Chmod Calculator — Octal, Symbolic and ls -l

Background.

Unix permissions are three sets of three bits plus three special bits, and almost every mistake people make with them comes from one of two places: forgetting that the octal digits are a sum rather than a code, or forgetting that the letters in an ls listing are not a straight rendering of those bits. This calculator handles both directions. Tick the boxes and it gives you the number to type; paste in a number and it tells you what it will do.

The octal side is the easy half. Each digit is read plus write plus execute, worth 4, 2 and 1 — so 7 is all three, 5 is read and execute, 6 is read and write, and 755 means the owner gets everything while group and others get read and execute. Those weights are not convention, they are the values POSIX assigns to the bits themselves: S_IRUSR is 0400, S_IWUSR is 0200, S_IXUSR is 0100, and so on down through the group and other triads. A fourth, leading digit carries the three special bits: 4000 for set-user-ID, 2000 for set-group-ID, 1000 for the restricted deletion flag most people call the sticky bit.

The symbolic side is where tools quietly disagree with reality. The execute column of each triad is overloaded: it shows the special bit when one is set, and its case tells you whether the underlying execute bit is on. POSIX spells this out for ls — a lower-case s in the owner triad means the file is executable and set-user-ID is set, while an upper-case S means set-user-ID is set and the file is not executable. The same distinction applies to t and T in the others triad. So 4755 renders as rwsr-xr-x but 4644 renders as rwSr--r--, and the capital letter is a warning sign: a setuid bit on a non-executable file does nothing at all. Plenty of chmod tools print lower case regardless. This one does not.

The special bits are also the ones worth understanding rather than copying. Set-user-ID on a program makes it run with its owner's privileges instead of the caller's, which is the entire reason a normal user can change their own password. Set-group-ID on a directory makes every new entry inherit the directory's group rather than the creator's, which is what makes a shared project directory actually shared. The restricted deletion flag on a world-writable directory stops one user deleting another's files, which is what makes /tmp workable. POSIX defines the last of those only for directories, so this page reports it honestly rather than inventing a meaning for it on files.

Finally, note the boundary of the mode word. It is twelve bits and nothing more. Access control lists, SELinux labels, Linux capabilities and filesystem attribute flags all live outside it and can grant or deny access regardless of what these bits say — if a chmod appears to have no effect, that is usually why. Everything on this page is sourced to IEEE Std 1003.1-2024, the current POSIX standard, and the specific pages are cited below.

What is chmod calculator?

A Unix file mode is a twelve-bit value attached to every file and directory. The low nine bits are three groups of three: read, write and execute for the owner, for members of the file's group, and for everyone else. The top three are special bits: set-user-ID on execution (04000), set-group-ID on execution (02000), and S_ISVTX (01000), which POSIX defines as the restricted deletion flag on directories. Because the bit values are powers of two within each triad — 4 for read, 2 for write, 1 for execute — each triad reads naturally as a single octal digit, and the whole mode reads as three or four octal digits. That is the number chmod takes. The same mode is displayed a second way in the first field of an ls -l line: an entry-type character followed by nine characters, in which a set bit shows its letter and a clear bit shows a dash, except that the execute position of each triad also encodes the corresponding special bit as s, S, t or T. On a directory the three permissions mean something different from a file: read allows listing the names inside, write allows creating and deleting entries, and execute allows traversing into it and reaching named entries. That difference is why a directory almost always needs the execute bit wherever it has the read bit, and why 644 on a directory is nearly useless.

How to use this calculator.

1. 01Pick a direction. 'Tick boxes' builds a mode from permissions and gives you the number; 'octal number' decodes a number you already have. The half of the form you are not using is ignored, so you never have to clear it.
2. 02Say whether the target is a file or a directory. It changes the ls entry-type character and, more importantly, changes what read, write and execute actually mean and what the special bits do.
3. 03In tick-box mode, set the nine permission switches. Remember that on a directory you almost always want execute wherever you have read, because without execute the directory cannot be traversed.
4. 04Set the special bits only if you mean them. setuid and setgid on a program are a privilege escalation surface; setgid on a directory is usually what you actually want for shared group work; the restricted deletion flag belongs on world-writable directories.
5. 05In octal mode, type three or four digits. A leading zero is optional. If you paste something that is not octal — a symbolic string, or a digit 8 or 9 — the calculator will say so rather than guess.
6. 06Read the symbolic output and check the letter case in the execute columns. An upper-case S or T means you have set a special bit on something that has no execute bit to go with it, which is almost always a mistake.

