chmod Permission Calculator
Convert between octal, symbolic and checkbox views of Unix file permissions, including setuid, setgid and the sticky bit.
Result
Breakdown
| Who | Octal | Symbolic | Permissions |
|---|---|---|---|
| Owner (user) | 6 | rw- | read, write |
| Group | 4 | r-- | read |
| Others (world) | 4 | r-- | read |
| Special bits | 0 | - | none |
About chmod Permission Calculator
Unix permissions are three groups of three bits, expressed as an octal digit each. This converts in both directions and flags the combinations that are security problems rather than choices.
umask, and why new files are not 777
Processes create files requesting mode 666 and directories requesting 777; the umask then subtracts permission bits. The common default of 022 removes group and other write, producing 644 files and 755 directories. A umask of 077 produces 600 and 700 — appropriate for a host handling credentials. Because umask only ever removes bits, it cannot grant permissions, which is why a deployment that needs group-writable files must set the mode explicitly rather than relying on it.
Why directories need execute
On a directory, the execute bit means "traverse" - permission to look inside and reach entries by name. A directory with r-- lets you list names but not stat or open anything in it, which produces bafflingly inconsistent errors. Directories need x wherever r is granted, which is why 755 and 750 are the conventional directory modes.
Common use cases
- Fixing an SSH key rejected for being too permissive (it wants 600).
- Setting the right mode on a config file containing credentials.
- Reading an ls -l output back into a chmod command.
Edge cases and gotchas
- Never make private keys, RADIUS secrets or credential files group- or world-readable.
- chmod -R on a tree applies file modes to directories too, usually removing the traverse bit and breaking access.