ChmodCalc

Chmod Calculator

Tick the nine boxes and everything else follows: the octal mode, the rwxr-xr-x string, the command you can paste, and the list of programs that will refuse the mode you have just built — each one quoted from its own source code, with the file and function named.

chmod — file mode
whoreadwriteexecutedigit
Owner6
Group4
Others4
special bits — the fourth digit

ls -l → -rw-r--r--

chmod 644 /var/www/html/index.html
chmod u=rw,g=r,o=r /var/www/html/index.html

Absolute symbolic form — identical result, and the only form that can name the setuid, setgid and sticky bits.

what 644 grants on this file

  • Ownerrw-read the contents and change the contents
  • Groupr--read the contents
  • Othersr--read the contents

programs that refuse this mode

  • OpenSSH client (ssh, scp, sftp, git over ssh)

    Permissions 0644 for '/var/www/html/index.html' are too open.

    fix: chmod 600 /var/www/html/index.html

  • Git

    hint: The '/var/www/html/index.html' hook was ignored because it's not set as executable.

    fix: chmod +x /var/www/html/index.html

  • Any POSIX shell (bash, dash, zsh, sh)

    /var/www/html/index.html: Permission denied (exit status 126)

    fix: chmod +x /var/www/html/index.html

Reading a mode in ten seconds

A Unix file mode is twelve bits. Nine of them are the familiar grid: three classes of user — the owner, the owning group, and everybody else — each with read, write and execute. Three more sit in front of those and change how a program is run, not who may run it. Octal notation exists because three bits fit exactly into one octal digit, so each digit describes one class completely and independently of the others.

Inside a digit, read is 4, write is 2, execute is 1, and you add the ones you want. There are only eight combinations, so the whole of octal permission notation is this table — and the second column, the one about directories, is where almost all real confusion lives:

What one octal digit grants. The file and directory columns are genuinely different rules, not two phrasings of the same rule.
Digit Bits On a regular file, this class can… On a directory, this class can…
0 --- nothing at all nothing at all
1 --x run it, but not read it — possible for a compiled binary, useless for a shell script, which the shell must read to interpret reach a name you already know inside it, but never list what is there
2 -w- overwrite the contents without being able to read them back nothing — creating an entry requires resolving the directory first, and that needs the search bit
3 -wx write and run, but not read create, delete and rename entries whose names you already know; still cannot list them
4 r-- read the contents list the names and nothing else: ls prints them, and every one of them fails to stat
5 r-x read and run — the normal mode for a script or binary list and enter — the normal mode for a directory
6 rw- read and overwrite list the names, and nothing more — the write bit is inert without the search bit, so this behaves exactly like 4
7 rwx read, overwrite and run list, enter, create, delete and rename

Look at two rows. Digit 4 on a directory gives read without search: ls prints the names and then every single one of them fails, because listing a directory and reaching an entry inside it are separate permissions. And digit 2 on a directory gives write without search, which grants nothing whatsoever — you cannot create an entry in a directory you cannot resolve. Those two are why "I gave it write and it still says permission denied" is such a common sentence.

All 512 modes, not the usual dozen

A cheat-sheet tells you about the modes somebody chose to include and nothing about the rest. The table below is the entire three-digit space — 512 rows, 000 through 777, generated by iterating the mode space at build time and rendered through the same functions the calculator above uses. It cannot disagree with the tool, and it cannot have a typo in row 349, because nobody typed row 349.

A few counts that only fall out once you have the whole space: 8 of 512 modes grant nothing at all outside the owner, which is exactly the set OpenSSH will accept for a private key. 256 of 512 are writable by every account on the machine. And 8 of 512 pass the mode test cronie applies to a crontab file — a much narrower opening than most people expect, and one that excludes 700.