The formula.

Every permission is one bit, and POSIX assigns each bit an octal value in <sys/stat.h>. For the owner: S_IRUSR is 0400, S_IWUSR is 0200, S_IXUSR is 0100. For the group: 040, 020, 010. For everyone else: 04, 02, 01. Add together the bits you want and you have the mode. Because the three values in each triad are 4, 2 and 1, their sum can never carry into the next triad, so each triad is exactly one octal digit and the whole thing reads off cleanly as 755 or 640 or 600.

The special bits sit above them: 04000 for set-user-ID, 02000 for set-group-ID, 01000 for S_ISVTX. They form the fourth digit, which is why chmod 2775 and chmod 0775 differ in exactly one bit. chmod's own specification describes the octal operand as setting the corresponding permission bit for each bit set in the number and clearing everything else — which is the reason chmod 755 is an assignment, not an addition, and why it can silently remove a special bit you had set. Use the symbolic form (chmod g+s) when you want to add without disturbing the rest.

Rendering the symbolic string is where the subtlety lives. The first two characters of each triad are simply r or w or a dash. The third is the execute column, and it carries two pieces of information at once. If no special bit applies it is x or a dash. If the corresponding special bit is set, it becomes a letter instead — s for the owner and group triads, t for the others triad — and the case of that letter reports the execute bit: lower case when execute is also set, upper case when it is not. POSIX's ls specification gives both cases explicitly. So 4755 is rwsr-xr-x, 4644 is rwSr--r--, 1777 is rwxrwxrwt and 1666 is rw-rw-rwT.

Decimal conversion is the same number in another base: 0755 is 7×64 + 5×8 + 5 = 493, and 02775 is 2×512 + 7×64 + 7×8 + 5 = 1533. That is the value a program sees in st_mode once the file-type bits above the mode word are masked away, and it is what you would pass to a chmod() system call written in C or to os.chmod in Python — which is exactly why a Python script that writes os.chmod(path, 755) sets a mode of 0o1363 rather than rwxr-xr-x.

The complementary umask is the bitwise inverse of the low nine bits, because a umask names the bits to remove rather than the bits to keep — POSIX describes the octal form of umask as setting the specified bits in the file mode creation mask. Complementing 755 gives 022, and complementing 700 gives 077. One caveat worth knowing: a umask can only take permissions away from the base mode the operating system starts with, which is 0777 for directories and 0666 for regular files. That is why no umask can make a newly created file executable, and why 022 produces 755 directories but 644 files.

A worked example.

Frequently asked questions.

References& sources.

1. [1]The Open Group / IEEE. IEEE Std 1003.1-2024, Base Specifications Issue 8 — <sys/stat.h>. Source of every bit value used on this page: S_ISUID 04000 'Set-user-ID on execution', S_ISGID 02000 'Set-group-ID on execution', S_ISVTX 01000 'On directories, restricted deletion flag', S_IRUSR 0400, S_IWUSR 0200, S_IXUSR 0100, S_IRGRP 040, S_IWGRP 020, S_IXGRP 010, S_IROTH 04, S_IWOTH 02, S_IXOTH 01.
2. [2]The Open Group / IEEE. IEEE Std 1003.1-2024 — chmod utility. Source of the octal-operand rule quoted on this page: 'For each bit set in the octal number, the corresponding file permission bit shown in the following table shall be set; all other file permission bits shall be cleared', together with the symbolic-mode definitions of the who symbols u, g, o and a and the perm symbols r, w, x, s and t.
3. [3]The Open Group / IEEE. IEEE Std 1003.1-2024 — ls utility. Source of the symbolic rendering rules, including the entry-type character ('d Directory ... - Regular file') and the special-bit substitutions: 'S If in <owner permissions>, the file is not executable and set-user-ID mode is set. s If in <owner permissions>, the file is executable and set-user-ID mode is set', and the equivalent T and t rules for the restricted deletion flag in the other-permissions field.
4. [4]The Open Group / IEEE. IEEE Std 1003.1-2024 — umask utility. Source of the complementary-umask output: 'In the octal integer form of mode, the specified bits are set in the file mode creation mask', i.e. the bits named in a umask are the bits cleared from newly created files.