Chmod Calculator - Octal, Symbolic and Umask for Linux File Permissions

How the number is built. Each of the three classes, owner, group and others, has three permissions: read is worth 4, write is worth 2 and execute is worth 1. Add up the ones that are on and you get one digit from 0 to 7, so read and write (4 + 2) is 6, read and execute (4 + 1) is 5, and all three (4 + 2 + 1) is 7. Put the three digits side by side and you have the mode: 755 means rwx for the owner, r-x for the group and r-x for others. A fourth digit in front holds the special bits: setuid is 4, setgid is 2 and the sticky bit is 1.

The rwxr-xr-x string. ls -l prints one letter for each bit: r, w or x, or a hyphen when the bit is off. A special bit takes the place of the x. A lower-case s (owner or group) or t (others) means the special bit is on and execute is on as well; an upper-case S or T means the special bit is on but execute is off. So 4755 is rwsr-xr-x, 4644 is rwSr--r-- and 1777 is rwxrwxrwt. This is the rule in the POSIX description of ls, which defines t and T for directories; GNU ls on Linux shows them for any file with the sticky bit.

What the bits mean on a directory. On a file, execute means you may run it. On a directory, read lets you list the names inside, execute (also called search) lets you reach items inside by name, and write lets you create, rename and delete items, which only works together with execute. That is why folders usually need 755 where files need 644. The sticky bit on a directory means an item in it can be renamed or deleted only by its owner, the directory's owner or a privileged user, which is how /tmp works. Setgid on a directory makes new files inherit the directory's group.

Changing a mode with who, operator and permission. A clause is who (u owner, g group, o others, a all), then an operator (+ adds, - removes, = sets exactly), then permissions: r, w, x, X, s, t, or one of u, g, o to copy that class's permissions. Clauses are separated by commas and applied from left to right. A capital X adds execute only to directories and to files that already have execute for someone. If you leave out the who, the umask decides which bits may change: POSIX specifies this and GNU chmod follows it, so chmod +w with a umask of 022 adds write for the owner only, while chmod a+w adds it for everyone. The engine here follows the POSIX grammar and the GNU chmod rules, and was checked against GNU chmod 9.7. Other implementations, such as BSD, BusyBox or the Rust rewrite of coreutils, may differ in edge cases.

Umask. A umask lists permission bits to switch off for new files. Strictly, the kernel takes the mode a program asks for and clears the bits that are set in the umask: mode & ~umask. Most programs ask for 666 for a file and 777 for a directory, so the calculator starts from those, but a program may ask for something else, such as 600 for a private file, and the umask is applied to that instead. With 022, 666 becomes 644 and 777 becomes 755. A folder whose parent has a default ACL ignores the umask altogether (umask(2)). It is a bit operation, not a subtraction: with a umask of 001, 666 stays 666 because a file has no execute bit to remove, while taking 001 away from 666 as numbers would wrongly give 665.

Safe commands. chmod -R applies one mode to everything under a folder, which makes every ordinary file executable if you use 755. The safer pattern is two find commands: one with -type d for the folders and one with -type f for the files. The + at the end of -exec runs chmod on batches of paths instead of once per path. The audit commands only list files, so you can look before you change anything.