The Chmod Calculator, Explained

After reading this you can translate any Unix permission between its octal form (755), its symbolic form (rwxr-xr-x) and a set of checkboxes, and predict exactly what each combination lets users do.

What a permission mode actually is

Every file and directory on a Unix filesystem carries a permission mode: a small integer that records who may read, write and execute it. When you run ls -l and see a line like -rwxr-xr-x, you are looking at that integer printed in symbolic form.

The mode splits into three groups of three bits. The first group applies to the file's owner (the user who owns it), the second to the file's group, and the third to others (everyone else). Each group carries the same three flags in the same order: read (r), write (w), execute (x).

Here is the hook. The command chmod 640 report.txt and the command chmod u=rw,g=r,o= report.txt do exactly the same thing. The number 640 is just the bit pattern rw-r----- written in base 8. Once you see how one becomes the other, the calculator stops being a lookup table and becomes obvious.

When to reach for this, and when not

Use the calculator when you have a mode in one form and need it in another. You read 755 in a tutorial and want to know what it grants. You want a private key readable only by its owner and need the octal for chmod. You are auditing a directory and want to confirm that 1777 really means what you think.

Do not use it to guess what permission a file should have. That depends on your threat model, not on arithmetic. A world writable web root (777) converts cleanly to rwxrwxrwx, and the calculator will tell you so, but it will not tell you that shipping it is a mistake. Numbers in, meaning out. Judgment stays with you.

The math: base 8 in three digits

Each permission group is three bits. Read is worth 4, write is worth 2, execute is worth 1. You add the values of the flags that are set. One group therefore ranges from 0 (no access) to 7 (all three).

Here r, w and x are each 0 or 1 depending on whether that flag is set, and v is the single octal digit for the group. Because 4, 2 and 1 are the three distinct powers of two below 8, every value from 0 to 7 has exactly one flag combination. There is no ambiguity.

A full mode is three such digits written owner, group, others. So rwx for owner, r-x for group, r-x for others gives 4+2+1=7, then 4+0+1=5, then 4+0+1=5, which is 755.

The fourth digit: setuid, setgid and sticky

Many modes are written with four octal digits, like 4755 or 1777. The leading digit holds three special bits that sit above the nine ordinary ones. Same arithmetic, same weights: setuid is 4, setgid is 2, the sticky bit is 1.

setuid (4000)

On an executable file, the process runs with the file owner's user ID instead of the caller's. This is how /usr/bin/passwd lets an ordinary user edit a root owned file. Shown as s in the owner execute position.

setgid (2000)

On an executable, run with the file's group. On a directory, new files inside inherit that directory's group rather than the creator's. Shown as s in the group execute position.

sticky (1000)

On a directory, only a file's owner (or root) may delete or rename it, even if others can write to the directory. Shown as t in the others execute position. This is exactly how /tmp stays safe.

The special bits share the display slots of the execute flags, which is why the letter changes case. A directory with mode 1777 prints as drwxrwxrwt: the final t is the sticky bit sitting where the others execute x would be. If the underlying execute bit is off, the letter is uppercase (S or T) to warn you the special bit has nothing to act on.

Reading a mode you did not write

The first character of an ls -l line is the file type, not a permission: - for a regular file, d for a directory, l for a symbolic link. Do not fold it into the octal. Only the nine characters after it (plus any special bits) form the mode.

For directories, the flags mean something different from files. Read on a directory lets you list its names. Execute lets you enter it and reach the files inside. Write lets you create and delete entries. A directory with r-- can be listed but not descended into, which surprises people: you can see that secret.txt exists but cannot open it, because opening requires traversing the directory, which needs execute.

Common mistakes

Confusing 4 and 2. Read is 4, write is 2, not the other way around. If you set chmod 400 expecting write only owner access, you get read only instead. The order is r, w, x from high value to low.

Forgetting execute on directories. chmod 644 on a folder produces rw-r--r--, and now nobody, not even you, can enter it. You will get "Permission denied" on paths you clearly own.

Reaching for 777. World writable almost never fixes the real problem, which is usually ownership. 777 lets any local account overwrite the file. Fix the owner or group with chown instead of opening the mode to everyone.

Dropping the special digit. chmod 755 on a setuid binary silently strips the setuid bit, because the three-digit form writes a leading 0. If you meant to keep it, use 4755.

Related tools

If you are working across a system rather than a single file, these help with the surrounding pieces. Plan an address range with the Subnet / CIDR Calculator. Identify a device from its hardware address with the MAC Address Lookup. Resolve a hostname with the DNS Lookup, check a domain's registration with the WHOIS Lookup, and inspect a TLS certificate with the SSL Certificate Decoder.

Related tools

Subnet / CIDR Calculator

Network, broadcast, host range and mask from CIDR notation.

DNS Lookup

A, AAAA, MX, TXT, NS, CNAME records via DNS-over-HTTPS.

SSL Certificate Decoder

Paste a PEM certificate, see subject, issuer, SANs, validity.

WHOIS Lookup

Registrar, dates and nameservers of any domain.

MAC Address Lookup

Vendor (OUI) lookup plus the meaning of every MAC bit.

Base64 / URL / HTML Encoder-Decoder

Encode and decode Base64, hex, URL percent-encoding and HTML entities — with auto-detect, bulk lines and file drop.