chmod calculator
Set Unix file permissions with checkboxes, an octal number such as 755, or the rwxr-xr-x text, and get the matching chmod commands.
Runs entirely in your browser
- Numeric
- Symbolic
What this mode allows
| Who | On a file | On a directory |
|---|
Works on the nine permission bits plus setuid, setgid and sticky, as in POSIX chmod. It does not read real files, show ownership, or cover ACLs, file attributes or umask. Octal modes need 3 or 4 digits.
How to work out a chmod mode
- Tick the boxes for owner, group and others, or pick a common preset such as 644 or 755. You can also type an octal number or the nine-letter text and the boxes follow.
- Check the plain-English summary of what each class can do to a file and to a directory, and read any warning shown.
- Copy the numeric or symbolic
chmodcommand. Change the file name first if you want the command ready to paste.
How Unix file permissions are stored
Every file and directory on a Unix-like system carries a short mode: three permission bits (read, write, execute) for each of three classes (the owning user, the owning group, everyone else), plus three special bits. That is twelve bits, and the octal number is simply those bits written three at a time, which is why the digits only go up to 7. The nine-letter form from ls -l shows the same bits as letters.
Read, write and execute mean different things on a directory. Read lets you list the names inside, write lets you add, rename and remove entries, and execute lets you step into the directory and reach things by name. A directory with read but no execute shows its names and denies access to everything in it, a common source of confusing permission errors.
The special bits change how a mode behaves. Setuid and setgid make a program run with the file owner's or group's rights instead of the caller's, which is powerful and so is ignored for shell scripts on most systems. Setgid on a directory makes new files inherit its group, and the sticky bit on a directory stops users deleting each other's files. If you are unsure which mode a file needs, start restrictive and add only what an error message asks for.
Tips
- Binary and octal are the same bits written differently; the number base converter shows 755 as 111 101 101.
- Planning a cron job that runs a script you just made executable? Build the schedule with the cron expression generator.
- Calculating network ranges next? Try the subnet calculator.
Questions
How does the octal number work?
Each digit adds up read (4), write (2) and execute (1) for one class, in the order owner, group, others. So 7 is read, write and execute, 5 is read and execute, and 4 is read only. 755 gives the owner everything and everyone else read and execute. An optional fourth digit in front holds setuid (4), setgid (2) and sticky (1).
What do the s, S, t and T letters mean?
They replace the x in the owner, group or others position. A lower-case letter means the special bit is set and execute is also on; an upper-case letter means the special bit is set but execute is off, which is usually a mistake. So 4755 is rwsr-xr-x and 4644 is rwSr--r--.
What is the difference between 644 and 755?
644 is the usual mode for ordinary files: the owner can read and write, everyone else can only read. 755 adds execute for all, which programs, scripts and directories need. Directories need the execute bit for anyone to enter them.
Why is 777 considered dangerous?
It lets every user on the machine, and any program running as one, change or replace the file. A web server that is told to write somewhere does not need that: giving the right user or group ownership and using 775 or 770 solves most permission errors without opening the file to everyone.
What does the sticky bit do?
On a directory, it stops users from deleting or renaming files they do not own, even if they can write to the directory. That is why shared folders such as /tmp are mode 1777. On modern Linux it has no effect on ordinary files.
Does this change anything on my computer?
No. It only calculates the number and the commands. Nothing you enter is sent anywhere, and you run the commands yourself in a terminal.