chmod Calculator
Convert between octal chmod values, symbolic notation and the permission bits Linux actually stores, including setuid, setgid and the sticky bit.
Runs entirely in your browser. Your input is never sent to our servers.
chmod 644
- Octal
- 644
- Symbolic
- rw-r--r--
- ls -l style
- -rw-r--r--
- Command
- chmod 644 filename
- Recursive
- chmod -R 644 directory/
What is chmod?
Linux file permissions are three sets of read, write and execute bits — for the file owner, the owning group, and everyone else — conventionally written as a three-digit octal number where read is 4, write is 2 and execute is 1.
What this chmod Calculator does
Toggle permissions and read the octal value, the symbolic string, and the exactchmod command. It works in both directions: pick a common mode such as 644 and the checkboxes update to match.
It also covers the three special bits that a plain three-digit mode omits — setuid, setgid and the sticky bit — and shows how each alters the symbolic notationls -l displays.
How to use it
- Tick the permissions each class should have, or click a common preset.
- Read the octal value and copy the command.
- Add
-Rto apply recursively — carefully, since it affects every file beneath the directory.
Understanding your results
Octal — each digit is the sum of read (4), write (2) and execute (1). 6 is read plus write; 7 is all three.
Symbolic — nine characters, three per class. rw-r--r-- is 644.
Execute on a directory means something different from a file: it grants the right to traverse into it. A directory with read but not execute lets you list names but not access what is inside.
s and t — a lowercase s or t means the special bit is set and execute is also set; uppercase S or T means the special bit is set without execute, which is usually a mistake.
Why this matters
Permissions are the primary access control on a Unix filesystem. Over-permissive modes are one of the most common findings in server reviews, and they are usually the result of someone reaching for 777 to make an error go away.
The consequences are concrete. A world-writable script executed by a privileged process is a direct privilege-escalation path. A world-readable private key is compromised the moment any account on the host is. OpenSSH refuses to use a private key with permissions looser than 600 precisely because that check catches real mistakes.
Worked examples
644 — the default for regular files. Owner reads and writes; everyone else reads.
755 — directories and executables. Owner has full control; others may read and traverse or run.
600 — private files such as ~/.ssh/id_ed25519. Only the owner has any access.
1777 — /tmp. Everyone may write, but the sticky bit means only a file’s owner can delete it, which stops users removing each other’s files.
2775 — a shared project directory. setgid makes new files inherit the directory’s group, so collaborators keep access without adjusting each file.
Common mistakes
Using 777 to fix a permissions error. It usually works because it grants everything, which is exactly the problem. The real fix is almost always correcting ownership with chown.
Recursive chmod across mixed content. chmod -R 755 makes every file executable; chmod -R 644 makes directories unusable by removing traverse. Use find with -type f and -type d separately.
Confusing permissions with ownership. Modes describe what each class may do; chown decides who is in each class. If the wrong user owns the file, no mode will make it correct.
Forgetting the umask. New files are created with permissions masked by the process umask, so a file may not appear with the mode you expect.
Technical background
The kernel stores permissions as 12 bits in the inode: nine for the owner/group/other triads and three for setuid, setgid and sticky. Octal notation maps onto this cleanly because each octal digit is exactly three bits. When a process opens a file the kernel checks the owner bits if the UID matches, otherwise the group bits if a GID matches, otherwise the other bits — the first matching class applies, and it does not fall through.
Limitations
This covers classic Unix permission bits. It does not model POSIX ACLs (setfacl), SELinux or AppArmor policy, or filesystem attributes (chattr), any of which can permit or deny access independently of the mode.
Frequently asked questions
What does chmod 755 mean?
The owner may read, write and execute (7); the group and everyone else may read and execute (5). It is the usual mode for directories and executable programs.
Why is 777 dangerous?
It lets any account on the system modify the file. If a privileged process executes it, any local user can alter what that process runs, which is a direct privilege-escalation route.
What is the difference between 644 and 755?
The execute bit. 644 suits data files. 755 suits directories, where execute means the right to traverse into them, and executables, where it means the right to run them.
What does the sticky bit do?
On a directory it restricts deletion to each file’s owner, even when the directory is world-writable. /tmp uses it so users cannot delete one another’s files.
Why does ls show S instead of s?
The setuid or setgid bit is set but the corresponding execute bit is not. The special bit has no effect in that state, and it almost always indicates a mistake.
References
Last reviewed