chmod Calculator

It starts innocently, the way infrastructure disasters always do: the deploy script cannot write to the uploads folder, the error message says permission denied, and the internet's most dangerous advice is four keystrokes away. chmod -R 777 uploads. It works. The script deploys. You close the laptop and go enjoy your weekend, having just made every file in that directory writable by every user on the machine — including the one that moved in overnight.

Monday arrives as an email from the hosting provider's abuse desk: a process under the nobody user is consuming 400% CPU mining cryptocurrency out of a directory called uploads. The cryptominer did not hack anything clever. It wrote a file into a folder that had been declared writable by all, and the web server — dutifully executing anything in its path — executed it. chmod 777 is not a shortcut past a permissions error; it is the error, installed permanently and recursively.

The chmod arithmetic is famously learnable — read is 4, write is 2, execute is 1, and every mode is three sums — but it is also famously done in a hurry, at the exact moment of maximum frustration, on production. This calculator exists for that moment. Tick the boxes you intend, get the octal mode, decode modes you find in documentation, and see a plain-language warning when you ask for something that should come with a chaperone. The Cron Next Run Checker and SLA Uptime Calculator are its neighbors in the deployment-checklist drawer; this page is where the checklist starts.

Two converters share the page, and both directions matter. Octal to symbolic: paste 755 — or 2775, or 1777, or any three- or four-digit mode — and see it expanded into rwx letters per audience, with a sentence explaining who can do what. Symbolic to octal: tick the read, write and execute boxes for owner, group and others, and get the number to type. Special-mode checkboxes cover setuid, setgid and the sticky bit for the modes that carry a fourth digit.

The opinions are built in, and they are not subtle. Ask for 777 and the tool says what 777 means for you: every account on the machine can replace this file. World-writable directories, setuid on anything you did not deliberately audit, modes odd enough to be typos — each gets a warning in plain English rather than a shrug. A calculator that happily hands you the keys to an accident is not a neutral tool; it is a bad colleague.

Everything is client-side logic — checkboxes, a little arithmetic, some warnings. Nothing to install, nothing to trust with your shell history, nothing that requires the machine you are repairing to be up.

The calculator is self-explanatory after one pass; the steps exist mostly to establish the habit of checking a mode before applying it, which is the entire difference between a boring Tuesday and an incident report.

1. 1

   Start from the mode you have

   Found 640 in a deploy guide? Paste it into the decoder field. Saw rwxr-x--- in ls -l output? Tick the boxes that match the letters, one audience at a time.

2. 2

   Read the expansion

   The output states each audience's permissions in words: owner reads, writes and executes; group reads and executes; others get nothing. If any expansion surprises you, the surprise is the point.

3. 3

   Check the warnings

   World-writable modes, sticky and setuid combinations, and the modes that commonly indicate a typo all trigger commentary. Read it before copying the command.

4. 4

   Compose the command

   Take the octal mode into chmod with a target: chmod 755 deploy.sh. For whole directory trees, use -R deliberately and sparingly — see the practice patterns below.

5. 5

   Verify with ls

   ls -l shows the symbolic form you intended, and the calculator's reverse direction confirms the round trip. Thirty seconds, zero surprises in production.

The octal mode is binary wearing a decimal costume. Nine permission bits — three for owner, three for group, three for others — each carry a value when set: read 4, write 2, execute 1. Sum each triple and you get one digit between 0 and 7; string the three digits together and you have the mode. 7 is 4 + 2 + 1, everything. 5 is 4 + 1, read and execute. 6 is 4 + 2, read and write, the classic file mode. 0 is nothing at all, which is why 600 means 'mine alone' and 700 means 'mine alone, and I can run it.'

The three digit positions are the audiences: first the file's owner, then its group, then everyone else on the system. The audiences are defined by the file itself — who owns it, which group it carries — which is why chmod is only half the story and chown is the other half. A mode of 750 grants the world nothing regardless of who the world is, which is what makes it the safe default for things you intend to share narrowly.

A small set of modes covers almost everything in practice, and recognizing them on sight turns ls -l from wallpaper into information. These are the residents of every Linux system you will ever administer.

Notice the last row's lowercase t — the sticky bit, one of the three special flags that live in the mode's rarely-used fourth digit, covered in full below. It is the reason /tmp works at all: a directory every user may write into, where nobody can delete anybody else's files. Without it, shared writable directories are playground fights.

chmod 777 means read, write and execute for all three audiences, and the middle number does the damage: group-writable plus other-writable means every account on the machine can modify the file. On your personal laptop, where you are the only human account, that is mostly a hygiene issue. On a shared host, a VPS running services under separate users, or any system where a web server runs as nobody or www-data, it is a structural hole: any process can replace the file's contents, and the next process that executes or includes it runs the replacement with whatever privileges it holds.

