Vibe Engines is free, interactive AI engineering & system design — runs in your browser. Pick a learning path
Chmod Calculator
A Unix file-permission calculator. Toggle read, write and execute for owner, group and others to get the octal mode (like 755) and the symbolic string (rwxr-xr-x), or type an octal number to see exactly which permissions it grants. Explains what each bit means and the common modes to reach for.
chmod 755 file| read (4) | write (2) | execute (1) | |
|---|---|---|---|
| Owner | |||
| Group | |||
| Others |
Unix permissions look cryptic, but they are nine on-off switches written two ways. Every file has three classes of user, the owner, the group and others, and each class gets three switches: read, write and execute. Click the switches and the tool writes the octal mode, the symbolic string and the matching chmod command. Type an octal mode and it sets the switches for you.
What it computes
Within a class, read is worth 4, write 2 and execute 1, and the class digit is the sum of the switches that are on. Each digit holds exactly three bits, so the mode is written in octal, base 8, always in the order owner, group, others. These are the nine POSIX permission bits, from 0400 for owner read down to 0001 for others execute.
digit = 4 × read + 2 × write + 1 × execute each switch is 1 or 0
mode = owner digit, group digit, others digit
symbolic = r or -, w or -, x or - for each class in turn
command = chmod mode fileDecoding runs the other way: each digit is split back into its three bits by testing it against 4, 2 and 1. Characters that are not digits from 0 to 7 are ignored, and a short entry is padded with leading zeros, the same way chmod reads it, so 64 means 064, or ---rw-r--.
A worked example
The calculator opens on 755. The owner row has all three switches on; the group and others rows have read and execute on.
| Class | Switches on | Sum | Digit | Symbolic |
|---|---|---|---|---|
| Owner | read, write, execute | 4 + 2 + 1 | 7 | rwx |
| Group | read, execute | 4 + 1 | 5 | r-x |
| Others | read, execute | 4 + 1 | 5 | r-x |
755 rwxr-xr-x chmod 755 fileAs one number, octal 755 is 7 × 64 + 5 × 8 + 5 = 493 in decimal, which is why code that sets a mode needs an octal prefix, as in 0o755 in Python or 0755 in C. Decoding works digit by digit: type 640 and 6 = 4 + 2 gives rw-, 4 gives r-- and 0 gives ---, so the mode reads rw-r-----.
Assumptions and limits
- Nine bits only. Setuid, setgid and the sticky bit form a fourth, leading digit, as in 4755 or 1777, which this calculator does not set. The field takes three digits, so for a four-digit mode enter only the last three.
- No file-type character.
ls -lprints one more character first,-for a file ordfor a directory, and may append+when an access control list exists. - Execute means two things. On a file it allows running it. On a directory it allows entering it and reaching files inside by name, while read only lists the names.
- Other layers can override the bits. ACLs, a filesystem mounted
noexec, SELinux or AppArmor policy, and the root user, who bypasses read and write checks, all sit outside the mode. - The command is a template. Replace
filewith your path.chmod -R 755also makes every file executable;chmod -R u=rwX,go=rXis safer, because a capital X adds execute only to directories and to files that already have it.
How to use the result
Start from the least access a file needs and add only what a real user or process requires.
- 644 for ordinary files and 755 for directories and scripts. These are what the common umask
022produces, since it removes write for group and others from the 666 and 777 that new files and directories request. - 600 for secrets such as SSH private keys and
.envfiles, and 700 for~/.ssh. OpenSSH refuses a private key that grants the group or others any permission. - 640 or 750 when a service account should read a file through its group, instead of opening it to everyone.
- 777 is almost never right, because anyone on the machine can change or replace the file. Shared scratch directories such as
/tmpuse 1777, with the sticky bit. - Fix ownership before widening the mode. When a process cannot write,
chownorchgrpto the right user or group is usually the real fix.
How it works
- Toggle r/w/x for owner, group and others to get the octal and symbolic mode.
- Type an octal mode (e.g. 640) to decode it back to rwx.
- Presets for the common modes: 644, 755, 600 and 777.
- Read = 4, write = 2, execute = 1, summed per class.
Frequently asked questions
How does the octal permission number work?
Each of the three permission classes, owner, group and others, gets one octal digit built from three bits: read is 4, write is 2 and execute is 1. You add the ones you want, so read, write and execute make 7, read and execute make 5, read and write make 6, and read only is 4. So 755 means the owner has 7, rwx, while group and others have 5, r-x. The three digits, left to right, are always owner, group, others.
What is the difference between chmod 644 and 755?
644, or rw-r--r--, is the usual mode for regular files: the owner can read and write, and everyone else can only read. 755, or rwxr-xr-x, is the usual mode for directories and executables: the owner can read, write and execute, while others can read and execute but not modify. The only difference is the execute bit for all three classes. On a file it means run this program, and on a directory it means you may enter it.
What does the execute bit mean on a directory?
On a directory, execute is the search permission: it lets you enter the directory and reach the files inside by name. Read on a directory only lets you list the names. Without execute you cannot cd into it or open a file inside, even one whose name you know and whose own mode allows reading. That is why directories are almost always 755, 750 or 700 rather than 644: removing execute from a directory locks people out of everything within it.
What about setuid, setgid and the sticky bit?
They form a fourth, leading octal digit, as in 4755, 2755 or 1777, which this calculator does not set. Setuid, worth 4, makes an executable run with its owner as the user. Setgid, worth 2, runs it with the file group or, on a directory, makes new files inherit the directory group. The sticky bit, worth 1, stops users deleting each other’s files in a shared directory such as /tmp. Setuid on the wrong program is a classic privilege escalation risk.
What permissions should an SSH private key have?
Use 600, read and write for the owner only, or 400 if you want it read-only. The ~/.ssh directory itself should be 700. OpenSSH checks this: if a private key file grants any permission to the group or to others, it prints a warning that the key is unprotected and refuses to use it. The same 600 mode is a sensible default for any secret on disk, such as a .env file, a token file or a database password file.
Is chmod 777 ever a good idea?
Almost never. 777, or rwxrwxrwx, lets every user and every process on the machine change, replace or delete the file, which turns any compromised account into a way to tamper with it. It usually appears when a permission error is fixed by opening everything up. The better fix is ownership: chown the file to the user that needs it, or give a shared group access with 770 or 775. Shared scratch directories such as /tmp use 1777, where the sticky bit protects each user’s files.