Chmod Calculator (Unix Permissions)

Every file on Linux, macOS and other Unix systems carries twelve permission bits: read, write and execute for the owner, the group and everyone else, plus three special bits — setuid, setgid and sticky. This calculator converts between the three ways people write them: octal numbers such as 755 or 4755, the rwxr-xr-x string that ls -l prints, and chmod’s own words such as u=rwx,go=rx or g+w. Tick the boxes, pick a common setting, or paste what you have in any of those forms; it shows the other forms, the exact chmod command, what the permissions let each class of user do, and a warning when a setting is risky. It follows GNU coreutils exactly — every one of the 4,096 possible modes converts both ways and back.

1. Type what you have — 755, -rwxr-xr-x copied from ls -l, or a chmod change like g+w — and press Enter. A change like g+w is applied to the boxes as they are.
2. Or tick read, write and execute for the owner, the group and others, and switch setuid, setgid or sticky on if you need them.
3. Copy the octal number or the full chmod command from the result.
4. Read the plain-English meaning and any warning before running it on a server.

• It covers the classic permission bits. Access control lists (the + after ls -l’s permissions), SELinux labels and macOS extended attributes can grant or deny access on top of them.
• chmod’s X (execute only for folders and already-executable files) and copying one class to another (g=u) depend on the file, so they are not accepted here.
• On most systems setuid and setgid are ignored on shell scripts; they only take effect on compiled programs.
• Who counts as the owner and the group depends on the file’s ownership, which chmod does not change — use chown for that.
• Everything is worked out in your browser. Nothing you type is sent anywhere, and no file is touched.

The owner can read, write and execute (7 = 4 + 2 + 1); the group and everyone else can read and execute (5 = 4 + 1). It is the usual setting for scripts, programs and folders that others need to open but not change. As ls -l shows it: rwxr-xr-x.

Execute. 644 (rw-r--r--) is for ordinary files: the owner can edit, everyone can read, nobody can run it. 755 adds execute for all three, which a folder needs before anyone can open it and a script needs before it can run.

Almost never. 777 lets every user on the system change or replace the file, so any other account or compromised service can plant code in it. If a web server cannot write somewhere, give the folder to the server’s user or group instead of opening it to everyone.

s in the owner’s execute place is setuid: the program runs with its owner’s rights — /usr/bin/passwd is 4755 so it can update the password file. s in the group’s place is setgid. t in others’ place is the sticky bit: in a shared folder such as /tmp (1777) people can only delete their own files. A capital S or T means the special bit is set but execute is not.

OpenSSH refuses a private key that others can read. Set it to 600 (rw-------) with chmod 600 ~/.ssh/id_ed25519, and the .ssh folder to 700. authorized_keys should not be writable by anyone but you — 600 or 644.

It holds the special bits: 4 is setuid, 2 is setgid and 1 is sticky, added together like the others. 2775 on a shared project folder makes new files belong to the folder’s group. With three digits, the special bits are left off.