Chmod Calculator

Common Permissions

Worked Examples

Setting up a web server file

Your web server serves static HTML. The web server process (running as www-data) only needs to read the files, while you as the owner need to edit them:

chmod 644 index.html   # Owner: read+write, Group/Others: read

This gives you rw-r—r— — you can edit, the server can read, and no one can execute the file.

Making a script executable

You’ve written a deployment script and need to run it. Others on the team should be able to run it too but not modify it:

chmod 755 deploy.sh    # Owner: full, Group/Others: read+execute

This gives you rwxr-xr-x. Now you can run ./deploy.sh directly.

Protecting SSH keys

SSH refuses to use a private key if its permissions are too open. Lock it down to owner-only:

chmod 600 ~/.ssh/id_rsa   # Owner: read+write, no one else

Result: rw-------. OpenSSH refuses a private key that group or others have any access to; 600, 400 and 700 all pass.

Special Bits: Setuid, Setgid and Sticky

The optional first digit adds 4 for setuid, 2 for setgid and 1 for the sticky bit. In the mode string they replace the execute position: s when execute is also set, S when it is not (for others, t and T). These are real values from a Debian system with GNU coreutils 9.1, and the tool gives the same strings:

The sticky bit on /tmp lets everyone create files but only the owner delete them. Setuid on passwd makes it run as its owner (root) so users can change their own password. Setgid on a directory makes new files take the directory’s group; on Linux a new subdirectory inherits the setgid bit too, so a shared project folder stays shared. The sticky bit is written as a separate +t because BSD and macOS chmod ignore o+t; +t works on both. The symbolic commands for all eight combinations of special bits were run through GNU and macOS chmod to confirm the resulting mode.

Limits and Gotchas

• Absolute modes only. The tool outputs the full mode (u=…,g=…,o=…). It does not build relative changes such as chmod g+w or a-x, and it does not show X (execute only for directories).
• chmod 755 does not clear setgid on a directory with GNU chmod. The coreutils manual says the setuid and setgid bits of a directory are kept unless you clear them explicitly. On GNU coreutils 9.1, a 2755 directory stays 2755 after chmod 755; chmod 00755 or chmod g-s clears it. The same applies to the u=…,g=… command.
• Numeric input needs 3 or 4 digits from 0 to 7. Spaces at the ends and a 0o prefix, as in Python’s 0o644, are ignored. Any other character, such as the 8 in 7558, fewer than 3 digits or more than 4 shows “Invalid octal” and keeps the last valid result.
• The find command matches exactly. find . -type f -perm 0644 lists files whose mode is exactly 644. To find files that have at least those bits, use -perm -644; to find files with any of them, -perm /644 (GNU find).
• Permissions are only part of access. ACLs (the + after the mode in ls -l), SELinux, mount options such as noexec, and the permissions of every parent directory can still deny access.

Why New Files Get 644 and 755

Programs usually create files with mode 666 and directories with 777, and the kernel removes the bits set in the umask. With the common umask 022, a new file becomes 644 and a new directory 755; with 077, a file becomes 600. If files keep coming out with the wrong mode, check umask before running chmod on them one by one. For private keys, OpenSSH refuses a key that group or others have any access to (“Permissions 0644 … are too open”), so use 600 or 400.