Chmod Calculator

Easily compute Linux/Unix file permissions. Toggle the checkboxes to instantly generate the corresponding octal (e.g., 755) and symbolic (e.g., -rwxr-xr-x) notations.

Common Permissions Reference

Octal	Symbolic	Meaning & Typical Use Case
777	-rwxrwxrwx	Dangerous. Anyone can read, write, and execute. Rarely recommended.
755	-rwxr-xr-x	Standard Directory. Owner can write; everyone else can only read and execute (enter).
644	-rw-r--r--	Standard File. Owner can edit; everyone else can only read. Ideal for HTML/PHP files.
600	-rw-------	Private File. Only the owner can read and write. Used for SSH keys (id_rsa) and configs.
400	-r--------	Read-Only Private. Only the owner can read. Used for immutable sensitive files.

Deep Technical Guide: Linux File Permissions and Chmod Octal Mapping

1. The Mathematical Foundation of Unix Permission Octals

At the core of the Unix and Linux file security models lies the permission bitmask. Linux filesystems store metadata for files using three distinct user scopes: the Owner (the user account that created the file), the Group (a defined group of users on the system), and Others (everyone else). Each scope is represented by three basic access flags: Read (r), Write (w), and Execute (x).

In octal notation, these rights are represented by binary bits. Read has a value of 4 (2^2), Write is 2 (2^1), and Execute is 1 (2^0). Summing these bits yields a single digit between 0 and 7. Thus, full read and write access without execute is 6 (4+2), whereas full access is 7 (4+2+1). Combining these digits yields the standard 3-digit octal permission code (e.g. 755).

2. Execution Contexts: Files vs. Directory Paths

A common point of confusion is how the execute (x) flag behaves across files versus directory nodes. For standard files, the execute flag determines if the OS kernel can load the file into memory as a running process or script.

For directory paths, however, the execute flag acts as the "traverse" permission. If a user has read access to a folder but lacks execute access, they can list the names of the files in the directory but cannot enter it (cd) or access any files within it. Thus, directories must maintain execute flags to allow access.

3. Enforcing the Principle of Least Privilege

In production environment administration, granting broad permissions is a primary security hazard. Developers frequently use the shorthand command chmod 777 to resolve access errors, which grants anyone on the server read, write, and execute permissions.

This exposure enables attackers to inject malicious scripts into public web folders. Security policies demand utilizing the tightest permissions that support execution. Private key nodes (such as id_rsa SSH credentials) require 600 permissions, which denies access to all users except the owner.

4. Advanced Permission Flags: SUID, SGID, and Sticky Bits

Unix security incorporates advanced permission bits that precede the standard 3-digit octal. SUID (represented by a leading 4) runs a program with the owner's privileges rather than the runner's, which is essential for binaries like passwd.

SGID (leading 2) forces new files within a folder to inherit the parent directory's group assignment. The Sticky Bit (leading 1) restricts file deletion in shared folders (like /tmp), preventing users from deleting files owned by others.

Example: Dangerous vs. Secure Permissions

Review how permissions can be restricted to secure files and folders while maintaining usability.

❌ Insecure Web Root Setup

# Grants write access to arbitrary users
chmod 777 /var/www/html
chmod 777 /var/www/html/config.php

🟢 Secure Production Setup

# Restricts write access to the owner only
chmod 755 /var/www/html
chmod 644 /var/www/html/config.php

Standard Permission Profiles

Chmod Code	Symbolic String	Typical Use Cases
755	`rwxr-xr-x`	Public directories, executable binaries, and system search paths.
644	`rw-r--r--`	Standard documents, HTML files, CSS sheets, and static image resources.
600	`rw-------`	Private SSH key stores (e.g. `id_rsa`) and secure database config files.
700	`rwx------`	Private home folders or script run sandboxes restricted to a single user.

Related Server & DevOps Utilities

🐳

Dockerfile Generator

Generate optimized, multi-stage Dockerfiles

📦

Docker Compose Generator

Orchestrate multi-container setups easily

🪣

S3 Bucket Policy Generator

Generate secure JSON AWS S3 resource policies

🧹

Gitignore Generator

Generate customized file exclusions for Git

🌐

.htaccess Generator

Build Apache server redirects and rewrites

⚙️

Nginx Redirect Generator

Configure Nginx server redirection rule blocks

Frequently Asked Questions

What is chmod?

chmod (change mode) is a command-line utility in Unix and Linux-like operating systems used to change the access permissions of file system objects. It determines who can read, write, or execute a file. Access settings are configured via flags representing different permissions. Operating systems enforce these restrictions to protect data integrity and lock down private server configurations.

How do octal permissions (e.g. 777 or 755) work?

Octal permissions are a 3-digit number where each digit represents permissions for the Owner, Group, and Public respectively. Each digit is a sum of its allowed actions: Read (4), Write (2), and Execute (1). For example, 7 (4+2+1) means read, write, and execute permissions. 5 (4+1) means read and execute permissions only. This notation is a shorthand way to convey access states in a simple format.

What is the difference between Owner, Group, and Public?

Owner (User) is the individual user account that owns the file. Group refers to users who are members of the file's assigned user group. Public (Others) applies to any other user on the system who is neither the owner nor in the group. Restricting access permissions according to these roles is a core mechanism of Linux system security.

What is the safest default permission for directories and files?

For directories, 755 (rwxr-xr-x) is standard, allowing the owner to modify files, while others can only enter and read. For standard files, 644 (rw-r----) is typical, allowing the owner to edit, and others to read. This balance ensures users can access applications while preventing unauthorized changes. Sensitive files like keys should use stricter flags like 600.

Why should I avoid chmod 777?

Setting a file or directory to 777 gives every user on the system full permission to read, write, modify, and execute it. This is a massive security vulnerability, particularly on web servers, as it allows attackers to inject malicious scripts or delete data. It bypasses all user boundaries and exposes private system assets to arbitrary manipulation. You should always opt for the least privilege needed.

How do I apply permissions recursively to a folder and all its contents?

To apply permissions recursively to a folder and all its subfolders and files, use the `-R` flag in your command line. For example, running `chmod -R 755 /path/to/directory` applies the permissions globally. Be cautious when using this command as it sets the execute flag on all files as well as directories. It is often safer to target files and directories separately using the find command.

What are special permission flags like SUID, SGID, and the Sticky Bit?

SUID (Set User ID) allows a file to execute with the permissions of the file owner rather than the user running it. SGID (Set Group ID) forces new files inside a directory to inherit the parent directory's group ownership. The Sticky Bit ensures that only a file's owner can rename or delete files inside a shared directory, like `/tmp`. These special permission flags are represented by a fourth leading digit in octal notation.