About the Chmod Calculator
The chmod calculator converts Unix file permissions between the three forms you actually run into: checkboxes for read, write and execute per owner, group and other, the numeric octal mode like 755, and the symbolic string like rwxr-xr-x. It also covers the three special bits, setuid, setgid and sticky, and generates the exact chmod command you can copy straight into a terminal.
It works in both directions. Tick the permission boxes and the octal value and symbolic string update instantly, or type an octal value directly and watch the checkboxes and symbolic string follow. That two-way sync is the point: you rarely start from a blank slate, you either have a target permission in mind ("owner should be able to write, nobody else") or a mode you're trying to decode ("what does 2755 actually grant"), and this tool works from either direction.
This matters because octal permission notation is compact but not self-explanatory, and getting it wrong on a server has real consequences: a world-writable config file, an SSH private key that ssh refuses to use because it's group-readable, or a setuid binary left on by accident. Rather than counting bits in your head or trusting a half-remembered chmod 777 reflex, you can build the exact permission set you mean and see both notations and the resulting command before you run anything.
Everything computes locally in the browser. No file, path or permission value is sent to a server, and the tool never touches your actual filesystem, it only calculates the octal mode, the symbolic string and the command text.
How to use it
- Tick read, write and execute for owner, group and other to build the permission set you want.
- Optionally enable setuid, setgid or the sticky bit under special, if the situation calls for them.
- Read the resulting octal value, such as 755 or 644, in the octal field.
- Read the equivalent symbolic string, such as rwxr-xr-x, right next to it.
- Or work in reverse: type an octal value like 2755 directly and watch the checkboxes and symbolic string update to match.
- Copy the generated chmod command with the button, or read it off the command line at the bottom.
- Cross-check the result against the output of ls -l on the actual file, which shows the current symbolic string in the first column.
Examples
- Owner rwx, group r-x, other r-x becomes octal 755, symbolic rwxr-xr-x, command chmod 755 file.
- Owner rw-, group r--, other r-- becomes octal 644, symbolic rw-r--r--, the default for most regular files.
- Owner rw- only, group and other with no access becomes octal 600, symbolic rw-------, the required mode for an SSH private key.
- 1777 gives full rwx to everyone plus the sticky bit, symbolic rwxrwxrwt, the exact mode used on /tmp.
- 4755 sets setuid on top of 755, symbolic rwsr-xr-x, as seen on binaries like passwd that must run as their owner.
- 2775 sets setgid on a directory, symbolic rwxrwsr-x, so new files created inside inherit the directory's group.
Octal vs symbolic notation
Both notations describe the exact same permission bits, they just read differently. Octal is a single base-8 digit per class (owner, group, other), where each digit is a sum of read (4), write (2) and execute (1). Symbolic notation spells the same three bits out as r, w, x or a dash for "off", repeated for owner, group and other in that order, which is also exactly what the first column of ls -l shows (after the leading file-type character). Octal is faster to type and is what chmod commands almost always use in scripts and documentation; symbolic is easier to read at a glance and is what you see when you list a directory.
- rwxr-xr-x reads as: owner rwx (7), group r-x (5), other r-x (5), so octal 755
- rw-r--r-- reads as: owner rw- (6), group r-- (4), other r-- (4), so octal 644
- rwx------ reads as: owner rwx (7), group and other nothing (0,0), so octal 700
- A dash in any position simply means that permission is off for that class
How each digit is built from bits
Within a single class, read, write and execute are independent bits that just get added together, which is why the digit range per class is always 0 to 7.
- 4 = read (r)
- 2 = write (w)
- 1 = execute (x)
- 0 = none (---)
- 5 = read + execute (r-x), 6 = read + write (rw-), 7 = read + write + execute (rwx), 3 = write + execute (-wx)
Setuid, setgid and the sticky bit
These three special bits form an optional fourth, leading octal digit (also built from 4, 2 and 1) and change behavior beyond plain read/write/execute. They show up as a substituted character in the symbolic string instead of an extra column, which is exactly why 4-digit modes like 4755 or 2775 look unfamiliar until you know what to look for.
