How it works
Unix permissions are three groups of three bits: user (owner), group and others, each holding read (4), write (2) and execute (1). The octal value is just the sum per group — rwx is 7, r-x is 5, r-- is 4 — so 755 means full control for the owner and read-plus-execute for everyone else. The calculator shows the matrix, the octal and the symbolic notation together, editable in both directions.
Toggle checkboxes and the octal updates; type an octal value and the checkboxes follow. The symbolic string (rwxr-xr-x) is what ls -l prints, so you can paste a permission you saw on a server and understand it instantly, or build the one you need and copy the ready chmod command.
Presets cover the daily cases: 644 for web files (owner writes, world reads), 755 for scripts and directories (execute = traverse for directories), 600 for private files such as keys, and 640 for files a group should read but not modify.
This tool covers the standard nine permission bits. Special bits — setuid (4xxx), setgid (2xxx) and the sticky bit (1xxx) — are a separate layer; the common errors section explains when they matter.
Worked example
Build 754: owner gets everything, group reads and executes, others read only.
| Class | Bits | Octal | Symbolic |
|---|---|---|---|
| User | r + w + x | 4+2+1 = 7 | rwx |
| Group | r + x | 4+1 = 5 | r-x |
| Others | r | 4 | r-- |
- Pick a direction: Toggle the rwx checkboxes or type a three-digit octal value directly.
- Read both notations: Octal and symbolic stay in sync as you edit either side.
- Use a preset if unsure: 644 for files, 755 for scripts and directories, 600 for secrets.
- Copy the command: The ready chmod line includes the symbolic form for review.
Combined: chmod 754 script.sh renders rwxr-xr-- in ls -l. On a directory, the execute bits mean "may enter", so 754 lets group and others list contents but not modify them.
Common errors and edge cases
- Execute on directories means traverse. A directory without x cannot be entered or listed through, even with r set. Web directories almost always need 755, not 644.
- 777 is not a fix. World-writable files let any local user or compromised process modify them. Solve the ownership problem (chown, groups) instead of opening everything.
- 600 for private keys. SSH refuses keys with loose permissions.
chmod 600 ~/.ssh/id_ed25519is the expected state. - umask shapes new files. The default permissions of new files are 666/777 minus the umask (commonly 022 → 644/755). chmod changes existing files; umask governs creation.
- Special bits are separate. setuid (4755), setgid (2755) and sticky (1777, like /tmp) add a fourth leading digit. They are powerful and easy to misuse — add them deliberately, not by habit.
Code equivalents
Beyond chmod, the same bits are visible and scriptable everywhere. These commands round out the daily workflow.
| Tool | Example |
|---|---|
| ls | ls -l file prints the symbolic form (-rwxr-xr-x); stat -c '%a %A' file shows octal and symbolic. |
| Symbolic chmod | chmod u+x script.sh, chmod o-w file, chmod g=r file — change classes without computing octal. |
| find | find . -type f -perm 777 locates world-writable files; find . -type d -exec chmod 755 {} + normalizes directories. |
Related tools
Frequently asked questions
What does chmod 755 actually mean?
Owner: read+write+execute (7), group and others: read+execute (5). It is the standard for scripts and directories — everyone can use or enter, only the owner can modify.
Why do directories need execute permission?
On directories, x means traverse: without it you cannot cd in or access files inside, even with read set. That is why directories are usually 755 while files are 644.
Is chmod 777 ever acceptable?
Almost never on a shared system. It lets any process modify or replace the file. Fix ownership or group membership instead; 777 is a symptom, not a solution.
What is the difference between chmod 600 and 640?
600 is owner-only — the right choice for private keys and secrets. 640 lets the owning group read as well, useful for shared configuration that others must not see.
How do I read the first character of ls -l output?
It is the file type, not a permission: - for a regular file, d for a directory, l for a symlink. The nine characters after it are the user/group/other rwx triplets.
Privacy note
All processing happens in your browser. The values you enter never leave your device and are never transmitted to ToolPlex.