Chmod Calculator

The 4-2-1 place-value math

A Unix mode is nine yes/no bits — read, write, execute for each of three classes (owner, group, other) — plus three special bits. Octal notation packs each class's three bits into one digit using place values read = 4, write = 2, execute = 1; add up what is granted. Owner with everything is 4+2+1 = 7; read+execute is 4+1 = 5; read-only is 4. So chmod 754 reads as: owner full (7), group read+execute (5), other read-only (4). Because each digit only ever uses values 0–7, the digit 8 can never appear in a valid mode — this calculator flags it as an error instead of guessing.

Worked example: 644 vs 755

Why do directories get 755 when files get 644? On a directory, execute does not mean "run" — it means permission to enter the directory and reach what is inside. Read on a directory only lets you list the filenames; without execute you cannot open any of them. A web server needs 5 (read+enter) on every directory along the path to a file it serves, which is exactly why "644 for files, 755 for directories" became the standard recipe.

The special bits, precisely

A fourth, leading digit encodes three more bits with the same 4-2-1 scheme: setuid = 4, setgid = 2, sticky = 1. Setuid on an executable makes it run with the file owner's privileges — /usr/bin/passwd is mode 4755 so an ordinary user can update the root-owned password database. Setgid does the same with the group, and on a directory it switches inheritance: files created inside get the directory's group, which is how a shared folder at 2775 keeps everything group-owned by the team. The sticky bit on a world-writable directory restricts deletion to each file's own owner; /tmp is 1777 for exactly that reason.

In ls -l output the special bits reuse the execute column, and case is the signal: lowercase s/t means the underlying execute bit is also set; uppercase S/T means it is not. rwsr-xr-x is 4755 — setuid plus owner execute. rwSr--r-- is 4644 — setuid on a file nobody can execute, which cannot actually run and is almost always a mistake; the capital letter is the visual warning.

Why 777 is a smell

chmod 777 grants read, write and execute to every account on the machine. Any other user — or any compromised process, like a web application — can then overwrite the file or plant new files in the directory. It typically gets reached for when the real problem is ownership (the web server writes as www-data but the files belong to you); the durable fix is chown to the right user or group and then 755/775 on directories, 644/664 on files. Legitimately world-writable places do exist, but they pair the mode with the sticky bit — 1777, like /tmp — so users cannot delete each other's files.

Honest limits

This calculator covers the classic 12-bit permission model, which is what chmod's numeric mode sets. It does not model POSIX ACLs (getfacl/setfacl), file attributes (chattr), SELinux/AppArmor contexts, or the owner/group themselves (chown) — on systems using those, the effective access can be narrower or wider than the mode alone suggests. The first character of ls -l output (-, d, l…) is the file type, not a permission, so it is not part of the 9-character symbolic string this tool reads. And the generated command is only text on this page: nothing executes until you run it in your own terminal.