- setuid (4, leading digit): on an executable, the process runs with the file owner's privileges instead of the caller's; shown as s replacing x in the owner's execute position (rwsr-xr-x), or S if execute is off for owner
- setgid (2, leading digit): on an executable, the process runs with the file's group privileges; on a directory, new files and subdirectories inherit that directory's group instead of the creating user's default group; shown as s or S in the group's execute position
- sticky bit (1, leading digit): on a directory, only the file's owner (or root) can delete or rename files inside it, even if others have write access to the directory; shown as t (or T if execute is off for other) in the other class's execute position, as used on /tmp
- setuid and setgid on regular files are a well-known privilege-escalation risk if the target binary is scriptable or has a shell fallback, which is why security scans flag unexpected setuid files
Common modes and when they're used
- 644 (rw-r--r--): standard for regular files, owner can edit, everyone else can read
- 755 (rwxr-xr-x): standard for directories and executable scripts, owner has full control, everyone else can read and traverse or execute
- 600 (rw-------): private files only the owner should read, the required mode for SSH private keys (id_rsa, id_ed25519) and most credential files
- 700 (rwx------): private directories, owner-only access, common for a home directory or a secrets folder
- 664 (rw-rw-r--): shared-write files within a group, common for collaborative project files
- 775 (rwxrwxr-x): shared-write directories within a group
- 1777 (rwxrwxrwt): world-writable with sticky bit, the mode used on /tmp so anyone can create files but only delete their own
- 4755 (rwsr-xr-x): setuid executables like /usr/bin/passwd that must briefly run with elevated privileges
- 777 (rwxrwxrwx): full access for everyone; almost never the right answer outside of throwaway test environments, since it removes any access control on the file
Frequently asked questions
What does the chmod calculator do?
It converts between four representations of the same Unix permission: read/write/execute checkboxes per owner, group and other, the octal mode, the symbolic rwx string, and the ready-to-run chmod command, updating all of them together.
Can I type an octal value directly instead of using the checkboxes?
Yes. Typing an octal value like 750 or 4755 updates both the checkboxes and the symbolic string to match, so you can work from either direction depending on what you already know.
What is the difference between 755 and 644?
755 gives the owner full read, write and execute access, and gives group and other read plus execute, which is typical for directories and scripts that others need to run or enter. 644 gives the owner read and write, and gives group and other read-only, which is typical for regular files that others should view but not run or modify.
What do setuid, setgid and the sticky bit do?
Setuid makes an executable run with its owner's privileges rather than the caller's. Setgid does the same for group privileges, and on a directory makes new files inherit that directory's group. The sticky bit, used on directories like /tmp, restricts file deletion to each file's own owner even when the directory itself is writable by everyone.
Why is chmod 600 required for an SSH private key?
SSH refuses to use a private key file that is readable by anyone besides the owner, since a group- or world-readable key could be copied by another local user. Chmod 600 (rw-------) satisfies that requirement, and 400 (r--------) also works if you never need to edit the file directly.
How do I read a symbolic string like rwxr-xr-x?
It splits into three groups of three characters, for owner, group and other in that order. Within each group, r means read, w means write, x means execute, and a dash means that permission is off.
What does chmod 4-digit mode like 2775 mean?
The leading digit encodes the special bits (4 setuid, 2 setgid, 1 sticky, summed as needed) and the remaining three digits are the normal owner, group, other permissions. 2775 is setgid (2) plus rwxrwxr-x (775), commonly used on shared project directories so new files inherit the directory's group.
Does this tool change permissions on my actual files?
No. It only calculates the octal value, symbolic string and command text locally in your browser. It does not touch your filesystem, and no path or file is sent to a server, so it is purely a reference and command generator.
Why does an s appear instead of x in the symbolic string?
That is how setuid or setgid is shown: a lowercase s in the execute position (owner for setuid, group for setgid) means the special bit and the execute bit are both set. An uppercase S in the same position means the special bit is set but execute is off, which is usually a sign of a misconfigured permission rather than an intentional one.
What is the safest permission for a new file I create?
Most systems default new files to 644 and new directories to 755 based on the umask. For anything containing credentials or private keys, tighten that to 600 (file) or 700 (directory) rather than leaving the default in place.