Chmod Calculator: Octal, Symbolic & Permission Converter

Chmod Calculator: Octal, Symbolic and ls -l Permissions

chmod changes who can read, write and execute a file or directory. Its mode can be written three ways: octal (755), symbolic (u=rwx,go=rx), and the nine-character string ls -l prints (rwxr-xr-x). This calculator converts between all three, shows what each class can actually do, flags risky combinations, and builds the command with the target quoted for the shell.

How Linux permissions work

Every file has three permission sets: one for its owner (u), one for its group (g) and one for everyone else (o). Each set has three bits.

Bit	Letter	Value	On a file	On a directory
read	r	4	read the contents	list the entries
write	w	2	modify the contents	create, rename and delete entries
execute	x	1	run it as a program	enter it (`cd`) and reach entries by name

An octal mode adds the values in each set: rwx is 4+2+1 = 7, r-x is 5, r-- is 4. So 754 means owner rwx, group r-x, others r--.

The kernel checks only one class per access: the owner class if you own the file, otherwise the group class if you are in the group, otherwise others. That is why a file with mode 044 can be read by everyone except its owner.

Reading ls -l output

ls -l prints a type character followed by nine permission characters:

-rw-r--r--   a regular file, mode 644
drwxr-xr-x   a directory, mode 755
-rwsr-xr-x   a regular file, mode 4755 (setuid)
drwxrwxrwt   a directory, mode 1777 (sticky)

A trailing . means an SELinux context is set, and + means an ACL is present. An ACL can grant access the nine characters do not show. Paste the line, with or without the type character, into the box above and the calculator reads the mode from it.

Common modes

Mode	ls -l	Symbolic	Typical use
400	r--------	u=r,go=	Private key you never edit
440	r--r-----	ug=r,o=	Read-only for owner and group
444	r--r--r--	a=r	Read-only for everyone
600	rw-------	u=rw,go=	Secrets: SSH private keys, `.env` files
640	rw-r-----	u=rw,g=r,o=	Config the owner edits and a service group reads
644	rw-r--r--	u=rw,go=r	Regular files: web content, source code
660	rw-rw----	ug=rw,o=	Files two users in one group both edit
664	rw-rw-r--	ug=rw,o=r	Group-editable files, readable by all
700	rwx------	u=rwx,go=	Private directory such as `~/.ssh`
711	rwx--x--x	u=rwx,go=x	Directory others may pass through but not list
750	rwxr-x---	u=rwx,g=rx,o=	Directory shared with one group only
755	rwxr-xr-x	u=rwx,go=rx	Executables, scripts, most directories
775	rwxrwxr-x	ug=rwx,o=rx	Directory a group writes to
777	rwxrwxrwx	a=rwx	Writable by every user; avoid
1777	rwxrwxrwt	ug=rwx,o=rwxt	Shared scratch directory such as `/tmp`
2775	rwxrwsr-x	u=rwx,g=rwxs,o=rx	Group project directory; new files inherit the group
4755	rwsr-xr-x	u=rwxs,go=rx	Setuid binary such as `passwd`

Special bits and four-digit modes

A fourth, leading octal digit holds three more bits. A three-digit mode is the same as a four-digit mode with a leading 0.

Digit	Name	ls -l shows	Effect
4	setuid	`s` in the owner execute slot	An executable runs with its owner's privileges instead of the caller's. Linux ignores the bit on interpreted scripts.
2	setgid	`s` in the group execute slot	An executable runs with its group's privileges. On a directory, new files and subdirectories inherit the directory's group.
1	sticky	`t` in the others execute slot	On a directory, only a file's owner, the directory's owner or root can delete or rename entries in it. Linux ignores it on regular files.

A capital letter (S or T) means the special bit is set but the matching execute bit is not. 4644 shows as rwSr--r--, and 1776 as rwxrwxrwT.

GNU chmod has one trap here. On a directory, a numeric mode of up to four digits does not clear existing setuid or setgid bits unless the number sets them. chmod 755 dir leaves a setgid directory setgid. To clear the bit, write five digits (chmod 00755 dir) or use chmod g-s dir. Sticky is not preserved this way; chmod 755 on a 1777 directory clears it.

