Chmod Calculator
chmod 755 means rwxr-xr-x: the owner can read, write and execute, while the group and everyone else can read and execute. chmod 644 is rw-r--r-- and chmod 600 is rw-------. With the sticky bit, 1777 is rwxrwxrwt.
How to use
- Tick Read, Write and Execute for Owner, Group and Public. The octal number, the rwx text and the full chmod command update at once.
- Or type an octal number such as 755 or 4755, or a symbolic string such as rwxr-xr-x. You can paste the first 10 characters of ls -l output, such as -rwxr-xr-x.
- Tick setuid, setgid or sticky for the special bits. They add a fourth leading digit: 4, 2 and 1.
- Press a preset such as 644 or 1777 for a common value, then Copy to take the chmod command.
How it works
Each class gets one octal digit made by adding its permissions: read is 4, write is 2, execute is 1. So rwx is 4 + 2 + 1 = 7, r-x is 4 + 1 = 5 and r-- is 4. Three digits give owner, group and public: 755 is rwx, r-x, r-x.
A fourth leading digit holds the special bits: setuid is 4, setgid is 2 and sticky is 1. 1777 is the sticky bit plus rwxrwxrwx. With no special bits the digit is left out.
In the symbolic form, setuid replaces the owner's x with s (or S when x is off), setgid does the same in the group part, and sticky replaces the public x with t (or T when x is off). 4755 is rwsr-xr-x and 1776 is rwxrwxrwT.
The tool shows what the numbers do not make obvious, such as 4644 giving rwSr--r--: the capital S means setuid is set but the owner cannot execute the file, which usually points to a mistake.
Common permission values
| Octal | Symbolic | Typical use |
|---|---|---|
| 644 | rw-r--r-- | Regular file: owner edits, everyone reads |
| 755 | rwxr-xr-x | Program, script or directory everyone can enter |
| 600 | rw------- | Private file such as an SSH private key |
| 700 | rwx------ | Private directory or script only the owner runs |
| 664 | rw-rw-r-- | Shared file the owner group can also edit |
| 777 | rwxrwxrwx | Anyone can read, write and run. Avoid it |
| 1777 | rwxrwxrwt | Shared directory like /tmp, with the sticky bit |
| 4755 | rwsr-xr-x | Program that runs as its owner, such as passwd |
What each permission means
| Bit | On a file | On a directory |
|---|---|---|
| r (4) | Read the contents | List the names inside |
| w (2) | Change the contents | Create, rename and delete entries |
| x (1) | Run it as a program | Enter it and open files by name |
| setuid (4000) | Runs with the file owner's rights | Ignored on most systems |
| setgid (2000) | Runs with the file group's rights | New files inherit the directory's group |
| sticky (1000) | Ignored on modern systems | Only a file's owner can delete or rename it |
Standards
The mode bits and the chmod command are defined by POSIX.
| Document | Defines | Where |
|---|---|---|
| POSIX chmod | Syntax of the chmod utility | https://pubs.opengroup.org/onlinepubs/9799919799/utilities/chmod.html |
| POSIX sys/stat.h | File mode bits S_ISUID, S_ISGID, S_ISVTX | https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/sys_stat.h.html |
FAQ
What does chmod 755 mean?
The owner can read, write and execute. The group and everyone else can read and execute, but not change the file. It is the usual mode for programs and for directories that others must enter.
What is the difference between 644 and 755?
The execute bits. 644 is for ordinary files that are read but not run. 755 adds execute for everyone, which scripts, programs and directories need. A directory without x cannot be entered.
Should I ever use chmod 777?
Almost never. It lets any user on the system change or replace the file. If a program says it needs 777, the real fix is usually the right owner or group plus 775 or 755.
What do setuid, setgid and sticky do?
Setuid makes a program run with its owner's rights, setgid does the same with its group (and on a directory makes new files inherit the group), and sticky on a directory lets only a file's owner delete or rename it. That is why /tmp is 1777.
What does a capital S or T mean?
A capital letter means the special bit is on but the matching execute bit is off. For example rwSr--r-- has setuid set on a file the owner cannot execute, so the bit does nothing useful. Lowercase s or t means execute is on as well.
Does chmod 600 hide a file from root?
No. Root can read and write any file regardless of its mode. 600 only keeps other normal users out, which is why SSH insists on it for private keys.