Chmod Calculator (Octal, Symbolic & Umask)

About this tool

This chmod calculator converts Unix file permissions between the three ways you meet them: checkboxes for owner, group and others, an octal number such as 755, and the symbolic string rwxr-xr-x that ls -l prints. Change any one and the other two follow. Unlike most permission calculators it also handles the three special bits (setuid, setgid and the sticky bit), shows the s, S, t and T letters they produce, writes the matching chmod commands, applies symbolic changes such as g+w,o-rwx, and works out what a umask does to new files and directories. Everything runs in your browser.

How to use the chmod calculator

1. Enter a mode in whichever form you have: type an octal number (one to four digits), paste a symbolic string from ls -l (with or without the leading - or d), tick the checkboxes, or click a preset.
2. Choose file or directory. The ls -l line and the directory notes depend on it.
3. Copy a command. The numeric and symbolic commands set exactly the same mode, so use whichever your script or team prefers.
4. Optionally apply a change like u+x or go-w to the current mode, or enter your umask to see the default modes for new files and directories.

How chmod numbers work

Each class of user (the file's owner, its group, and everyone else) gets one octal digit. The digit is the sum of read (4), write (2) and execute (1), so 7 is rwx, 5 is r-x and 4 is r--. An optional fourth digit in front holds the special bits: 4 for set-user-ID, 2 for set-group-ID and 1 for the restricted deletion flag, better known as the sticky bit. The GNU coreutils manual on numeric modes lists the same values, and the POSIX chmod specification defines them as S_ISUID (4000), S_ISGID (2000) and S_ISVTX (1000). Leading digits you leave out count as zeros, so chmod 55 means 0055.

On a directory, read lets you list the names inside, write lets you create, delete and rename entries, and execute (search) lets you enter it and reach the files inside.

Reading s, S, t and T

The special bits do not get their own column in ls -l. They replace the execute letter of a class, following the rules in the POSIX ls specification: s in the owner or group position means setuid or setgid is set and that class can also execute; S means the special bit is set but execute is not. In the others position, t means the sticky bit plus execute for others, and T means the sticky bit without it. An uppercase letter on a program is usually a mistake, because the bit has nothing to act on.

What the special bits do

• Setuid (4000) on an executable makes it run with the privileges of the file's owner rather than the user who started it.
• Setgid (2000) on an executable runs it with the file's group. On a directory, the GNU manual notes that on most systems new files inside inherit the directory's group (and new subdirectories inherit the setgid bit), which is why shared project folders use 2775.
• Sticky bit (1000) on a directory stops users from deleting or renaming files they do not own, even though the directory is writable. That is how /tmp can be 1777 safely.

One GNU detail catches people out: on a directory, chmod leaves the setuid and setgid bits alone unless you mention them. chmod 755 dir, chmod 0755 dir and chmod u=rwx,go=rx dir all keep an existing setgid bit. To clear it, the GNU manual on directory set-ID bits says to use five or more octal digits (chmod 00755 dir), an operator mode such as =755, or a symbolic mode such as g-s. This is a GNU extension, so the tool shows that form whenever you pick a directory, and the symbolic change box below follows the same rule.

How umask works

A umask lists the permission bits to withhold from new files. Programs usually request 666 for a new file and 777 for a new directory, and the kernel turns off every bit that is set in the umask. The Linux umask(2) manual gives the classic case: 0666 & ~022 = 0644. So a umask of 022 gives files 644 and directories 755, while 077 gives 600 and 700. The POSIX umask utility also defines umask -S, which prints the permissions that remain allowed, such as u=rwx,g=rx,o=rx for 022.

Worked example

The calculator opens on 755. The digits are 7 (4+2+1, rwx) for the owner and 5 (4+1, r-x) for group and others, so the tool shows:

Octal             0755
Symbolic          rwxr-xr-x
ls -l shows       -rwxr-xr-x
Numeric command   chmod 755 file
Symbolic command  chmod u=rwx,g=rx,o=rx file

Click the 2775 preset and the type switches to directory. The leading 2 adds setgid, which replaces the group's x with s: drwxrwsr-x, set with chmod 2775 dir or chmod u=rwx,g=rwxs,o=rx dir.

Common mistakes

• Using chmod 777 to fix a "permission denied" error. It lets every account on the machine change or replace the file. Fixing ownership with chown, or granting group access with 775 or 664, is almost always the better fix.
• Giving files the execute bit by running chmod -R 755 on a whole tree. Directories need execute; most files do not.
• Forgetting execute on a directory. With 644 on a directory, users can see names but cannot open anything inside.
• Expecting chmod 755 to clear setgid on a directory. With GNU chmod it does not, as explained above.
• Setting setuid on a file that is not executable, which ls -l shows as a capital S.

Use cases

• Making a script runnable, locking down an SSH key, or preparing a web upload folder.
• Setting up shared team directories with setgid, or a world-writable drop folder with the sticky bit.
• Translating ls -l output from a bug report into a command you can run.
• Picking a umask for a server account or a container image.

Need to see the bits behind each digit? The Binary & Hex Converter converts octal, binary and hex. For scheduling the scripts you just made executable, try the Cron Expression Generator.

Related reading

For a longer explanation, read our guide: chmod 777, 755 and 644 explained.