Files and directories behave differently

The same mode means different things:

A directory without execute cannot be entered, so nothing inside it is reachable even if the files are readable.
A directory with read but not execute lets you list names but not open or stat anything.
A directory with execute but not read lets you open files whose names you already know, but not list the directory.
Write on a directory only works together with execute, and controls creating, renaming and deleting entries, not editing the files inside.
Deleting a file needs write on its directory, not on the file.

Switch the File and Directory toggle to see the description, warnings and X behaviour change.

Symbolic mode reference

A symbolic mode is a comma-separated list of clauses. Each clause is [ugoa]* followed by one or more operations, each an operator and permissions.

Part	Values	Meaning
who	`u` `g` `o` `a`	owner, group, others, all three
operator	`+` `-` `=`	add bits, remove bits, set exactly these bits
permissions	`r` `w` `x`	read, write, execute
	`X`	execute only if the target is a directory or already has an execute bit for someone
	`s` `t`	setuid/setgid, sticky
	`u` `g` `o`	copy the current bits of that class

Examples: u+x adds execute for the owner. go-w removes write from group and others. a=r makes everything read-only. u+r-w chains two operations. g=u gives the group whatever the owner currently has. u=rwx,go=rx sets 755 from any starting mode.

Clauses are evaluated left to right, and g=u copies from the mode as it stands after the earlier clauses. s affects setuid when u is in the who list and setgid when g is, and nothing when only o is. t sets sticky for o, a or no who letters, and does nothing for u or g.

umask and chmod

The umask decides the starting mode of new files and directories: files start from 666 and directories from 777, minus the umask bits. With the common umask 022 that gives 644 files and 755 directories.

chmod with a numeric mode ignores the umask. A symbolic clause with no who letters does not: bits set in the umask are left alone by + and -. With umask 022, chmod +w file adds write for the owner only, not group and others, while chmod +x file adds execute for everyone because 022 does not mask execute. Write a+w to override the umask. Relative expressions in this calculator assume umask 022.

Recursive chmod

A numeric mode applies the same bits to every file and directory. chmod -R 755 site makes every regular file executable. Two safer approaches:

# X sets execute only on directories and files that already have it
chmod -R u=rwX,go=rX site
 
# or set directories and files separately
find site -type d -exec chmod 755 {} +
find site -type f -exec chmod 644 {} +

When you tick -R, the calculator builds both forms from your current mode. Keep --preserve-root on: it makes GNU chmod -R refuse to operate on /.

Examples

Make a script executable

chmod u+x deploy.sh

Lock down an SSH key

chmod 600 ~/.ssh/id_ed25519

OpenSSH refuses to use a private key that other users can read.

Fix a web root: files 644, directories 755

chmod -R u=rwX,go=rX /var/www/site

The capital X keeps files non-executable while directories stay enterable. This avoids the classic mistake of chmod -R 755.

chmod 2775 /srv/project

Group members can create files, and the setgid bit makes new files belong to the directory's group.

Copy permissions from another file

chmod --reference=template.conf new.conf

The result depends on the other file, so the calculator cannot compute it. Use stat -c %a template.conf to read its octal mode, then paste that here.

What the calculator adds to the command

Target is treated as one path, never split on spaces. Spaces and shell metacharacters are single-quoted, a leading ~/ stays unquoted so tilde expansion still works, and a name starting with - gets -- in front of it.
Recursive (-R) applies the mode to a directory and everything below it.
Verbose (-v) prints every file processed. Report changes (-c) prints only files whose mode changed.
Preserve root (--preserve-root) is suggested whenever -R is on.
The target path is never added to the page URL or sent to analytics. Only the mode is in the shareable link.

