Chmod permissions, decoded — octal, symbolic and the special bits
Every file on a Unix system carries nine permission switches: read, write and execute for the owner, the group, and everyone else. Octal notation compresses those switches into digits — read is 4, write is 2, execute is 1, and each triad adds them up — so rwxr-xr-x becomes 755. Symbolic notation spells the same thing out as the rwx strings you see in ls -l output.
On top of the nine sit three special bits that most calculators quietly ignore: setuid and setgid run an executable with the file owner's or group's rights, and the sticky bit protects shared directories like /tmp so only the owner can delete their own files. Those live in a fourth, leading octal digit — which is why setuid on 755 is written 4755 and shows up as rwsr-xr-x.
Open the free Chmod Calculator — no signup, runs entirely in your browser.
How to use it
- Tick the read, write and execute boxes for Owner, Group and Others, or type an octal value like 644 straight into the octal field.
- Paste a symbolic string — including a full ls -l line like -rw-r--r--; the leading file-type character is stripped automatically.
- Add setuid, setgid or sticky with the labeled special-bit checkboxes and watch the leading octal digit and the s/S/t/T characters update.
- Copy whichever representation your chmod command, Dockerfile or deployment script needs.
Why this one
- The values everyone actually uses: 755 (rwxr-xr-x) for scripts and directories, 644 (rw-r--r--) for regular files, 700 (rwx------) for private directories like ~/.ssh, 600 (rw-------) for private keys and config secrets, 400 (r--------) for read-only protection, and 777 (rwxrwxrwx) which is almost always a mistake.
- Special bits round-trip exactly: 4755 becomes rwsr-xr-x and back, with lowercase s meaning execute is also set and uppercase S meaning it is not.
- Three synced representations — checkboxes, octal and symbolic — so you can think in whichever notation you already know.
- Errors point at the exact digit or position that failed instead of shrugging.
Frequently asked questions
What does chmod 755 mean?
755 is rwxr-xr-x: the owner can read, write and execute, while the group and everyone else can only read and execute. It is the standard permission for directories and executable scripts on web servers.
What is the difference between 644, 600 and 400?
644 (rw-r--r--) lets the owner edit a file while everyone else just reads it — the default for web content. 600 (rw-------) locks a file to the owner alone, which is what SSH demands for private keys. 400 (r--------) makes a file read-only even for its owner, a cheap guard against accidental edits.
Why is chmod 777 dangerous?
777 gives read, write and execute to absolutely everyone, including untrusted processes and other users on the machine. On a web server that means anyone who compromises any service can rewrite your files. The right value is almost always 755 for directories and 644 for files.
What do setuid, setgid and the sticky bit do?
Setuid (4xxx, shown as s in the owner-execute spot) runs a program with the file owner's rights — passwd uses it to edit /etc/shadow. Setgid (2xxx) does the same for the group, and on directories forces new files to inherit the group. The sticky bit (1xxx, shown as t) on a directory means only a file's owner can delete it — that is what keeps /tmp civilized.
What does the capital S or T mean in ls -l output?
A lowercase s or t means the special bit is set and execute is also allowed. A capital S or T means the special bit is set but execute is not — usually a sign someone set the bits in the wrong order, since setuid without execute rarely makes sense.