0xx — 64 modes where the owner can nothing
Octal Symbolic Owner Group Others
000 --------- nothing nothing nothing
001 --------x nothing nothing run
002 -------w- nothing nothing write
003 -------wx nothing nothing write, run
004 ------r-- nothing nothing read
005 ------r-x nothing nothing read, run
006 ------rw- nothing nothing read, write
007 ------rwx nothing nothing read, write, run
010 -----x--- nothing run nothing
011 -----x--x nothing run run
012 -----x-w- nothing run write
013 -----x-wx nothing run write, run
014 -----xr-- nothing run read
015 -----xr-x nothing run read, run
016 -----xrw- nothing run read, write
017 -----xrwx nothing run read, write, run
020 ----w---- nothing write nothing
021 ----w---x nothing write run
022 ----w--w- nothing write write
023 ----w--wx nothing write write, run
024 ----w-r-- nothing write read
025 ----w-r-x nothing write read, run
026 ----w-rw- nothing write read, write
027 ----w-rwx nothing write read, write, run
030 ----wx--- nothing write, run nothing
031 ----wx--x nothing write, run run
032 ----wx-w- nothing write, run write
033 ----wx-wx nothing write, run write, run
034 ----wxr-- nothing write, run read
035 ----wxr-x nothing write, run read, run
036 ----wxrw- nothing write, run read, write
037 ----wxrwx nothing write, run read, write, run
040 ---r----- nothing read nothing
041 ---r----x nothing read run
042 ---r---w- nothing read write
043 ---r---wx nothing read write, run
044 ---r--r-- nothing read read
045 ---r--r-x nothing read read, run
046 ---r--rw- nothing read read, write
047 ---r--rwx nothing read read, write, run
050 ---r-x--- nothing read, run nothing
051 ---r-x--x nothing read, run run
052 ---r-x-w- nothing read, run write
053 ---r-x-wx nothing read, run write, run
054 ---r-xr-- nothing read, run read
055 ---r-xr-x nothing read, run read, run
056 ---r-xrw- nothing read, run read, write
057 ---r-xrwx nothing read, run read, write, run
060 ---rw---- nothing read, write nothing
061 ---rw---x nothing read, write run
062 ---rw--w- nothing read, write write
063 ---rw--wx nothing read, write write, run
064 ---rw-r-- nothing read, write read
065 ---rw-r-x nothing read, write read, run
066 ---rw-rw- nothing read, write read, write
067 ---rw-rwx nothing read, write read, write, run
070 ---rwx--- nothing read, write, run nothing
071 ---rwx--x nothing read, write, run run
072 ---rwx-w- nothing read, write, run write
073 ---rwx-wx nothing read, write, run write, run
074 ---rwxr-- nothing read, write, run read
075 ---rwxr-x nothing read, write, run read, run
076 ---rwxrw- nothing read, write, run read, write
077 ---rwxrwx nothing read, write, run read, write, run
1xx — 64 modes where the owner can run
Octal Symbolic Owner Group Others
100 --x------ run nothing nothing
101 --x-----x run nothing run
102 --x----w- run nothing write
103 --x----wx run nothing write, run
104 --x---r-- run nothing read
105 --x---r-x run nothing read, run
106 --x---rw- run nothing read, write
107 --x---rwx run nothing read, write, run
110 --x--x--- run run nothing
111 --x--x--x run run run
112 --x--x-w- run run write
113 --x--x-wx run run write, run
114 --x--xr-- run run read
115 --x--xr-x run run read, run
116 --x--xrw- run run read, write
117 --x--xrwx run run read, write, run
120 --x-w---- run write nothing
121 --x-w---x run write run
122 --x-w--w- run write write
123 --x-w--wx run write write, run
124 --x-w-r-- run write read
125 --x-w-r-x run write read, run
126 --x-w-rw- run write read, write
127 --x-w-rwx run write read, write, run
130 --x-wx--- run write, run nothing
131 --x-wx--x run write, run run
132 --x-wx-w- run write, run write
133 --x-wx-wx run write, run write, run
134 --x-wxr-- run write, run read
135 --x-wxr-x run write, run read, run
136 --x-wxrw- run write, run read, write
137 --x-wxrwx run write, run read, write, run
