Chmod Calculator
Convert Linux permissions between checkboxes, octal and rwx. Runs in your browser.
About this chmod calculator
This chmod calculator converts Linux and macOS file permissions between checkboxes, octal numbers like 755 and symbolic strings like rwxr-xr-x, and gives you the chmod command to copy. It is for anyone setting up a web server, fixing a "Permission denied" error, or reading an ls -l listing.
It handles the parts many calculators skip: setuid, setgid and the sticky bit, full ls -l strings such as drwxr-sr-x, and chmod's own u+x and go-w syntax. Switch between File and Directory and the explanation changes, because read, write and execute mean different things for folders.
Everything is calculated in your browser.
Features
Checkboxes, octal and symbolic in sync
Tick a box and the octal and rwx forms update. Type 640, 0755, rw-r----- or a ten-character ls -l string and the boxes follow.
Special bits
Setuid (4), setgid (2) and sticky (1) make the fourth octal digit, shown as s, S, t or T in the symbolic form exactly as ls prints them.
Apply chmod expressions
Type u+x, go-w, a=r, g=u or +t and apply it to the current mode, the same way chmod would. X (execute only for folders or already-executable files) is supported.
Ready commands
Copy chmod 755 deploy.sh or the u=rwx,g=rx,o=rx form. File names with spaces are quoted for the shell, and folders get an optional -R.
Plain-English meaning and warnings
Each class gets a sentence about what it can do. Risky modes such as world-writable files or setuid with write access get a red warning.
umask helper
Enter a umask such as 022 or 077 to see the default mode new files and folders will get.
How to use the chmod calculator
- 1Tick read, write and execute for owner, group and others, or type a mode like 644 or rwxr-xr-x.
- 2Add setuid, setgid or sticky if needed and read the plain-English meaning.
- 3Set the file name and copy the ready chmod command.
When to use it
Making a script executable
A new deploy.sh fails with "Permission denied". Tick Execute for the owner, or apply u+x, and copy chmod 744 deploy.sh. Use 755 if other users need to run it too.
Locking down SSH keys
OpenSSH refuses a private key that others can read. Set the key to 600 and the ~/.ssh folder to 700.
Web server files
A common setup is 644 for files and 755 for folders, so the server can read everything but only the owner can change it. Upload folders may need group write.
A shared team folder
Use 2775 on the folder. The setgid bit makes new files inherit the folder's group, so everyone on the team can keep editing them.
How do chmod numbers work?
Each permission has a value: read is 4, write is 2 and execute is 1. Add them up for each class of user. Read plus execute is 4 + 1 = 5, and all three is 7. The three digits are, in order, the owner, the group and everyone else.
So 755 means owner 7 (rwx), group 5 (r-x) and others 5 (r-x). 640 means owner 6 (rw-), group 4 (r--) and others 0 (nothing). An optional digit in front holds the special bits: 4 for setuid, 2 for setgid and 1 for sticky, so 2775 is 775 with setgid.
- 7 = rwx: read, write, execute
- 6 = rw-: read and write
- 5 = r-x: read and execute
- 4 = r--: read only
- 0 = ---: no access
What do read, write and execute mean on a directory?
On a file, the meaning is obvious. On a directory it is not. Read lets you list the names inside. Execute lets you enter the directory and reach files whose names you know. Write lets you create, rename and delete entries, but only together with execute.
That is why folders almost always have x wherever they have r: 755 or 700, never 644. A folder set to 644 shows its file names to the owner, who still cannot open any of them. It also explains a classic surprise: you can delete a file you cannot write to if you can write to its folder.
What are setuid, setgid and the sticky bit?
Setuid on a program makes it run with the owner's privileges instead of the caller's. /usr/bin/passwd is setuid root so ordinary users can change their own password, and ls shows it as rwsr-xr-x (4755). Setuid is a common attack target, so never set it on scripts or on anything writable by others.
Setgid on a program runs it with the file's group. On a directory, which is where you will use it most, it makes new files inherit the directory's group. The sticky bit on a directory stops users from deleting each other's files, which is how /tmp (1777) works. A capital S or T in ls output means the special bit is set but the matching execute bit is not.
Octal or symbolic chmod: which should I use?
Octal sets the whole mode at once: chmod 644 file always ends at rw-r--r--, whatever it was before. Symbolic changes only what you name: chmod g+w file adds group write and leaves the rest alone. Use octal when you know the end state, and symbolic when you want to change one thing across many files with different modes.
Be careful with -R. chmod -R 755 folder makes every file executable as well. Many admins use find instead: find folder -type d -exec chmod 755 {} + for folders, then the same with -type f and 644 for files.
Why use Mavros
| Mavros | Typical upload sites | |
|---|---|---|
| Input formats | Checkboxes, octal, rwx and full ls -l strings | Checkboxes and octal |
| Special bits | Setuid, setgid and sticky with s/S/t/T | Often missing |
| chmod expressions | u+x, go-w, a=r, g=u, X | Not supported |
| Directory meaning | Separate explanation for folders | Same text for files and folders |
| Safety warnings | World-writable, setuid risks, unusable modes | None |
| umask | Default file and folder modes from any umask | Rare |
Tips
- Avoid 777. If a web app only works with 777, the real fix is usually the file's owner or group (chown), not more permissions.
- AWS and many SSH clients reject .pem key files that are not 400 or 600.
- When a script still says "Permission denied" after chmod +x, check the first line (the #! interpreter path) and whether the disk is mounted with noexec.
- Writing the deploy script itself? The cron expression parser helps schedule it, and the hash generator checks that the copy on the server matches yours.
- Permissions are only one layer. Paths with odd characters still need quoting; the string escape tool covers shell quoting rules.
Questions
What does chmod 644 mean?
The owner can read and write, and the group and everyone else can only read. It is the standard mode for regular files such as HTML pages, images and most config files.
What does chmod 777 do?
It gives every user on the system read, write and execute access. Anyone can change or replace the file, so avoid it on servers. Fix the owner or group instead.
What does chmod +x do?
It adds execute permission so the file can be run as a program. Without a u, g or o in front, chmod applies it to everyone except where your umask blocks it, so on most systems +x turns 644 into 755.
How do I read rwxr-xr-x?
Split it into three groups of three: rwx for the owner, r-x for the group, r-x for others. A letter means the permission is granted and a dash means it is not. rwxr-xr-x is 755.
What does the first letter in ls -l output mean?
It is the file type, not a permission: - for a regular file, d for a directory, l for a symbolic link, plus c, b, p and s for devices, pipes and sockets. Paste the whole string here and the calculator explains it.
What is the difference between s and S in permissions?
Lowercase s means setuid or setgid is set and execute is also set. Capital S means the special bit is set but execute is not, which usually makes it useless. The same rule applies to t and T for the sticky bit.
What permissions should a website use?
Usually 644 for files and 755 for directories, owned by your deploy user. Keep secrets such as .env or wp-config.php at 640 or 600, and give the web server write access only to upload and cache folders.
What is umask?
A mask of permissions removed from new files and folders. New files start from 666 and folders from 777, so the common umask 022 gives 644 files and 755 folders, and 077 gives 600 and 700.