Mistakes to avoid

chmod -R 777 gives every user on the machine write access. It "fixes" permission errors by removing all protection. Find the owner or group that needs access instead; that is often a job for chown, not chmod.
Removing x from a directory makes everything inside unreachable, even files that are themselves readable.
Setting setuid on a shell script. Linux ignores it, so it adds risk on other systems and does nothing on yours.
Recursing from the wrong place. Run pwd first and keep --preserve-root on.

chmod command explained is a longer written guide with more examples
chown Command Builder changes the owner and group instead
ls Command Builder: ls -l shows the current permissions
All Linux command builders

Frequently asked questions

What do chmod 755, 644, 600 and 777 mean?

755 is rwxr-xr-x: the owner can read, write and execute; group and others can read and execute. It is the usual mode for programs, scripts and directories. 644 is rw-r--r--: the owner can read and write, everyone else can only read. It is the usual mode for regular files. 600 is rw-------: only the owner has any access, which suits SSH private keys and files with secrets. 777 is rwxrwxrwx: every user can read, modify and execute, so avoid it.

How do I convert between octal, symbolic and ls -l permissions?

Add the values of the bits in each class: read is 4, write is 2, execute is 1. rwx is 7, r-x is 5, r-- is 4, so rwxr-xr-- is 754. In ls -l the nine characters are three groups of three for owner, group and others. In symbolic form 754 is u=rwx,g=rx,o=r. Paste any of these forms into the calculator and the other two are filled in.

What does the capital X in chmod do?

X adds execute only if the target is a directory or already has an execute bit set for someone. chmod -R u=rwX,go=rX dir gives directories 755 and ordinary files 644 in one command, and leaves files that were already executable executable. A lowercase x would make every file executable.

What are setuid, setgid and the sticky bit?

They are three special bits held in an optional fourth leading octal digit. Setuid (4000) makes an executable run with its owner's privileges; Linux ignores it on scripts. Setgid (2000) makes an executable run with its group's privileges, and on a directory makes new files inherit the directory's group. Sticky (1000) on a directory lets only a file's owner, the directory's owner or root delete or rename entries, as in /tmp (mode 1777). In ls -l they show as s in the owner or group execute slot and t in the others slot, in capitals when the execute bit is missing.

What does chmod +x do?

It adds execute permission. With no who letters, chmod applies the umask, so with the common umask 022 it adds execute for owner, group and others. With a stricter umask such as 077 it adds execute for the owner only. Write u+x to give the owner execute regardless of the umask, or a+x for everyone.

Why should I avoid chmod -R 777?

It gives every user and every process on the machine permission to modify and execute every file under the directory. Services such as OpenSSH and sudo refuse to use files with those permissions, and it hides the real problem, which is usually wrong ownership. Fix the owner or group with chown, grant group write with 664 or 775, and use chmod -R u=rwX,go=rX or find with -type d and -type f to set directories and files separately.

What permissions should SSH keys and the .ssh directory have?

Use 700 for ~/.ssh, 600 for private keys (400 also works), 644 for public keys, and 600 for authorized_keys and config. OpenSSH refuses a private key that group or others can access and reports that the key file is unprotected. Your home directory must not be writable by group or others either.

What are 4-digit chmod modes?

The first digit holds the special bits: 4 for setuid, 2 for setgid and 1 for sticky, added together. For example 2755 is 755 with setgid and 1777 is 777 with sticky. A three-digit mode is the same as a four-digit mode with a leading zero. On a directory, GNU chmod keeps existing setuid and setgid bits when you give four digits or fewer without setting them; write five digits, such as 00755, or use g-s to clear them.

How does umask interact with chmod?

The umask removes bits from the mode of newly created files and directories: files start at 666 and directories at 777, so umask 022 gives 644 and 755. chmod with a numeric mode ignores the umask. A symbolic clause with no who letters, such as +w, does respect it: bits set in the umask are not touched. With umask 022, chmod +w adds write for the owner only, while a+w adds it for everyone.

Is the path I type uploaded or saved?

No. The calculator runs in your browser. The target field is used only to build the command text. It is never added to the page URL and never sent to analytics; the shareable link carries only the mode and the file or directory choice.