Nobody chmods most files into existence — the system assigns a mode at creation, guided by a per-process setting called umask. New files start from a base of 666 (nobody needs the execute bit by default) and new directories from 777 (directories need traversal). The umask then clears bits from that base: it is a mask of what to remove, applied with a bitwise AND NOT rather than subtraction — a distinction that matters exactly once and then saves you forever.

The classic trap: with umask 077, subtracting naively gives 666 − 077 = 577, which would be an executable monstrosity. Masking gives the correct answer: 666 with all group and other bits cleared is 600 — owner read-write, nobody else anything. The bits are flags, not quantities, and the arithmetic follows them. The calculator's umask table applies the real operation so you can see both the results and the trap side by side.

Check yours with the umask command — no arguments, it prints the current value. Set it for one shell with 'umask 027', or permanently in .bashrc, .profile or the system-wide defaults depending on how far the policy needs to travel. Pair it with the ENV File Validator when you are locking down a deployment that carries secrets, and your new files stop being a source of quiet exposure.

Modes sometimes arrive with a fourth digit, and it is not a typo — it encodes three special flags worth 4, 2 and 1, prepended to the ordinary three. Setuid (4) makes an executable run with its file owner's privileges regardless of who launched it; the canonical example is /usr/bin/passwd at mode 4755, root-owned, which is how ordinary users are allowed to edit their own entries in /etc/shadow through a carefully controlled channel instead of being granted the file itself.

Setgid (2) does the same for group, and on directories it does something distinct and beloved by teams: new files created inside a setgid directory inherit the directory's group rather than the creator's primary group. A shared project directory at mode 2775 means every file anyone drops belongs to the team group automatically, without a chmod ritual after every save. The sticky bit (1) rounds out the trio — on writable directories it restricts deletion to each file's owner, which is precisely how /tmp achieves anarchy without homicide: mode 1777, shown in ls -l as rwxrwxrwt with a lowercase t in the final position.

• setuid on a binary: runs as the file's owner — audit every instance you find
• setuid on scripts: ignored or refused by modern systems, a fossil of older Unix
• setgid on a directory: group inheritance for team shares — 2775 is the workhorse
• sticky on a writable directory: deletion restricted to owners — 1777 for shared scratch space
• ls -l shows them as s, s and t in the execute positions; capital S or T means the underlying execute bit is missing, almost always a misconfiguration

Real systems converge on a small set of incantations, and typing them beats inventing them under pressure. The code block below is the sane core of web-deployment permission work — study it, run it on a copy first, and adjust ownership before ever loosening modes.

# directories traversable, files readable, nothing world-writable
chmod -R u+rwX,go+rX,go-w /var/www/app

# private key material: owner only, always
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519

# shared team project directory with group inheritance
chgrp -R devs /srv/project
chmod -R 2775 /srv/project

# the uploads directory the web server must write into
chown www-data:www-data /var/www/app/uploads
chmod 755 /var/www/app/uploads

The capital X in the first command is the subtle one: unlike lowercase x, it grants execute only to directories and to files that already have an execute bit set somewhere — so 'chmod -R u+rwX' recursively fixes a whole tree without accidentally making every CSS file executable. That single letter distinction has saved more Sunday afternoons than any backup software.

The permission bits live in the filesystem's metadata, which means filesystems without that metadata ignore chmod completely. FAT32, exFAT and NTFS mounts accept the command, return success, and change nothing — the kernel invents one fixed mode for the whole mount from options like fmask, dmask and umask at mount time. If chmod on a USB stick does nothing, that is not a bug in your afternoon; it is a filesystem from a world without users and groups.

Other limits are quieter. Access control lists — getfacl and setfacl territory — layer fine-grained per-user rules on top of the nine bits, and a single ACL entry can grant access that the mode bits claim to forbid; an audit that reads only ls -l will misread an ACL-protected tree. Root, on most systems, overrides the mode bits outright. And filesystems mounted from network servers may remap or squash identities — NFS's root_squash famously turns root into nobody, which is the opposite of a privilege and occasionally exactly what you want.

The honest answer is everyone at the start of a systems career, and everyone sensible at 2 a.m. Students preparing for the RHCSA or LFCS certifications convert modes constantly, and getting the octal-symbolic round trip fluent is half the exam's permission questions. Junior administrators inheriting their first production server decode the modes they find before changing them — the calculator's warnings have caught more than one inherited 777 that predated the current team by three predecessors.

Web developers deploying their first VPS are the biggest group by volume, because they meet permissions exactly once, at the worst possible moment, with a tutorial open that confidently recommends 777 and a comments section below it filled with people saying never do that. Security auditors round out the crowd, using the calculator as a documentation aid when writing findings: mode 1777 is a fact, mode 666 on a configuration file is a finding, and the difference is a sentence the tool helps you write precisely.

Permissions, cron schedules, and uptime commitments are the three numbers a deployment either gets right or explains later. This page handles the first; the Cron Next Run Checker answers 'when will this actually fire' for the second; and the SLA Uptime Calculator translates the third into minutes your stakeholders can feel. Run all three before the weekend, and the abuse desk can spend its Monday on someone else.