What Chmod Calculator does
A chmod number is three digits, one each for the owner, the group and everyone else. Each digit is the sum of read (4), write (2) and execute (1), so 7 is rwx, 6 is rw-, 5 is r-x and 4 is r--. This calculator does that sum for you: tick the nine boxes and it returns the octal value, the nine-character symbolic string and a ready command such as chmod 755 file.txt. The boxes start at 755. It works in one direction, from ticks to number, and it covers the three standard digits only, so setuid, setgid and the sticky bit are not included.
Chmod number chart: what each digit 0 to 7 means
Every digit in a mode is one row of this table. The same eight values apply to the owner, group and other positions.
| Digit | Symbolic | Sum | Permissions |
|---|---|---|---|
| 0 | --- | 0 | No access |
| 1 | --x | 1 | Execute only |
| 2 | -w- | 2 | Write only |
| 3 | -wx | 2 + 1 | Write and execute |
| 4 | r-- | 4 | Read only |
| 5 | r-x | 4 + 1 | Read and execute |
| 6 | rw- | 4 + 2 | Read and write |
| 7 | rwx | 4 + 2 + 1 | Read, write and execute |
Because 4, 2 and 1 are powers of two, each total can only be reached one way, which is why a single digit is never ambiguous.
Common chmod values and what they are used for
Octal and symbolic pairs below were produced with the calculator above.
| Octal | Symbolic | Who can do what | Typical use |
|---|---|---|---|
| 400 | r-------- | Owner reads; nobody else has access | Read-only key files, such as a downloaded .pem key |
| 444 | r--r--r-- | Everyone reads; nobody writes | Files that should not be edited by accident |
| 600 | rw------- | Owner reads and writes; nobody else has access | SSH private keys, .env files, password stores |
| 640 | rw-r----- | Owner reads and writes; group reads | Config files a service group needs to read |
| 644 | rw-r--r-- | Owner reads and writes; everyone else reads | Ordinary files, web pages, images |
| 660 | rw-rw---- | Owner and group read and write | Files shared inside one group only |
| 664 | rw-rw-r-- | Owner and group read and write; other reads | Group-edited files that are public to read |
| 666 | rw-rw-rw- | Everyone reads and writes | Seldom appropriate for a file on disk |
| 700 | rwx------ | Owner has full access; nobody else has access | Private directories such as ~/.ssh |
| 711 | rwx--x--x | Owner full; others may pass through but not list | A home directory that exposes one known subfolder |
| 750 | rwxr-x--- | Owner full; group reads and enters | Application directories closed to other users |
| 755 | rwxr-xr-x | Owner full; everyone else reads and executes | Directories, shell scripts, programs |
| 770 | rwxrwx--- | Owner and group full; other has no access | A team directory |
| 775 | rwxrwxr-x | Owner and group full; other reads and enters | Shared project directories |
| 777 | rwxrwxrwx | Everyone has full access | Almost never the right fix on a server |
Worked examples from tick boxes to command
Make a deploy script runnable
Owner read, write, execute; Group read, execute; Other read, execute; Path deploy.sh
Octal 755, Symbolic rwxr-xr-x, Command: chmod 755 deploy.sh
These are the boxes ticked when the page first loads.
Lock down an SSH private key
Owner read and write only; every Group and Other box cleared; Path ~/.ssh/id_ed25519
Octal 600, Symbolic rw-------, Command: chmod 600 ~/.ssh/id_ed25519
Config file that a service group must read
Owner read and write; Group read; Other nothing; Path /etc/myapp/config.yml
Octal 640, Symbolic rw-r-----, Command: chmod 640 /etc/myapp/config.yml
Directory a whole team writes to
Owner read, write, execute; Group read, write, execute; Other read and execute; Path /srv/project
Octal 775, Symbolic rwxrwxr-x, Command: chmod 775 /srv/project
Why directories use 755 when files use 644
The execute bit means something different on a directory. On a file it lets the system run the file as a program. On a directory it lets a user pass through it: cd into it and open the things inside by name. Take execute away from a directory and everything beneath it becomes unreachable, even files that are themselves readable by everyone.
Read on a directory is narrower than it sounds. It allows listing the names inside, not opening them. A directory with read but no execute shows that a file exists and then refuses every attempt to use it, which produces permission denied errors that look as if they come from the file.
That is the reason for the common pairing: 755 on directories so they can be entered, 644 on files so they can be read but not run. To apply both to a whole tree without mixing them up, run find . -type d -exec chmod 755 {} + for the directories and find . -type f -exec chmod 644 {} + for the files, instead of a single chmod -R.
Octal mode and the matching symbolic chmod command
chmod also accepts letters: u for the owner, g for group, o for other and a for all three. The = form sets a class exactly, like a number does; + and - change single bits and leave the rest alone.
| Goal | Numeric | Symbolic equivalent |
|---|---|---|
| Set a directory or script to rwxr-xr-x | chmod 755 path | chmod u=rwx,go=rx path |
| Set a file to rw-r--r-- | chmod 644 path | chmod u=rw,go=r path |
| Set a private file to rw------- | chmod 600 path | chmod u=rw,go= path |
| Add execute for the owner only | No single number; depends on the current mode | chmod u+x path |
| Remove write from group and other | No single number; depends on the current mode | chmod go-w path |
| Let everyone read | No single number; depends on the current mode | chmod a+r path |
This calculator outputs the numeric form only.
What this calculator does not cover
- Special bits. A fourth leading digit sets setuid (4), setgid (2) and the sticky bit (1), as in 1777 on /tmp or 2775 on a shared directory. The tool works with three digits only.
- Typing a number in. There is no octal input box; to decode a mode, look it up in the chart above or tick boxes until the Octal value matches.
- Ownership. chmod changes what the owner, group and other may do, not who the owner and group are. That is chown and chgrp.
- Quoting. The path is placed in the command exactly as typed, so a name with spaces needs quotes or backslashes added before you run it.
- Recursion. The command targets one path. Add -R yourself to apply it to a directory and everything inside.
- Access control lists. Systems using ACLs or SELinux can allow or deny access beyond what the nine permission bits show.
How to use it
- 1
Tick or clear the three owner boxes: Owner — read, Owner — write and Owner — execute.
- 2
Do the same for the Group boxes, then for the Other boxes, which cover every user who is neither the owner nor in the group.
- 3
Type the file or directory in Path so the command is built for it. Left blank, the command uses file.txt.
- 4
Read Octal and Symbolic in the Permissions panel, with the per-class breakdown for Owner, Group and Other beside them.
- 5
Copy the line under Command and run it in a terminal. Put quotes around the path yourself if it contains spaces.