chmod calculator
Octal permissions to rwx and back, with the symbolic command to run.
| Class | Read | Write | Execute | Octal |
|---|---|---|---|---|
| Owner (u) | 6 | |||
| Group (g) | 4 | |||
| Others (o) | 4 |
Special bits
Common permissions
| Octal | Symbolic | Use | Notes |
|---|---|---|---|
| rw-r--r-- | Regular files | Owner can edit, everyone can read | |
| rwxr-xr-x | Directories and scripts | Owner can write, everyone can read and traverse | |
| rw------- | Private files | SSH keys, credentials — owner only | |
| rwx------ | Private directories | Such as ~/.ssh | |
| rw-rw-r-- | Group-writable files | Shared project files | |
| rwxrwxr-x | Group-writable directories | Shared project folders | |
| rwxrwxrwx | Everything to everyone | Almost always wrong |
How it works
Unix permissions are three groups of three bits: what the owner, the group and everyone else may do. Each group is one octal digit because three bits fit exactly into 0–7.
read = 4
write = 2
execute = 1
644 = rw- r-- r--
755 = rwx r-x r-x Execute means something different on directories
On a file, the execute bit permits running it. On a directory it permits entering it — accessing anything inside by name. A directory with read but not execute lets you list the names and nothing else, which is why directories are 755 rather than 644.
The special bits
- setuid (4000)
- The program runs with the owner's privileges rather than the caller's. This is how
passwdcan edit a root-owned file. It is also a classic privilege-escalation vector. - setgid (2000)
- On a program, runs with the file's group. On a directory, new files inherit the directory's group — useful for shared project folders.
- sticky (1000)
- In a world-writable directory, only the owner of a file can delete it. This is what makes
/tmp(1777) safe.
777 is almost always wrong
It usually appears as a debugging shortcut that was never reverted. If a web server cannot read a file, the fix is to correct the ownership, not to grant the whole machine write access. On a shared host, 777 lets any other user modify your code.
umask
New files do not get the permissions you might expect, because the umask masks bits out. The common default of 022 turns a requested 666 into 644 and 777 into 755 — which is why new files are not executable and not group-writable.