# Chmod Calculator - Octal, Symbolic and Umask for Linux File Permissions

Page: https://hirantha.me/tools/chmod-calculator
Part of: Hirantha Sandaruwan Lakshan free tools (https://hirantha.me/tools)
Updated: 2026-10-15

Tick read, write and execute boxes to get the chmod number and rwxr-xr-x string, read u+x style changes, work out a umask, and copy safe chmod and find commands.

This is a free tool that runs in the browser: open the page to use it. File tools process files on the visitor's own device; files are never uploaded or stored. No account, sign-up, payment or watermark.

Tick the boxes for owner, group and others to see the chmod number and the rwxr-xr-x string that go with them, or type either one and watch the boxes follow. The tool also handles the setuid, setgid and sticky bits, reads change strings such as u+x,g-w,o=r, works out what a umask gives new files, and writes chmod and find commands you can copy. It only does the arithmetic: no file is touched and nothing is uploaded.

How the number is built. Each of the three classes, owner, group and others, has three permissions: read is worth 4, write is worth 2 and execute is worth 1. Add up the ones that are on and you get one digit from 0 to 7, so read and write (4 + 2) is 6, read and execute (4 + 1) is 5, and all three (4 + 2 + 1) is 7. Put the three digits side by side and you have the mode: 755 means rwx for the owner, r-x for the group and r-x for others. A fourth digit in front holds the special bits: setuid is 4, setgid is 2 and the sticky bit is 1.

The rwxr-xr-x string. ls -l prints one letter for each bit: r, w or x, or a hyphen when the bit is off. A special bit takes the place of the x. A lower-case s (owner or group) or t (others) means the special bit is on and execute is on as well; an upper-case S or T means the special bit is on but execute is off. So 4755 is rwsr-xr-x, 4644 is rwSr--r-- and 1777 is rwxrwxrwt. This is the rule in the POSIX description of ls, which defines t and T for directories; GNU ls on Linux shows them for any file with the sticky bit.

What the bits mean on a directory. On a file, execute means you may run it. On a directory, read lets you list the names inside, execute (also called search) lets you reach items inside by name, and write lets you create, rename and delete items, which only works together with execute. That is why folders usually need 755 where files need 644. The sticky bit on a directory means an item in it can be renamed or deleted only by its owner, the directory's owner or a privileged user, which is how /tmp works. Setgid on a directory makes new files inherit the directory's group.

Changing a mode with who, operator and permission. A clause is who (u owner, g group, o others, a all), then an operator (+ adds, - removes, = sets exactly), then permissions: r, w, x, X, s, t, or one of u, g, o to copy that class's permissions. Clauses are separated by commas and applied from left to right. A capital X adds execute only to directories and to files that already have execute for someone. If you leave out the who, the umask decides which bits may change: POSIX specifies this and GNU chmod follows it, so chmod +w with a umask of 022 adds write for the owner only, while chmod a+w adds it for everyone. The engine here follows the POSIX grammar and the GNU chmod rules, and was checked against GNU chmod 9.7. Other implementations, such as BSD, BusyBox or the Rust rewrite of coreutils, may differ in edge cases.

Umask. A umask lists permission bits to switch off for new files. Strictly, the kernel takes the mode a program asks for and clears the bits that are set in the umask: mode & ~umask. Most programs ask for 666 for a file and 777 for a directory, so the calculator starts from those, but a program may ask for something else, such as 600 for a private file, and the umask is applied to that instead. With 022, 666 becomes 644 and 777 becomes 755. A folder whose parent has a default ACL ignores the umask altogether (umask(2)). It is a bit operation, not a subtraction: with a umask of 001, 666 stays 666 because a file has no execute bit to remove, while taking 001 away from 666 as numbers would wrongly give 665.

Safe commands. chmod -R applies one mode to everything under a folder, which makes every ordinary file executable if you use 755. The safer pattern is two find commands: one with -type d for the folders and one with -type f for the files. The + at the end of -exec runs chmod on batches of paths instead of once per path. The audit commands only list files, so you can look before you change anything.

Common chmod values:
| Octal | Symbolic | What it allows | Typical use or warning |
| --- | --- | --- | --- |
| 400 | r-------- | Owner can read. Nobody can write, and nobody else can do anything. | Read-only secrets and keys you do not want to change by accident. |
| 600 | rw------- | Owner can read and write. Nobody else has any access. | Private files: SSH private keys, config files with passwords. |
| 640 | rw-r----- | Owner can read and write, group can read, others have nothing. | Files a service group must read but the public must not, such as an app's config. |
| 644 | rw-r--r-- | Owner can read and write; everyone else can only read. | The usual mode for ordinary files: web pages, text, images. |
| 664 | rw-rw-r-- | Owner and group can read and write; others can only read. | Shared files in a team folder where the group edits. |
| 700 | rwx------ | Owner can do everything. Nobody else has any access. | Private folders such as ~/.ssh, and scripts only you run. |
| 750 | rwxr-x--- | Owner can do everything; group can read and run; others have nothing. | Programs and folders shared with one group only. |
| 755 | rwxr-xr-x | Owner can do everything; everyone else can read and run, but not change. | The usual mode for programs, scripts and folders. |
| 775 | rwxrwxr-x | Owner and group can do everything; others can read and run. | Shared folders where the group writes. |
| 777 | rwxrwxrwx | Everyone can read, change and run it. | Almost never right. Any user or program on the machine can alter it. Prefer 755 or 775 with the correct owner and group. |
| 1777 | rwxrwxrwt | Everyone can add files, but only an item's owner can delete or rename it (sticky bit). | Shared scratch folders such as /tmp. |
| 2775 | rwxrwsr-x | Like 775, and new files inside inherit the folder's group (setgid). | Shared project folders for a team. |
| 4755 | rwsr-xr-x | Like 755, and the program runs with the file owner's privileges (setuid). | A few system programs, such as passwd. Risky; avoid creating your own. |

