755: the only question most files raise

The difference is the execute bit, and the rule is narrower than people expect: execute is for things that are run and for directories, nothing else.

Use 644 for files the system reads — HTML, CSS, images, JSON, configuration, and source files that are imported by an interpreter rather than launched. Use 755 for directories and for scripts you invoke directly.

Directories are the part that surprises newcomers. On a directory, execute does not mean "run" — it means "traverse". A directory with read but no execute lets you list the names inside and lets you open none of them, which produces a permission error that reads like nonsense until you know this. That is why directories are 755 and almost never 644.

There is one mode worth learning as a reflex: 600 for private keys. SSH refuses to use a key file that is readable by anyone else, and that refusal is a feature.

Why 777 is never the fix

chmod 777 means every account on the machine may rewrite the file. On a shared host or a web server, "every account" includes the one your application runs as — the same account an attacker reaches through a file upload or a template injection. A world-writable directory turns a small mistake into a persistent one, because the attacker can now leave something behind.

777 gets used because it makes an error go away, and it does, which is exactly what makes it dangerous: the underlying problem was almost always ownership, not permission. The file belongs to your user and the server runs as another; the correct fix is chown to the right user or group, then 644 or 755. If you cannot change ownership, 664 with a shared group solves the same problem without opening the file to the whole machine.

The sticky bit, and why /tmp needs it

/tmp is mode 1777 — world-writable, with the sticky bit on. Without that leading 1, anyone could delete anyone else's temporary files, because in Unix the permission to delete a file comes from write access to the directory holding it, not from the file's own mode. The sticky bit narrows deletion and renaming to each file's owner, which is what makes a shared scratch directory workable at all.

Setuid (4000) and setgid (2000) are rarer and deserve more caution. Setuid runs a program with the privileges of its owner; a setuid-root binary with a bug is a local privilege escalation. Setgid on a directory is the friendlier of the two: new files inherit the directory's group, which is the tidiest way to run a shared folder.

Deploying alongside this? The hash generator verifies the artefact you are about to upload, and the JSON formatter makes the config file you are about to chmod readable first.

Frequently asked questions

What does chmod 755 actually mean?

The owner may read, write and execute; everyone else may read and execute but not write. Each digit is one audience — owner, group, others — and each is the sum of read 4, write 2 and execute 1. So 7 is 4 plus 2 plus 1, and 5 is 4 plus 1. It is the standard mode for a directory and for a script that other people need to run.

Why is 777 always the wrong answer?

Because it lets any account on the machine rewrite the file, and on a web server that includes the account your application runs as. A single injected upload then becomes a permanent backdoor. Whenever 777 makes a problem disappear, the actual fault is ownership: the right fix is chown to the user or group that needs access, then 644 or 755.

What is the difference between 644 and 755?

Only the execute bit. Use 644 for anything the system reads — HTML, images, configuration, source files that are imported rather than run. Use 755 for directories, which need execute to be traversable at all, and for scripts you intend to launch directly. Marking a data file executable does not help and quietly widens what a mistake can do.

Why can anyone delete files in /tmp but not each other's?

The sticky bit, which shows as t in the last position of rwxrwxrwt and as the leading 1 in 1777. On a world-writable directory it restricts deletion and renaming to the owner of each file. Without it, world-writable would mean anyone could delete anyone's work, because permission to delete a file comes from write access to the directory that holds it.

What do the capital S and T in a mode mean?

That a special bit is set while the matching execute bit is not, as in rwSr--r--. It is almost always a mistake — setuid without execute does nothing at all. The ls command uses the capital letter precisely so the combination looks wrong at a glance.

Related tools

Updated