140 --xr----- run read nothing
141 --xr----x run read run
142 --xr---w- run read write
143 --xr---wx run read write, run
144 --xr--r-- run read read
145 --xr--r-x run read read, run
146 --xr--rw- run read read, write
147 --xr--rwx run read read, write, run
150 --xr-x--- run read, run nothing
151 --xr-x--x run read, run run
152 --xr-x-w- run read, run write
153 --xr-x-wx run read, run write, run
154 --xr-xr-- run read, run read
155 --xr-xr-x run read, run read, run
156 --xr-xrw- run read, run read, write
157 --xr-xrwx run read, run read, write, run
160 --xrw---- run read, write nothing
161 --xrw---x run read, write run
162 --xrw--w- run read, write write
163 --xrw--wx run read, write write, run
164 --xrw-r-- run read, write read
165 --xrw-r-x run read, write read, run
166 --xrw-rw- run read, write read, write
167 --xrw-rwx run read, write read, write, run
170 --xrwx--- run read, write, run nothing
171 --xrwx--x run read, write, run run
172 --xrwx-w- run read, write, run write
173 --xrwx-wx run read, write, run write, run
174 --xrwxr-- run read, write, run read
175 --xrwxr-x run read, write, run read, run
176 --xrwxrw- run read, write, run read, write
177 --xrwxrwx run read, write, run read, write, run
2xx — 64 modes where the owner can write
Octal Symbolic Owner Group Others
200 -w------- write nothing nothing
201 -w------x write nothing run
202 -w-----w- write nothing write
203 -w-----wx write nothing write, run
204 -w----r-- write nothing read
205 -w----r-x write nothing read, run
206 -w----rw- write nothing read, write
207 -w----rwx write nothing read, write, run
210 -w---x--- write run nothing
211 -w---x--x write run run
212 -w---x-w- write run write
213 -w---x-wx write run write, run
214 -w---xr-- write run read
215 -w---xr-x write run read, run
216 -w---xrw- write run read, write
217 -w---xrwx write run read, write, run
220 -w--w---- write write nothing
221 -w--w---x write write run
222 -w--w--w- write write write
223 -w--w--wx write write write, run
224 -w--w-r-- write write read
225 -w--w-r-x write write read, run
226 -w--w-rw- write write read, write
227 -w--w-rwx write write read, write, run
230 -w--wx--- write write, run nothing
231 -w--wx--x write write, run run
232 -w--wx-w- write write, run write
233 -w--wx-wx write write, run write, run
234 -w--wxr-- write write, run read
235 -w--wxr-x write write, run read, run
236 -w--wxrw- write write, run read, write
237 -w--wxrwx write write, run read, write, run
240 -w-r----- write read nothing
241 -w-r----x write read run
242 -w-r---w- write read write
243 -w-r---wx write read write, run
244 -w-r--r-- write read read
245 -w-r--r-x write read read, run
246 -w-r--rw- write read read, write
247 -w-r--rwx write read read, write, run
250 -w-r-x--- write read, run nothing
251 -w-r-x--x write read, run run
252 -w-r-x-w- write read, run write
253 -w-r-x-wx write read, run write, run
254 -w-r-xr-- write read, run read
255 -w-r-xr-x write read, run read, run
256 -w-r-xrw- write read, run read, write
257 -w-r-xrwx write read, run read, write, run
260 -w-rw---- write read, write nothing
261 -w-rw---x write read, write run
262 -w-rw--w- write read, write write
263 -w-rw--wx write read, write write, run
264 -w-rw-r-- write read, write read
265 -w-rw-r-x write read, write read, run
266 -w-rw-rw- write read, write read, write
267 -w-rw-rwx write read, write read, write, run
270 -w-rwx--- write read, write, run nothing
271 -w-rwx--x write read, write, run run
272 -w-rwx-w- write read, write, run write
273 -w-rwx-wx write read, write, run write, run
274 -w-rwxr-- write read, write, run read
275 -w-rwxr-x write read, write, run read, run
276 -w-rwxrw- write read, write, run read, write
277 -w-rwxrwx write read, write, run read, write, run
3xx — 64 modes where the owner can write, run
Octal Symbolic Owner Group Others
300 -wx------ write, run nothing nothing