Q: What does chmod 755 mean?
A: 755 gives the owner read, write and execute (7), and group and others read and execute (5). Written out it is rwxr-xr-x. It is the usual mode for programs, scripts and folders that everyone may use but only the owner may change.

Q: What does chmod 644 mean?
A: 644 is rw-r--r--: the owner can read and write, and group and others can only read. It is the usual mode for ordinary files such as web pages, images and documents.

Q: Is chmod 777 safe?
A: No. 777 lets every user and every program on the machine read, change and run the file or folder, so one compromised account or script can overwrite it. If a program fails with permission denied, 777 usually hides the real cause, which is the wrong owner or group. Fix those, or use 755 or 775.

Q: How do I make a file executable?
A: chmod u+x file adds execute for the owner only. chmod +x file adds it for every class your umask allows, which is everyone with a umask of 022. chmod 755 file sets rwxr-xr-x outright. The file also needs a valid shebang line or a program it can run.

Q: What do the s, S, t and T in ls -l mean?
A: They are the special bits drawn in the execute place. s in the owner or group part means setuid or setgid is on and execute is on. S means the special bit is on but execute is off. t in the others part means the sticky bit is on and others have execute; T means sticky is on and others have no execute.

Q: What is the difference between chmod -R 755 and the find commands?
A: chmod -R 755 gives every file and folder under the path the same mode, so ordinary files become executable. The two find commands give folders 755 and files 644 separately. The capital X form (chmod -R u=rwX,g=rX,o=rX) gets close in one command: X adds execute only to folders and to files that already have execute for someone, so plain files stay non-executable. A file that was already executable for anyone ends up executable for everyone the mode names, which the two find commands would not do.

Q: What is a umask and why is 022 common?
A: A umask is a set of permission bits that are switched off for new files and folders. 022 removes write for group and others, so files are created as 644 and folders as 755: you can write, everyone else can only read. 002 is common where each user has a private group, because the group may then write too.

Q: Why does chmod 755 not clear setgid on a folder?
A: GNU chmod deliberately keeps the setuid and setgid bits of a directory when you give a numeric mode of four digits or fewer, so shared folders keep working. To clear them use g-s, an operator mode such as =755, or five digits (00755). Other systems may behave differently, so scripts that must be portable should not rely on it.

Q: Who can change a file's permissions?
A: Only the file's owner or a privileged user such as root. POSIX says the chmod utility needs an effective user ID that matches the file's owner, or appropriate privileges. Having write permission on the file is not enough.

Sources: POSIX.1-2024 chmod: grammar, who, operators and permissions (checked 15 October 2026) (https://pubs.opengroup.org/onlinepubs/9799919799/utilities/chmod.html); POSIX.1-2024 ls: the s, S, t and T characters (checked 15 October 2026) (https://pubs.opengroup.org/onlinepubs/9799919799/utilities/ls.html); GNU Coreutils manual: Symbolic Modes (checked 15 October 2026) (https://www.gnu.org/software/coreutils/manual/html_node/Symbolic-Modes.html); GNU Coreutils manual: Directories and the set-user-ID and set-group-ID bits (checked 15 October 2026) (https://www.gnu.org/software/coreutils/manual/html_node/Directory-Setuid-and-Setgid.html); Linux man page umask(2): 0666 & ~022 = 0644 (checked 15 October 2026) (https://man7.org/linux/man-pages/man2/umask.2.html); Linux man page inode(7): set-group-ID and sticky bit (checked 15 October 2026) (https://man7.org/linux/man-pages/man7/inode.7.html); Linux man page find(1): -perm, -type and -exec ... {} + (checked 15 October 2026) (https://man7.org/linux/man-pages/man1/find.1.html); OpenBSD ssh(1) manual: permissions for ~/.ssh and private keys (checked 15 October 2026) (https://man.openbsd.org/ssh)

Related tools:

- [Number base converter](https://hirantha.me/tools/number-base-converter.md): Convert whole numbers between binary, octal, decimal, hex and any base from 2 to 36 with exact BigInt maths, negatives, two's complement and step-by-step working.
- [HTTP status codes reference](https://hirantha.me/tools/http-status-codes.md): Every HTTP status code in the IANA registry in plain English: what it means, when you see it, the usual fix and caching. Search by number, name or word.
- [Hash generator](https://hirantha.me/tools/hash-generator.md): Generate a SHA-1, SHA-256, SHA-384, or SHA-512 hash of text.
- [Cron expression explainer](https://hirantha.me/tools/cron-expression-explainer.md): Paste a five-field cron expression to read it in plain English, see a field-by-field breakdown and list the next 10 run times in any time zone.