Chmod calculator

What this tool does

Every file on a Unix system carries a set of permissions that decide who may read it, change it, or run it. The chmod command sets them, and it accepts those permissions in two quite different spellings — a three-digit octal number and a string of letters — that describe the exact same thing. This tool keeps both spellings, and a grid of checkboxes, in sync, so you can start from whichever one you have and copy the one you need.

It runs entirely in your browser and is pure arithmetic: there is no server, and nothing you type is sent anywhere. It is a calculator and a reference, not a way to change permissions on a real machine — for that you copy the chmod command it produces and run it yourself.

Three groups, three permissions

Permissions are organised as three groups of three. The three groups are the file’s owner, the group that owns it, and everyone else — “other”. Within each group there are three permissions: read, write and execute.

• Read (r) — view the file’s contents, or list a directory’s entries.
• Write (w) — change the file, or add and remove entries in a directory.
• Execute (x) — run the file as a program, or enter a directory and reach the files inside it.

Execute means something different for a directory than for a file, and that catches people out: a directory you can read but not execute lets you see the names of what is inside but not open any of it.

How the octal number works

Each group’s three permissions pack into one octal digit by adding up fixed values: read is 4, write is 2, execute is 1. Read-write-execute is 4+2+1 = 7; read-execute is 4+1 = 5; read-write is 4+2 = 6. Three groups give three digits.

755
7 = 4+2+1   # owner: read + write + execute
5 = 4+0+1   # group: read + execute
5 = 4+0+1   # other: read + execute

So 755 is “owner can do everything, everyone else can read and run but not change”, which is the usual mode for a program or a directory. 644 — owner read-write, everyone else read-only — is the usual mode for an ordinary file. Once the pattern is familiar the common modes read at a glance.

The symbolic string

The other spelling is the one ls -l prints: nine characters, three per group, each either its letter or a dash. 755 is rwxr-xr-x; 644 is rw-r--r--. It carries exactly the same information as the octal number, just laid out so you can see each permission rather than add digits in your head.

An ls -l line has a tenth character on the front — a d for a directory, a dash for a regular file, an l for a symbolic link. That leading character is the file’s type, not a permission, and chmod cannot change it. You can paste a whole ls -l permission field here and the type character is simply ignored.

The special bits: setuid, setgid and sticky

Above the nine ordinary bits sit three special ones, written as an optional fourth octal digit on the front — setuid (4), setgid (2) and the sticky bit (1). They do not get a column of their own; instead each one overloads an execute slot in the symbolic string, which is the source of the capital letters people find baffling.

• setuid on an executable makes it run as the file’s owner rather than as the user who launched it. This is how passwd can update a system file you cannot write to directly — and why a setuid program with a bug is a serious hole.
• setgid on an executable runs it as the file’s group. On a directory it does something more useful and safer: new files created inside inherit that directory’s group instead of the creator’s.
• The sticky bit on a directory means only a file’s owner can delete or rename it, even when everyone can write to the directory. This is what keeps /tmp shared but safe. On a plain file it does nothing.

In the symbolic string a set special bit turns its execute slot into a letter: s in the owner slot for setuid, s in the group slot for setgid, t in the other slot for sticky. The case tells you whether execute is also on — lowercase means yes, uppercase means no.

rwsr-xr-x  4755   # setuid, owner executes
rwSr-xr-x  4655   # setuid, owner does NOT execute
rwxrwxrwt  1777   # sticky, other executes
rwxrwxrwT  1776   # sticky, other does NOT execute

A capital S or T is almost always a mistake: it means a special bit was set on a file that is not executable, so the bit has nothing to act on.

Octal or symbolic on the command line

chmod accepts both forms, and this tool writes both. The octal form sets every bit at once: chmod 755 file. The symbolic = form does the same absolutely — chmod u=rwx,g=rx,o=rx file — listing each group so the result does not depend on what the file started as.

There is a third, relative form the calculator does not need but you will meet: chmod +x file adds execute for everyone, chmod g-w file removes group write, chmod o= file clears everything for other. That form changes bits relative to the current mode rather than setting the whole thing, which is handy on the command line but has no single “result” to display.

Modes worth not setting

A permission tool should also say when a mode is a bad idea. Two come up constantly:

• 777 gives every user read, write and execute. It is the reflex fix when something “won’t work”, and it almost always trades a small problem for a real security hole. The right mode is nearly always narrower — usually 755 or 644.
• Any world-writable file (the last digit including 2) lets any account on the machine rewrite its contents. For anything that is run, sourced, or trusted, that is a way in. Grant write to a group instead, or keep it to the owner.

The tool flags these as they occur. It cannot know whether your target is a file or a directory, so it phrases them as things worth a second look rather than as errors — the sticky bit is right on a directory and pointless on a file, and only you know which you have.

