Chmod Calculator

How Linux permission numbers work

Every file on a Unix-like system carries three permission triads — for the owning user, the owning group, and everyone else — and each triad is three bits: read (4), write (2), execute (1). Add the bits per triad and you get one octal digit, so rwxr-xr-x becomes 7 5 5 → chmod 755. For directories the bits mean slightly different things: read lists the entries, write creates and deletes them, and execute allows entering the directory at all — which is why directories almost always need the execute bit that plain data files should not have.

The fourth digit: setuid, setgid and sticky

An optional leading digit encodes three special bits. Setuid (4) makes an executable run with the file owner's privileges — how passwd edits a root-owned file. Setgid (2) does the same for the group, and on directories makes new files inherit the directory's group — handy for shared project folders. The sticky bit (1) on a world-writable directory restricts deletion to each file's owner, which is why /tmp is mode 1777. In the symbolic form these show up as s or t replacing the execute position — capitalized (S/T) when the underlying execute bit is off, which is usually a misconfiguration worth noticing.

FAQ

What's the difference between chmod 755 and 644?

755 (rwxr-xr-x) is for executables and directories: everyone can read and execute/enter, only the owner can modify. 644 (rw-r--r--) is for regular files: owner edits, everyone reads, nobody executes. Web servers conventionally want 755 on directories and 644 on files.

Why does SSH complain about my key permissions?

OpenSSH refuses private keys that other users could read. Fix it with chmod 600 ~/.ssh/id_ed25519 (owner read/write only) and chmod 700 ~/.ssh on the directory. The same rule applies to .env files and anything holding credentials.

Is chmod 777 ever the right answer?

Almost never. 777 lets any user on the machine modify or replace the file — a security hole and a common "quick fix" that hides a real ownership problem. If a service can't access a file, the correct fix is usually chown to the right user or adding the service to the owning group, then a sane mode like 755 or 664.