Skip to content
ToolBoxGenie

Chmod Calculator

Developer Tools · Added 18 August 2026

A Unix file mode is twelve bits written three different ways, and the three views here stay in step: tick the boxes, type 755, or paste rwxr-xr-x straight out of ls -l, and the other two update to match. Alongside them you get the command to run, the ls -l string, the umask that would produce the same mode on something newly created, and a plain-language note on what each class of user can actually do.

Permissions
ClassRead (4)Write (2)Execute (1)Octal
OwnerThe user who owns the file6
GroupMembers of the file's group4
OtherEveryone else on the system4
Special bits — rarely needed

Type a mode to fill the grid.

Paste a line from ls -l — the leading d or - is ignored.

This is a

Mode

Octal mode

644

-rw-r--r-- — what ls -l prints for this file.

Four-digit octal
0644

Special bits first

Symbolic
rw-r--r--
Command
chmod 644 file.txt
Matching umask
0022

New files would be created at this mode

Who can do what

Owner
read, write
Group
read
Other
read

The grid, the octal value and the symbolic string are the same twelve bits shown three ways, so editing any one of them updates the others. Nothing here touches a filesystem — it produces the command for you to run yourself.

How to use the chmod calculator

  1. 1Tick read, write and execute for the owner, the group and everyone else — or type the mode straight into the octal or symbolic box.
  2. 2Choose whether this is a file, a directory or a symlink. Execute means something different on a directory, and the results say so.
  3. 3Add a special bit only if you need one — setuid, setgid and the sticky bit are listed with what each of them does.
  4. 4Copy the chmod command from the results, or the octal value if you are writing it into a Dockerfile or an Ansible task.
  5. 5Read the notes under the results: they call out the combinations that are usually mistakes, such as a world-writable file or a setuid bit with no execute bit beneath it.

Examples

The everyday file mode

Input
rw- for the owner, r-- for group and other
Result
644, -rw-r--r--, chmod 644 file.txt, umask 0022

The owner edits it and everyone else can read it. This is what most files should be.

A script or a directory

Input
755
Result
rwxr-xr-x — the owner may write, everyone may execute or traverse

On a directory, execute is what allows entering it. Read alone only lists the names.

An SSH private key

Input
600
Result
rw------- — owner only

OpenSSH refuses to use a key any other account can read, so this one is enforced rather than advisory.

A special bit with no execute bit

Input
4655
Result
rwSr-xr-x — the capital S means setuid is set on something the owner cannot execute

It has no effect, and it almost always means a digit was mistyped.

About the chmod calculator

Three notations, one set of bits

Octal is compact, and it is what chmod, Dockerfiles and configuration management tools take. Symbolic notation is what ls -l prints and is easier to read at a glance, because each position always means the same thing. The tick-box grid is neither, and it is the one that makes the structure obvious: three classes of user, three permissions each.

All three describe the same twelve bits, which is why every view here is editable and why editing any one of them rewrites the others. There is no conversion step to get wrong, and no way for the grid and the number on screen to disagree.

Where the special bits are actually used

setgid on a shared directory is the most useful of the three. Files created inside it inherit the directory group rather than the creator group, which is what lets a team work in one folder without every new file needing its group fixed by hand afterwards.

The sticky bit solves the other shared-directory problem. A world-writable directory would normally let anyone delete anyone else's files, since deletion is a write to the directory rather than to the file. The sticky bit restricts removal to each file's owner, and that combination, 1777, is precisely what /tmp is.

setuid is the one to be careful with. A setuid binary runs with its owner's privileges rather than the caller's, so a setuid-root program that can be made to misbehave is a route to full system access. It is the mechanism behind tools such as passwd, and it is not something to add to your own scripts — on Linux the kernel ignores it on interpreted scripts in any case.

The modes worth knowing by heart

644 for files and 755 for directories and executables covers most of what a system needs. 600 and 700 are the private equivalents, required for SSH keys and for the .ssh directory itself. 664 and 775 are the shared versions, used with a setgid parent so that a group can collaborate in one place.

Permissions are also only half the picture. A mode says what the owner, the group and everyone else may do; who the owner and the group actually are is set by chown and chgrp. A file that appears to have the wrong permissions frequently has the right ones and the wrong group, and changing the mode to work around that is how a 777 gets into a system and stays there.

Frequently asked questions

Why do 4, 2 and 1 mean read, write and execute?
Because each class of user gets three bits, and a three-bit number written in octal is a single digit. Read is the high bit (4), write the middle one (2) and execute the low one (1), so any combination adds up to a distinct digit between 0 and 7: 6 is read and write, 5 is read and execute, 7 is all three. Three digits then cover owner, group and other.
What is the fourth digit for?
The special bits: 4 is setuid, 2 is setgid and 1 is the sticky bit, which is why /tmp is mode 1777. When you write a three-digit mode the fourth digit is zero, so chmod 644 and chmod 0644 mean the same thing — that leading zero is convention rather than a special bit.
Why does a capital S or T appear instead of s or t?
The special bits share a column with the execute bits in symbolic notation. A lowercase s or t means the special bit is set on something that is also executable; a capital letter means it is set without the execute bit underneath it. The kernel accepts that combination but nothing useful comes of it, so a capital letter is nearly always the sign of a mistyped mode.
What does execute mean on a directory?
Traversal. With execute and no read you can reach a known path inside the directory but cannot list what is there; with read and no execute you can list the names but cannot open any of them or enter a subdirectory. That pair produces the most confusing permission errors on a Unix system, and it is why 644 on a directory is almost never what was intended.
How does umask relate to a mode?
A umask removes permission bits from the default a program asks for when it creates something — 666 for files and 777 for directories. So a umask of 022 yields 644 files and 755 directories. Because it only ever subtracts, a umask cannot make a new file executable and cannot set a special bit, and the tool says so rather than inventing a value where none exists.
Is 777 ever the right answer?
Very rarely, and almost never on a file. It grants write access to every account on the system, which means any of them — including anything running as one of them, such as a compromised web process — can modify or replace the contents. The permission error it appears to fix is usually solved by a narrower mode, the right group, or the right ownership.

Related tools