What chmod 755 means

This is the mode almost every script, program and directory ends up with, and it reads one class at a time. Each digit is that class’s three permissions added together — read 4, write 2, execute 1 — so 7 is all three and 5 is read plus execute with write left out.

• Owner — 7 = 4+2+1. Read, write and execute: you can edit the file and run it.
• Group — 5 = 4+0+1. Read and execute, no write: members of the file’s group can read it and run it, and cannot change it.
• Other — 5 = 4+0+1. The same again: every other account on the machine can read it and run it, and none of them can change it.

Written out that is rwxr-xr-x, and the command is chmod 755 file — or chmod u=rwx,g=rx,o=rx file if you prefer the letters. On a directory the same bits read differently, because there execute means you may enter it and reach what is inside: 755 is a directory anyone can list and walk into while only the owner can add or remove entries. The calculator says nothing at all about 755, deliberately — it is the narrowest mode that still lets other accounts run what you wrote. If the group needs to edit the file too, the mode that adds group write is 775; 777 is not.

What chmod 644 means, and why your files already have it

644 is 755 with every execute bit taken out: 6 = 4+2 for the owner, then 4 = 4+0+0 for the group and 4 again for other, which is rw-r--r--. Nobody can run it, and that is exactly right for anything only ever read — a document, a page of HTML, a configuration file, a source file some other program compiles. On a directory it is not restrictive but broken: with no execute nothing can enter, so the names inside can be listed and not one of them opens.

It is also the mode a new file usually has before anyone touches it, and umask is the reason. A program creating a file normally asks for 666 and one creating a directory for 777; the umask then clears the bits it names before the file exists. With the common umask of 022 — write withheld from group and from other — 666 becomes 644 and 777 becomes 755, which is why those two are everywhere and why they are the first two modes this tool offers. Type umask in a shell to see the value you have.

• umask 022, the usual default — a new file comes out 644 and a new directory 755.
• umask 002, set where every user has a group of their own — 664 and 775, so group members can edit as well.
• umask 077, the private setting — 600 and 700, which nobody but the owner can even read.

All six of those are presets here, and that is not a coincidence: they are the three umasks people actually set, applied once to a file and once to a directory. Reading them as three pairs rather than six values is the quickest way to stop looking modes up.

What chmod 711 means: enter, but do not look

711 is the common mode that hands out execute without read: 7 = 4+2+1 for the owner, then 1 = 0+0+1 twice, which is rwx--x--x. It only makes sense once you separate the two directory permissions again — read lists the names, execute lets you pass through — so a directory at 711 can be walked into by anyone who already knows the name of what they want, and listed by nobody.

• On a directory that is genuinely useful. A home directory at 711 lets a web server, or another account on a shared machine, open /home/you/public/report.pdf while ls /home/you is refused. Nothing is hidden from the owner; the names simply cannot be enumerated by anybody else.
• On a file it is close to useless. Running a shell script means an interpreter opening the file and reading it, so execute without read fails; only a compiled binary, which the kernel loads itself, still runs. If you meant a script others could run, you wanted 755.

The calculator says nothing about 711 either, because it is narrower than 755 rather than wider: it grants nothing 755 does not. Its neighbours turn up for the same reason — 751 hands the group the listing that other is denied, and 700 withholds even the traversal, which is what a directory meant for one account wants.

777 and 1777: one bit apart, and not the same advice

The two modes a shared directory tends to attract differ by a single bit, and this tool answers them differently on purpose. 777 is rwxrwxrwx and comes back flagged as a danger; 1777 is rwxrwxrwt, comes back as a plain note, and is one of the presets above — it is the mode /tmp really has.

• 777 — every digit is 4+2+1: read, write and execute for the owner, the group and everyone else. Nothing is left to protect anything with: any account can rewrite the file, and any account can delete or replace an entry in a directory carrying it. It is the reflex fix for a permission problem, and it almost always swaps a small problem for a real one.
• 1777 — the same nine bits with the sticky bit added, which allows deleting and renaming an entry only to that entry’s own owner. That one restriction is what makes a directory safe to leave writable by everybody, and it is why /tmp works: anyone may create a file there and nobody may remove somebody else’s.

The distinction only holds where other can execute as well, and the tool is strict about that. 1666 is rw-rw-rwT — the sticky bit set where no class has execute at all — and nothing of that shape can be a usable directory, so the sticky bit guards nothing and the mode is flagged world-writable at full severity, exactly as 666 is. The capital T says the same thing in one character.

So: a directory that has to be shared wants 1777, or better still 775 and the right group; and a file that will not open is nearly always an ownership problem rather than a case for 777.