chmod Calculator

Every file and directory on a Unix-like system — Linux, macOS, FreeBSD, the BSD-based router and NAS firmware that runs much of the internet — carries a small piece of metadata describing who is allowed to read it, modify it and (for executables) run it. That metadata is the permission mode, and the chmod command (CHange MODe) is how administrators and developers set it. The calculator above is a visual front-end for the same arithmetic that chmod performs.

Three classes, three bits

Unix permissions split the world into three classes: the file's owner (a specific user), the file's group (a specific group of users), and everyone else. For each class, the permission mode records three bits: read (4), write (2) and execute (1). Adding the bits per class gives a digit from 0 (no permissions) to 7 (read + write + execute). The mode is conventionally written as three octal digits — one per class — so 755 means owner has 7 (rwx), group has 5 (r-x) and public has 5 (r-x).

The symbolic form (rwxr-xr-x) writes the same information differently. A dash replaces a missing permission; the order is always read, write, execute for each class. The leading character indicates file type — usually - for a regular file, d for a directory, l for a symbolic link. So the symbolic form -rwxr-xr-x describes a regular file with mode 755.

The fourth digit and the special bits

Fewer developers know that chmod accepts a fourth, leading octal digit for the special bits. Setuid (4) makes an executable run with the owner's user-ID instead of the caller's — this is how sudo and passwd can do privileged work. Setgid (2) does the same for group; on directories it causes newly-created files to inherit the directory's group rather than the creator's primary group. The sticky bit (1) on a directory restricts deletion to the file's owner — Linux's /tmp uses mode 1777 so every user can write but no user can delete another user's files. Special bits combine with the regular bits using the same additive scheme.

The modes worth knowing, and where the rules come from

The presets above are the conventions, not laws: regular files usually want 644 (owner read+write, everyone else read-only) and directories 755 (owner read+write+search, everyone else read+search) because a umask of 022 produces exactly those from a fresh file. One case is enforced by software rather than convention: an SSH private key. ssh(1) says the identity files "contain sensitive data and should be readable by the user but not accessible by others (read/write/execute). ssh will simply ignore a private key file if it is accessible by others" — so 600 and 400 work and 640 fails as surely as 644. World-writable files (666, 777) mean any account on the host can replace the content; outside a sticky /tmp-style directory there is rarely a reason to want that.

Two things this calculator shows that are easy to misread. The symbolic string always begins with -, the regular-file marker — ls -l prints d for a directory and l for a symbolic link in that slot. And the special bits borrow the execute columns: POSIX ls(1) prints s where setuid or setgid is set on an executable and S where the bit is set but the execute bit is not; t and T do the same for the restricted-deletion (sticky) flag in the "other" column. The upper-case forms are almost always a mistake, and the grid makes the mismatch visible.

What chmod doesn't do

Permission modes are a coarse-grained access control — three classes, three bits. They do not handle "give Alice read access but not Bob" without elaborate group-juggling. For fine-grained control, modern Linux supports access control lists (ACLs) via setfacl and getfacl, which the basic chmod calculator cannot model. The mode also does not encrypt anything — it controls who can ask the kernel for a file, not what they can do once they have a copy. And it does not survive transit cleanly: copying a file via SCP, SFTP, or a Docker bind-mount frequently resets the mode to whatever the destination filesystem defaults to. When in doubt, run ls -la on the destination side and confirm.