chmod Calculator

Nine bits, three classes, one number

A Unix mode is three groups of three bits. The classes are user (the owner), group, and other — everyone else. Within each class the bits are read, write and execute, in that order, worth 4, 2 and 1.

So 7 is 4+2+1 — read, write and execute — and 755 means the owner can do everything, while everyone else can read and execute but not modify. That is the conventional mode for a program, and it is the reason executable files are usually 755 while data files are 644: nobody needs to execute a text file, and granting execute permission on one is how accidentally downloaded files become accidentally run.

Mode	Meaning	Typical use
644	Owner reads and writes; everyone reads	Ordinary files, web content
755	Owner does everything; others read and execute	Programs and scripts
700	Owner only	Private directories, SSH keys
600	Owner reads and writes, nobody else anything	Secrets, key files
1777	Everyone, plus the sticky bit	/tmp
4755	Executable that runs as its owner	setuid binaries such as passwd

The three bits nobody remembers

Above the nine permission bits sit three more, written as a fourth leading digit:

• setuid (4000) — on an executable, the process runs with the permissions of the file's owner rather than the person invoking it. This is how passwd lets you change a root-owned file. It is also the classic privilege-escalation primitive, so an unexpected setuid binary is worth investigating.
• setgid (2000) — on an executable, the process takes the file's group. On a directory it means something different and very useful: new files created inside inherit the directory's group instead of the creator's, which is what you want for a shared project folder.
• sticky (1000) — on a directory, restricts deletion: a file can only be removed by its owner, the directory's owner, or root, even if everyone has write access. That is what makes /tmp workable.

Directories need execute, and that surprises people

On a directory the bits mean something slightly different from on a file. Read lets you list the names inside; write lets you create and delete entries; execute means you can traverse into it and reach anything within.

A directory with read but not execute lets you see filenames but not open them or stat them. A directory with execute but not read lets you open a file if you already know its name but not list the contents. Removing execute from a directory is effectively removing access to everything under it.

Why new files are not 666

Permissions of newly created files are filtered through the process's umask, a mask of bits to clear. A umask of 022 — the common default — removes write permission from group and other, so a file created with mode 666 lands at 644 and a directory created at 777 lands at 755. A umask of 077 gives 600 and 700, which is the right choice for anything private.

Frequently asked questions

Why does chmod not work on my file?

You probably do not own it — only the owner and root can change a mode. Ownership is separate from permission bits; use chown first, or sudo. On some systems an immutable attribute or an ACL can also block the change.

What is the difference between chmod and chown?

chmod changes what can be done with a file; chown changes who owns it. Both matter, because the "user" bits apply to whoever the owner is.

Do I need the execute bit to run a script?

To run it as ./script.sh, yes. You can also pass it to an interpreter explicitly — bash script.sh — which only needs read permission, because in that case bash is the thing executing.

What does the leading character in ls -l mean?

The file type: - for a regular file, d for a directory, l for a symbolic link. The nine characters after it are the permission bits in user, group, other order.