Chmod Calculator_
Tick the boxes and the number follows, or type the number and the boxes follow — both directions stay in step, and the chmod line underneath is the thing you actually paste into a terminal. The fourth digit is here too, which is where setuid, setgid and the sticky bit live.
What the other calculators leave out is the sentence after the number. A mode is not merely a value to convert: 777 hands every account on the machine the right to rewrite the file, 644 on a private key is the reason SSH is refusing to connect, and a capital S in the symbolic form means a bit that is set and doing nothing. Those notes appear as you build the mode.
| Class | read | write | execute | Digit |
|---|---|---|---|---|
| Owner | 4 | |||
| Group | 4 | |||
| Others | 4 |
chmod 644 file- Input
- An octal mode typed either way round — 644, 0644 or the four-digit 4755 — or the nine-character symbolic string straight out of ls -l, with or without the leading file-type character.
- Output
- The other notation, the digit each class contributes, and the chmod command with your filename in it. Recursive adds -R.
- Processing
- Arithmetic in this tab. Nothing about your filesystem is known here, and nothing is sent anywhere — the page is doing bitwise work on nine booleans.
- Limits
- This computes a mode; it cannot tell you whether you can apply it. Ownership, the parent directory, ACLs, SELinux and mount options all sit between a valid mode and a successful chmod.
- Where the fourth digit hides
- Setuid, setgid and the sticky bit are not shown alongside the permissions in ls -l — they replace the execute character inside it. rwsr-xr-x is 4755, and rwSr--r-- is 4644, where the capital letter means the bit is set on something that cannot execute and therefore does nothing at all. Most calculators drop the fourth digit, which is why a mode pasted from a terminal so often fails to survive the round trip.
Three digits, and what each one is for
Why permissions are numbers at all
Each class of user gets three yes-or-no answers, so each class fits in three bits, and three bits is one octal digit. Read is worth 4, write 2, execute 1, and the digit is their sum — which is why every digit from 0 to 7 means something and 8 and 9 are not modes at all. The three digits are owner, then group, then everyone else, in that order, and nothing about the numbering is arbitrary once you can see it as bits.
Execute means something different on a directory
On a file, execute means the kernel will run it. On a directory it means permission to traverse — to name something inside it and reach that thing. Read on a directory only lets you list the names. This is why a directory set to 644 looks empty or broken rather than forbidden: you can see the entries and cannot open any of them. It is also why directories are 755 while the files inside them are 644, a pairing that looks inconsistent until you know the two meanings of x.
What 777 really grants, and why it keeps getting typed
chmod 777 is the most-searched permission on the internet and almost never the right answer. It grants read, write and execute to every account on the machine — not to your team, not to the web server, to every process running as any user, including one that arrived through some unrelated flaw. It gets typed because a permission error is genuinely hard to diagnose and 777 removes permissions from the list of suspects. That is a reasonable debugging step and a terrible resting state: once it works, the actual fix is nearly always ownership rather than mode, and the mode wants putting back.
The error that sends most people here
WARNING: UNPROTECTED PRIVATE KEY FILE! followed by Permissions 0644 for 'id_rsa' are too open is SSH refusing to use a key that anybody else on the machine can read. The fix is chmod 600 ~/.ssh/id_rsa, and the part the error does not mention is that the directory is checked too — ~/.ssh itself wants 700, and a group-writable home directory can fail the same check.
A valid mode is not the same as a successful command
Only the owner of a file and root may change its mode, so chmod can fail on a perfectly correct number. Beyond that, several mechanisms outrank the mode entirely: POSIX ACLs can grant or deny past it, SELinux and AppArmor can refuse an operation the mode permits, a filesystem mounted read-only ignores the whole question, and umask quietly clears bits from anything newly created. If a mode looks right and behaves wrong, the mode is usually not the thing that is wrong.
Tick, type, or pick a preset
- 01Type an octal mode, or paste the nine-character string from ls -l — the leading d or - is fine, it is ignored.
- 02Or tick the grid directly. The digit beside each row updates as you go, so the arithmetic stays visible.
- 03Turn on setuid, setgid or sticky if you need the fourth digit, and watch what happens to the symbolic form.
- 04Put your filename in "Applies to", add -R if it is a directory tree, and copy the command.
SSH will not use your key
The connection fails with a warning about an unprotected private key file. The key is fine; the mode is not, and the error does not name the fix.
-rw-r--r-- 1 you staff 2610 id_rsa
chmod 600 ~/.ssh/id_rsa chmod 700 ~/.ssh
A deploy script that has to be runnable
The file is in the repository and git preserved only the execute bit it was committed with. Running it reports permission denied even though you own it.
-rw-r--r-- deploy.sh
chmod 754 deploy.sh → rwxr-xr--
A web root somebody set to 777
Uploads worked, so the mode stayed. Every account on the host can now rewrite the application's own files, which is a far larger grant than the one that was needed.
drwxrwxrwx public/ -rwxrwxrwx index.php
chmod -R 755 public/ chmod 644 public/index.php
A shared upload directory that has to stay tidy
Several accounts write into one directory and you do not want any of them deleting another's files. This is the one legitimate use of world-writable permissions.
