chmod Calculator

How to Use

1. Toggle the Read, Write, and Execute checkboxes for Owner, Group, and Other to build your permission set visually.
2. Or type a three-digit octal number (e.g., 755) directly into the numeric input field.
3. View the symbolic notation, chmod command, and ls -la preview below the grid.
4. Click a common preset button to quickly apply standard permission sets like 644 or 755.
5. Copy the numeric value or full chmod command with the Copy button.

Understanding Unix File Permissions

Unix and Linux file permissions control who can access files and directories on a system. Every file has three categories of users: the owner (the user who created the file), the group (a set of users who share access), and other (everyone else on the system). For each category, three types of access can be granted or denied: read (view the file contents), write (modify the file), and execute (run the file as a program or enter a directory).

These nine permission bits (3 categories times 3 permissions) are represented as a 9-character string in the output of ls -la. For example, rwxr-xr-x means the owner can read, write, and execute; the group can read and execute; and others can read and execute. A hyphen (-) indicates that permission is not granted.

How the chmod Command Works

The chmod command (short for "change mode") modifies file permissions on Unix-like operating systems including Linux and macOS. It accepts permissions in two formats: numeric (octal) and symbolic.

In numeric mode, permissions are expressed as a three-digit octal number. Each digit ranges from 0 to 7 and represents the sum of permission values: read (4), write (2), and execute (1). For example, chmod 755 script.sh sets owner to read+write+execute (4+2+1=7), group to read+execute (4+1=5), and other to read+execute (4+1=5).

In symbolic mode, you specify who to change (u for user/owner, g for group, o for other, a for all), the operation (+ to add, - to remove, = to set exactly), and which permissions (r, w, x). For example, chmod u+x script.sh adds execute permission for the owner only.

Common Permission Patterns

• 644 (rw-r--r--) — The default for regular files. The owner can read and write; everyone else can only read. This is what most web servers expect for HTML, CSS, and image files.
• 755 (rwxr-xr-x) — The default for directories and executable scripts. The owner has full access; everyone else can read and execute (for directories, execute means the ability to enter the directory).
• 600 (rw-------) — Private files that only the owner can read and write. Used for sensitive configuration files, SSH private keys (~/.ssh/id_rsa), and password files.
• 700 (rwx------) — Private directories only the owner can access. The ~/.ssh directory should use this permission.
• 444 (r--r--r--) — Read-only for everyone. Useful for files that should never be modified, like certain system configuration files.
• 400 (r--------) — Read-only for the owner only. SSH requires this for private key files: if permissions are too open, SSH will refuse to use the key.
• 777 (rwxrwxrwx) — Full access for everyone. Avoid this in production environments as it is a serious security risk.

Directory vs. File Permissions

Permission bits behave differently for files and directories. For files, read allows viewing contents, write allows modifying contents, and execute allows running the file as a program. For directories, read allows listing the directory contents (ls), write allows creating or deleting files inside the directory, and execute allows entering the directory (cd) and accessing files within it.

A directory with read but no execute permission (r--) lets you see file names but not access file metadata or contents. A directory with execute but no read (--x) lets you access files if you know their names, but you cannot list the directory. Most directories should have both read and execute permissions for the appropriate users.

Security Considerations

Setting file permissions correctly is fundamental to system security. Overly permissive settings (like 777) can allow any user to modify or delete critical files. Web servers are particularly sensitive to permissions: configuration files containing database passwords should be 600 or 640, not world-readable. The principle of least privilege applies — grant only the minimum permissions necessary for the file to serve its purpose.

Common security mistakes include making SSH keys group- or world-readable (SSH will refuse to use them), setting 777 on web directories (allowing attackers to upload malicious files), and making executable scripts world-writable (allowing privilege escalation). Use chmod -R with caution, as it recursively changes permissions for all files and subdirectories, which can accidentally expose sensitive files.

The Octal Number System

Unix permissions use octal (base-8) because three binary bits map perfectly to a single octal digit. Each permission type is a single bit: read=100 (binary), write=010, execute=001. Combined, they form values from 000 (no permissions, octal 0) to 111 (all permissions, octal 7). Three octal digits cover all nine permission bits for owner, group, and other — making the notation compact and easy to read once you understand the system.

Related Tools

Generate secure passwords with the Password Generator. Create file checksums with the Hash Generator. Convert permission octals with the Number Base Converter. Calculate network subnets with the Subnet Calculator. Generate unique identifiers with the UUID Generator. Decode JSON Web Tokens with the JWT Decoder. Encode sensitive strings with the Base64 Encoder.