Chmod Calculator

This tool converts between the octal form of a Unix permission, such as 755, and the symbolic form, such as rwxr-xr-x. Change either form and the other updates.

Each digit covers one group: the owner, the group, and everybody else. The digit is the sum of read (4), write (2), and execute (1). So 7 is read, write, and execute, and 5 is read and execute.

Use 644 for a normal file and 755 for a directory or a script. Never use 777, because it lets any user on the machine change the file. An SSH private key needs 600, or the client refuses to use it.

Execute permission on a file and on a directory

The execute bit has a different function on a file and on a directory. On a file, the execute bit lets the kernel run the file as a program. On a directory, the same bit gives search permission. The command chmod +x on a directory therefore adds search permission. It does not make the directory runnable.

Search permission lets a process use a name inside the directory. The kernel resolves a path one directory at a time. It must have search permission on each directory in the path. The command cat /home/user/notes.txt needs search permission on /, on /home, and on /home/user. Without it, the kernel refuses the request, even when the file itself is readable.

Read permission on a directory is a different right. It lets a process list the names in the directory. A directory with mode 444 (r--r--r--) lets a user read the list of names, but the user cannot open a file in it. A directory with mode 111 (--x--x--x) lets a user open a file by its exact name, but the user cannot read the list of names. A directory therefore needs 755 and not 644.

Special bits

SetUID (4) runs a program with the identity of the file owner. SetGID (2) runs a program with the identity of the file group, and on a directory it gives each new file the group of the directory. The sticky bit (1) on a shared directory, such as /tmp with mode 1777, lets only the owner of a file delete that file.

A special bit changes the execute character of the symbolic form. A lowercase character (s or t) shows that execute permission is also on. An uppercase character (S or T) shows that execute permission is off.