chmod Permission Calculator

What is a chmod calculator?#

chmod is the Unix command that sets the read, write and execute permissions on a file or directory. Its permission model is three groups — owner, group, other — each with three on/off bits: read (4), write (2), execute (1), which sum to a single digit from 0 to 7. Stack the three digits and you get the octal mode you type at the command line: 755 means “owner read+write+execute (7), group read+execute (5), other read+execute (5)”. There is also an optional fourth special prefix digit for setuid, setgid and the sticky bit.

The reason a calculator is genuinely useful here is the three-way equivalence between the permission matrix (the checkboxes you tick in a file manager), the octal number (755), and the symbolic string (rwxr-xr-x, what ls -l prints). Most people learn one of these representations well and stumble over the other two. This page keeps all three in sync: change any one and the other two update instantly, and the matching chmod command line is assembled for you.

That matters because a wrong permission bit is one of the most common ways to break a deployment — a directory the web server cannot read, a private key that is too open and gets rejected by SSH, an executable that lost its x bit. Reading 755 and knowing it means “world-readable, group and other can traverse but not write” is a skill this tool trains by showing the translation live.

How to use it#

1. Work from whichever representation you already have:
   • Tick the checkboxes in the permission matrix (3 rows: owner/group/other, 3 columns: read/write/execute). The Digit column on the right of each row shows that group’s 0–7 value as you tick.
   • Or type an Octal value (1–4 digits, 0o prefix accepted, e.g. 755, 0644, 0o600).
   • Or type a Symbolic value (rwxr-xr-x, the comma form rwx,r-x,r-x, or a chmod clause like u=rw,go=r).
2. If you need special bits, tick setuid, setgid, or sticky in the Special bits fieldset. These occupy the execute slot of their owner in the symbolic form: s/S for setuid/setgid, t/T for sticky.
3. Read the result card:
   • The assembled command line, $ chmod <octal> file, ready to copy.
   • The symbolic form, e.g. u=rwx,go=rx.
   • A per-group breakdown showing each who’s digit and their read/write/execute grants.
4. Click Copy to grab the command line.
5. The status line confirms the parse or reports whether an octal or symbolic input was invalid.

Key features#

• Three-way live sync. Matrix, octal and symbolic all update each other, so you can enter what you know and read what you need.
• Special bits done right. setuid, setgid and the sticky bit are handled losslessly, including the lowercase/uppercase execute-slot notation (s vs S, t vs T) that ls uses.
• Canonical 4-digit octal. Output is always 4 digits (0755, 4755, 0000), matching how chmod and stat display modes — never an ambiguous 3-digit form when special bits are set.
• Clause-form symbolic. Emits the absolute-assignment form a shell accepts (u=rw,go=rx), merging identical adjacent groups for brevity, and appends special bits as u+s / g+s / +t.
• Lenient input parsing. Accepts 755, 0644, 0o600, the 9-char picture, the comma-separated variant, and chmod clauses (u=rwx,go=rx, u+rwx,go-w).

Worked example#

The most common mode on a deployed web directory. Type 755 into the Octal field. The matrix ticks owner read+write+execute, group read+execute, other read+execute; the symbolic field shows rwxr-xr-x; and the result card reads:

$ chmod 755 file
Symbolic: u=rwx,go=rx

with the breakdown listing owner 7 (read, write, execute), group 5 (read, execute), other 5 (read, execute). That is the standard mode for directories and executable scripts: the owner can do everything, everyone else can read and traverse but not modify.

Now contrast it with 644 — the safe mode for a regular served file. The symbolic becomes rw-r--r--, and the command is $ chmod 644 file: the owner can read and write, group and other can read only, and crucially nobody has execute (so a downloaded file will not accidentally run). For a private SSH key, you would type 600 (rw-------), the only mode ssh will accept.

A special-bit example: a binary that must run with its owner’s privileges. Type 4755 and the symbolic slot becomes rwsr-xr-x — note the s in the owner’s execute position, marking setuid. The command line reads $ chmod 4755 file, and the leading 4 is the special prefix digit (setuid = 4) that the 3-digit form cannot express — which is exactly why this tool always emits four digits.

FAQ#

What is the difference between 755 and 0755?#

On the command line they are equivalent — chmod 755 and chmod 0755 produce the same mode, because the leading 0 simply means “no special bits”. This tool always displays four digits (0755) so the special-bit position is visible and consistent with how stat and ls report modes. When you copy the command line, the conventional $ chmod 755 file form is used because that is what people type.

What do s, S, t, and T mean in the symbolic output?#

They are the special bits occupying an execute slot. Lowercase s (in owner or group position) means setuid/setgid and execute is on; uppercase S means the bit is set but execute is off. Lowercase t (in the other position) means sticky and execute on; uppercase T means sticky set, execute off. This uppercase-means-no-execute convention is how ls distinguishes the two states without an extra column.

Should I use octal or symbolic when I actually run chmod?#

Either works, but they behave differently. Octal (chmod 755 file) sets the mode absolutely — every bit is set to exactly what you typed. Symbolic (chmod u+x file) edits the current mode — it only changes the bits you mention and leaves the rest alone. Use octal when you want a known final state (deploy scripts, Dockerfiles); use symbolic when you want to nudge one permission without disturbing others.

Why does SSH refuse my private key with a “bad permissions” error?#

Because ssh requires private keys to be mode 0600 (read/write owner only) and will reject anything more open as insecure. If your key is 0644 or has group/other write, ssh treats it as tamperable and refuses to use it. Set it with $ chmod 600 id_ed25519 and the error goes away. You can verify the exact mode here before running the command.