About Chmod Calculator
Linux and macOS file permissions are short, and they are easy to get wrong. You need to read a mode such as rwxr-x--- from a directory listing, or you have been told to set 640 and want to know who can do what. Each of the three inputs here updates the others as you type, so you can start from whichever you already have.
The result is a command you can copy, a spelled-out version of it, and an explanation in plain words. If the mode you picked is risky, such as anything others can write to, a warning says why.
How it works
Each digit in an octal mode adds up read (4), write (2) and execute (1), for the owner, group and others in that order. A fourth digit in front holds the special bits: setuid (4), setgid (2) and sticky (1). So 755 is 7 (4+2+1) for the owner and 5 (4+1) for the rest. The symbolic box accepts the form printed by ls -l, with or without the leading file type letter and with a trailing ., + or @, so you can paste straight from a terminal.
Special bits appear in the execute position: s for setuid or setgid, and t for sticky. A capital S or T means the special bit is set while execute is not, which usually marks a mistake, so a mode like setuid without owner execute gets its own warning. The spelled-out command uses the explicit form, such as u=rwx,g=rx,o=rx, which some people find easier to read in a script.
How to use Chmod Calculator
- Type in Octal or Symbolic, tick the Read, Write and Execute boxes, or press one of the Common settings.
- Tick Setuid, Setgid or Sticky under Special bits if you need them.
- Enter the name in File or folder name.
- Read What this means and any warning, then press Copy beside Command or Same thing, spelled out.
A real run with a setuid script
Octal: 4755
File or folder name: deploy.shSymbolic: rwsr-xr-x
Command: chmod 4755 deploy.sh
Same thing, spelled out: chmod u=rwxs,g=rx,o=rx deploy.sh
Owner: read, write and execute.
Group: read and execute.
Others: read and execute.
Setuid: a program runs with the permissions of the file's owner, not the person running it.Notice the s in the owner's execute position. On Linux, the setuid bit is ignored on interpreted scripts for security reasons, and it is meant for compiled programs, so this mode on deploy.sh is a good example of one to question.
When it helps
- Setting an SSH private key to
600, which is whatsshexpects before it will use it - Reading a listing like
drwxr-s---fromls -land working out who has access - Fixing the common
644for files and755for folders on a web server - Setting up a shared project folder, using setgid so new files keep the group
Tips for a better result
- Folders need execute to be entered. Read alone lets someone list the names but not open the files, which is why folders are usually
755where files are644. - Think twice before using
777. It is a common quick fix for a permissions error, and it lets every account on the machine change the file. Fixing the owner withchownis usually the right answer. - Mind what you run with
chmod -R. The same mode applied to files and folders together makes every file executable.findwith-type for-type dlets you treat them separately. - Set
1777only on shared temp folders, which is what the sticky bit is for. It stops users from deleting each other's files, the way/tmpworks.
Good to know
- It works out a mode and does not touch your files. You run the command yourself.
- The
+xandg-wstyle of change, which adds to or subtracts from existing permissions, is not accepted as input, because a change has no meaning without the current mode. - Access control lists, SELinux labels and file ownership also affect access, and none of them are shown in a mode.
- It does not add
-Rto the command or handle recursion. - Windows uses a different permission model, so these modes do not apply to NTFS files in the same way.
Questions people ask
What does 755 mean?
The owner can read, write and execute, and the group and others can read and execute. It is the usual setting for folders and programs, written rwxr-xr-x.
Why does SSH say my key permissions are too open?
OpenSSH refuses a private key that others can read. Set it to 600, so that only you can read and write it, with chmod 600 followed by the key's path.
What is the sticky bit?
On a folder, it means only a file's owner, the folder's owner or root can delete or rename files in it, even though everyone can write there. It appears as a t at the end, as in rwxrwxrwt.
Why do I see a capital S in a listing?
The setuid or setgid bit is set while execute is not, so it does nothing useful for a program. Usually it means execute was left out by mistake. For setuid, this page shows a warning when that happens.
What to use next
- Subnet Calculator: for the other bit-counting job on the same server
- Number Base Converter: to see an octal mode in binary, where each bit is visible
- Cron Expression Explainer: if the script you are fixing also runs on a schedule
Last reviewed . Read our editorial policy.