Chmod Calculator

Every file has an owner, a group and a mode. The mode gives three permissions to each of three classes — nine bits — and right after the file-type character, ls -l prints exactly those nine characters.

-rw-r--r-- is a file (-) whose owner may read and write, and whose group and everyone else may only read: mode 644. drwxr-xr-x is a directory (d) at 755. The first character is the type: - a file, d a directory, l a symlink, and b, c, p or s for the special kinds. Paste any of those lines into the calculator and it reads the mode and the type out of it.

On a directory the three permissions mean something different from a file. Read lets you list the names in it. Execute lets you go into it and reach the files you already know the names of. Write, together with execute, lets you create and delete entries — which is why deleting a file depends on the directory's permissions, not the file's. A directory with read but no execute is a directory you can list and not open.

644 for files, 755 for directories and for anything that has to run. The only difference is the execute bit.

644 is rw-r--r--: the owner can change it, everyone can read it, nobody can run it. That is right for HTML, CSS, images, configuration and source files. 755 is rwxr-xr-x: the same, plus the execute bit for all three classes. A directory needs it or nobody can enter the directory, and a script needs it or the shell will refuse to run it.

The mistake worth avoiding is chmod -R 755 over a whole site, which makes every image and every .php file executable. The two find commands the calculator writes give directories and files different modes in one pass, with the modes you actually chose rather than a pair from a blog post.

OpenSSH refuses to use a private key that anyone but its owner can read. Set the key to 600 and the .ssh directory to 700.

The exact message is Permissions 0644 for '<path>' are too open., followed by It is required that your private key files are NOT accessible by others. The test behind it is blunt: if you own the file and any group or other bit is set, the key is refused. That is why 640 fails too, and why 600 is the answer rather than "a bit less than 644".

chmod 600 ~/.ssh/id_ed25519 and chmod 700 ~/.ssh fix it. The public key may be readable by anyone — only the private key and the directory matter here. Pick SSH key under the common modes above and the calculator writes both commands for you.

The fourth digit. On a file, setuid and setgid change which account a program runs as. On a directory, setgid decides the group of new files and the sticky bit decides who may delete them.

Setuid (4000) on an executable makes it run as the file's owner rather than as you — passwd is installed setuid so that it can run with root's rights when you change your password. Setgid (2000) does the same for the group. On a directory, setgid does something different and much more useful: new files inside inherit the directory's group instead of the creator's, which is how a shared project folder stays shared. Linux documents no meaning for the setuid bit on a directory; on macOS and the BSDs it can make new files take the directory's owner, if the filesystem was mounted with that option.

The sticky bit (1000) on a directory stops people deleting each other's files: only the file's owner, the directory's owner or root may remove or rename an entry. /tmp is mode 1777 for exactly that reason — everyone may write in it, nobody may delete anyone else's work. On a regular file macOS and the BSDs ignore the sticky bit, and GNU's manual gives it a meaning there only on some older systems. One trap: chmod 755 somedir — or chmod 0755 somedir — does not clear a setgid bit that is already on a directory, because GNU chmod deliberately keeps them with any numeric mode of fewer than five digits — POSIX only requires the octal form to clear them on a regular file. Use g-s, or the five-digit chmod 00755, and the calculator writes the five-digit form for you whenever that is what you need.

ls -l shows them as letters and stat shows them as a number. Paste either into the calculator and it reads the mode back.

ls -l file prints -rw-r--r-- 1 you staff 4096 25 Oct 09:26 file, and the calculator takes the whole line — you do not have to pick the mode out of it. stat -c '%a %n' file prints 644 file on Linux; on macOS the same thing is stat -f '%Lp %N' file. For a whole directory at once, GNU find . -maxdepth 1 -printf '%m %p\n' lists every mode as a number (macOS's find has no -printf).

A + at the end of the permission string means there is more than the nine bits: on Linux it is a POSIX ACL, which getfacl shows, and those extra entries are not in the mode at all. On macOS a @ means extended attributes and a + means extended security information. With GNU ls, a dot (.) means a security context, such as SELinux's. The calculator accepts all three markers and tells you the mode is only part of the story.