chmod 777 /var/spool/shared
chmod 1777 /var/spool/shared → rwxrwxrwt
The modes people actually look up
| Octal | Symbolic | What it is for |
|---|---|---|
| 644 | rw-r--r-- | Regular file — The default for a file you want everyone to read and only you to change. Web content, configuration that holds no secrets, anything in a repository. |
| 755 | rwxr-xr-x | Directory or program — The default for directories and for anything meant to be run. Execute on a directory means permission to enter it, which is why a directory at 644 appears empty rather than forbidden. |
| 600 | rw------- | Private key, credentials — Owner reads and writes, nobody else sees it at all. This is the answer to "permissions 0644 for id_rsa are too open". |
| 700 | rwx------ | Private directory — The mode for ~/.ssh itself. SSH checks the directory as well as the key, and a group-readable .ssh fails the same way. |
| 664 | rw-rw-r-- | Shared within a group — Two accounts in the same group both editing, everyone else reading. Depends on the file actually being owned by that group. |
| 775 | rwxrwxr-x | Shared directory — The group-writable counterpart of 755, for a directory a team deploys into. |
| 777 | rwxrwxrwx | Everyone, everything — Read, write and execute for every account on the machine. Almost always a diagnostic step that got committed rather than a decision. |
| 1777 | rwxrwxrwt | Sticky shared directory — World-writable, but only the owner of a file can delete it. This is /tmp, and it is the one legitimate use of 777-style permissions. |
Every pair in this table is asserted in the test suite: the octal is parsed, rendered to symbolic, and compared. A typo here fails the build rather than misinforming somebody at a terminal.
Habits that keep permissions boring
- Reach for ownership before you reach for a wider mode.
chownor adding a user to a group solves most permission errors that 777 merely hides. - Set directories and files separately when recursing.
chmod -R 755across a tree makes every document executable;find . -type d -exec chmod 755 {} +andfind . -type f -exec chmod 644 {} +is the pair that does what you meant. - Check the symbolic form after setting a special bit. A capital
SorTis the file telling you the bit is set and inert. - Remember
umaskwhen a new file is not the mode you expected. It subtracts bits at creation time, and 022 — the common default — is why new files arrive at 644 rather than 666. - On a directory, add execute wherever you added read. Read without execute lists names you cannot open, which produces some of the most confusing errors in Unix.
Where a correct mode still goes wrong
777 is a diagnostic, not a fix
It works because it removes permissions from the list of suspects, which is useful for one minute and dangerous permanently. Anything running on that machine — including something you did not install — can rewrite the file.
Recursive execute on files is a common accident
chmod -R 755 is meant for directories and hits every file too, marking images and configuration as programs. It rarely breaks anything immediately, which is exactly why it survives.
Setuid on a root-owned file is privilege escalation waiting for a bug
The program runs as its owner rather than as whoever started it. That is how passwd works and how a great many exploits work; if you are not certain you need it, you do not.
ACLs and SELinux outrank the mode
A trailing + in ls -l means there are ACLs the mode does not describe. If access is denied on a mode that plainly allows it, check getfacl and the security context before changing the number again.
Notation, bits, and what is computed
- Notation
- Octal in one to five digits, with optional leading zeros, exactly as chmod accepts them. Symbolic in the nine-character ls -l form, with the leading file-type character optional.
- Special bits
- setuid 4000, setgid 2000, sticky 1000. Rendered inside the execute column as s, s and t — capitalised when the matching execute bit is clear, which marks a bit that has no effect.
- Round trip
- Every mode in the reference table, and every capital-letter form, is asserted to survive octal → symbolic → octal unchanged. Dropping the fourth digit is the usual failure and it fails the build here.
- Not computed
- Ownership, ACLs, SELinux contexts, umask and mount options. All of them can override a mode, and none of them is knowable from a number.
- Network
- None from tool code. A test sweep calls every function this page uses with
fetchandXMLHttpRequestreplaced by stubs that throw, so a stray request fails the build instead of shipping. Disconnect from the network and the page still works.
Questions about chmod and file permissions
What does chmod 777 do?
It grants read, write and execute to the owner, to the group, and to everyone else — every account on the machine, and every process running as any of them. On a directory it also allows creating and deleting entries. It is the widest setting there is, and outside a world-writable scratch directory it is almost always broader than the problem being solved.
Is chmod 777 safe?
On a multi-user machine or anything reachable from a network, no. Any process that can already run code as any user can rewrite the file, so a vulnerability elsewhere becomes a way to change your application. It is defensible on a throwaway container or a single-user machine while you narrow down a permission error, provided you put it back.
What is the difference between 644 and 755?
The execute bit. 644 is read and write for the owner and read for everyone else, which is what a document or a configuration file wants. 755 adds execute, which a program needs to run and a directory needs to be entered at all. Files 644, directories 755 is the pairing behind most of what you see on a Unix system.
How do I fix "permissions are too open" for an SSH key?
chmod 600 ~/.ssh/id_rsa, so only you can read it. If it still fails, the directory is the problem: chmod 700 ~/.ssh. SSH checks both, and on some configurations a group-writable home directory fails the check as well.
What is the fourth digit in chmod 4755?
The special bits: 4 is setuid, 2 is setgid, 1 is sticky, and they add together the same way the others do. They appear inside the symbolic form rather than beside it — 4755 shows as rwsr-xr-x — and a capital letter in that position means the bit is set on something with no execute bit, where it does nothing.
What does the sticky bit do?
On a directory everyone can write to, it stops one user deleting or renaming another user’s files. /tmp is mode 1777 for precisely this reason. On a regular file it does nothing on any modern system.
Why is my directory empty after chmod 644?
Because execute on a directory means permission to enter it, not permission to run it. Read alone lets you list the names and open none of them, which most tools report as an empty or broken directory. Directories want 755.
How do I set directories to 755 and files to 644 in one pass?
find . -type d -exec chmod 755 {} + then find . -type f -exec chmod 644 {} +. A plain chmod -R 755 marks every file executable, which is the single most common accident with recursive permissions.
Does this page know anything about my files?
No. The work is JavaScript running in this tab. Every function it calls is covered by a test that stubs fetch and XMLHttpRequest to throw, so a request that slipped in would break the build rather than reach a server — and you can confirm it for yourself by disconnecting and carrying on.