Chmod Calculator — Linux File Permissions (Octal ⇄ rwx)
Tick read, write and execute boxes to get the octal mode and chmod command, or decode 755, 644 and rwxr-xr-x.
| Who | Read | Write | Execute | Digit |
|---|---|---|---|---|
| Owner (user) | 7 | |||
| Group | 5 | |||
| Others | 5 |
chmod 755 deploy.sh
chmod u=rwx,g=rx,o=rx deploy.sh
- Owner (7): read, write, execute
- Group (5): read, execute
- Others (5): read, execute
See what chmod u+x,go-w does to an existing mode. Supports u/g/o/a, + - =, r w x X s t and copies such as g=u. Uses the directory setting above for X.
644 (rw-r--r--) → 744 (rwxr--r--)Runs entirely in your browser. Nothing you enter is sent anywhere. Browse all free tools.
Found a problem, or something that could be better? We read every message and we fix things quickly.
This chmod calculator converts Unix and Linux file permissions between a checkbox grid, the octal number chmod uses (755, 644, 2775) and the rwxr-xr-x string that ls -l prints. Change any one and the others follow, along with a ready-to-paste chmod command and a plain-English explanation of who can do what. It handles the setuid, setgid and sticky bits, and explains how the same bits mean different things on a directory.
It also evaluates symbolic chmod expressions such as u+x,go-w or a=rX against a starting mode, using the same rules as GNU chmod, so you can check what a command will do before running it on a server. One difference: when you leave out the u/g/o letter, real chmod applies your umask, while this tool treats it as “a” (as with a umask of 000). Nothing touches your files; it is a calculator.
How to use
- Tick the read, write and execute boxes for owner, group and others, or type an octal mode such as 750, or paste a string such as -rw-r--r-- from ls -l.
- Tick “It is a directory” if you are setting permissions on a folder; the explanation changes, because x on a directory means “can enter”.
- Enter the file name, tick Recursive if needed, and copy the chmod command.
- To check a relative change, enter the current mode and an expression such as u+x,go-w in the expression box and read the result.
- Use a preset when you just need the usual answer: 644 for files, 755 for directories and scripts, 600 for private keys.
Frequently asked questions
What does chmod 755 mean?
Each digit is a sum of read (4), write (2) and execute (1), for owner, group and others in that order. 7 = 4+2+1, so the owner can read, write and execute; 5 = 4+1, so group and others can read and execute but not write. As a string it is rwxr-xr-x. It is the standard mode for directories and for scripts or programs everyone should be able to run.
What is the difference between 644 and 755?
Only the execute bit. 644 (rw-r--r--) lets the owner read and write and everyone else read; it is the normal mode for documents, web pages, images and configuration. 755 adds execute for everyone, which a directory needs to be entered and a script needs to be run. Giving 755 to ordinary files is harmless but untidy; giving 644 to a directory makes it unusable for others.
Why is chmod 777 a bad idea?
777 gives every user on the system permission to modify or replace the file, or to add and delete files in the directory. On a web server that means any compromised process, such as a vulnerable plugin running as a different user, can rewrite your code. The usual real fix for a “permission denied” error is to change the owner (chown) or add the web server user to the file’s group, then use 755/644 or 775/664.
What are setuid, setgid and the sticky bit?
They are the optional fourth (leading) octal digit. setuid (4) makes an executable run with its owner’s privileges, which is how passwd can edit /etc/shadow. setgid (2) on an executable runs it with the file’s group; on a directory it makes new files inherit the directory’s group, which is useful for shared team folders (2775). The sticky bit (1) on a directory lets only a file’s owner delete it, as on /tmp (1777).
What permissions should SSH keys have?
OpenSSH refuses private keys that others can read. Use 600 (or 400) for private keys such as ~/.ssh/id_ed25519, 644 for public keys (.pub), 600 for ~/.ssh/authorized_keys and ~/.ssh/config, and 700 for the ~/.ssh directory itself. AWS and other cloud providers tell you to chmod 400 the .pem file they give you for the same reason.
What does a capital S or T in ls -l mean?
A lowercase s or t means the special bit is set and the execute bit under it is also set. A capital S or T means the special bit is set but execute is not, which is usually a mistake: setuid on a file nobody can execute does nothing, so rwSr--r-- is typically a sign someone ran chmod u+s on the wrong file.
Permission bits on files vs directories
• r on a file: read its contents. On a directory: list the names inside it (ls).
• w on a file: change its contents. On a directory: create, delete and rename entries inside it, but only together with x. Deleting a file is a write to its directory, not to the file.
• x on a file: run it as a program or script. On a directory: enter it (cd) and access files inside by name. A directory with r but not x lets you list names but not open anything.
Permissions are checked against the first class that matches you: if you are the owner, only the owner bits apply, even if the group or others bits are more generous.
Symbolic chmod syntax
A symbolic mode is one or more comma-separated clauses of the form [who][operator][permissions]. Who is u (owner), g (group), o (others) or a (all). The operator is + to add, - to remove or = to set exactly. Permissions are r, w, x, X (execute only if it is a directory or already executable by someone), s (setuid/setgid) and t (sticky), or a single u, g or o to copy another class’s current bits.
Examples: chmod u+x deploy.sh makes a script executable for its owner. chmod go-w file removes write for everyone but the owner. chmod -R a=rX public/ makes a tree readable by all, with directories enterable and files not executable. chmod g=u shared/ gives the group the same rights as the owner.
Safe defaults by use case
• Web root files: 644, directories 755, owned by your deploy user; uploads directory owned by the web server user, 755.
• Secrets (.env, private keys, credentials): 600, owned by the service user that reads them.
• Shell scripts in a repository: 755. Git stores only the executable bit, as file mode 100755 or 100644; set it with git update-index --chmod=+x on Windows.
• Shared team directory: 2775 with a common group, so new files inherit the group.
• Your umask decides the starting point: with the common 022, new files get 644 and directories 755; with 077, 600 and 700.
Related free tools
- Subnet Calculator — Network, broadcast, host range and mask for any CIDR; split networks with VLSM, expand IPv6 and find overlapping ranges.
- .gitignore Generator — Combine .gitignore templates for languages, frameworks, editors and operating systems into one clean file.
- Cron Expression Generator — Build a cron schedule from dropdowns or paste one, read it in plain English, and see the next 10 run times in your zone and UTC. Free, in your browser.
- Docker Run ⇄ Compose — Turn a docker run command into a docker-compose.yml service, or a Compose service back into docker run.