301 -wx-----x write, run nothing run
302 -wx----w- write, run nothing write
303 -wx----wx write, run nothing write, run
304 -wx---r-- write, run nothing read
305 -wx---r-x write, run nothing read, run
306 -wx---rw- write, run nothing read, write
307 -wx---rwx write, run nothing read, write, run
310 -wx--x--- write, run run nothing
311 -wx--x--x write, run run run
312 -wx--x-w- write, run run write
313 -wx--x-wx write, run run write, run
314 -wx--xr-- write, run run read
315 -wx--xr-x write, run run read, run
316 -wx--xrw- write, run run read, write
317 -wx--xrwx write, run run read, write, run
320 -wx-w---- write, run write nothing
321 -wx-w---x write, run write run
322 -wx-w--w- write, run write write
323 -wx-w--wx write, run write write, run
324 -wx-w-r-- write, run write read
325 -wx-w-r-x write, run write read, run
326 -wx-w-rw- write, run write read, write
327 -wx-w-rwx write, run write read, write, run
330 -wx-wx--- write, run write, run nothing
331 -wx-wx--x write, run write, run run
332 -wx-wx-w- write, run write, run write
333 -wx-wx-wx write, run write, run write, run
334 -wx-wxr-- write, run write, run read
335 -wx-wxr-x write, run write, run read, run
336 -wx-wxrw- write, run write, run read, write
337 -wx-wxrwx write, run write, run read, write, run
340 -wxr----- write, run read nothing
341 -wxr----x write, run read run
342 -wxr---w- write, run read write
343 -wxr---wx write, run read write, run
344 -wxr--r-- write, run read read
345 -wxr--r-x write, run read read, run
346 -wxr--rw- write, run read read, write
347 -wxr--rwx write, run read read, write, run
350 -wxr-x--- write, run read, run nothing
351 -wxr-x--x write, run read, run run
352 -wxr-x-w- write, run read, run write
353 -wxr-x-wx write, run read, run write, run
354 -wxr-xr-- write, run read, run read
355 -wxr-xr-x write, run read, run read, run
356 -wxr-xrw- write, run read, run read, write
357 -wxr-xrwx write, run read, run read, write, run
360 -wxrw---- write, run read, write nothing
361 -wxrw---x write, run read, write run
362 -wxrw--w- write, run read, write write
363 -wxrw--wx write, run read, write write, run
364 -wxrw-r-- write, run read, write read
365 -wxrw-r-x write, run read, write read, run
366 -wxrw-rw- write, run read, write read, write
367 -wxrw-rwx write, run read, write read, write, run
370 -wxrwx--- write, run read, write, run nothing
371 -wxrwx--x write, run read, write, run run
372 -wxrwx-w- write, run read, write, run write
373 -wxrwx-wx write, run read, write, run write, run
374 -wxrwxr-- write, run read, write, run read
375 -wxrwxr-x write, run read, write, run read, run
376 -wxrwxrw- write, run read, write, run read, write
377 -wxrwxrwx write, run read, write, run read, write, run
4xx — 64 modes where the owner can read
Octal Symbolic Owner Group Others
400 r-------- read nothing nothing
401 r-------x read nothing run
402 r------w- read nothing write
403 r------wx read nothing write, run
404 r-----r-- read nothing read
405 r-----r-x read nothing read, run
406 r-----rw- read nothing read, write
407 r-----rwx read nothing read, write, run
410 r----x--- read run nothing
411 r----x--x read run run
412 r----x-w- read run write
413 r----x-wx read run write, run
414 r----xr-- read run read
415 r----xr-x read run read, run
416 r----xrw- read run read, write
417 r----xrwx read run read, write, run
420 r---w---- read write nothing
421 r---w---x read write run
422 r---w--w- read write write
423 r---w--wx read write write, run
424 r---w-r-- read write read
425 r---w-r-x read write read, run
426 r---w-rw- read write read, write
427 r---w-rwx read write read, write, run
430 r---wx--- read write, run nothing
431 r---wx--x read write, run run
432 r---wx-w- read write, run write
433 r---wx-wx read write, run write, run
434 r---wxr-- read write, run read
435 r---wxr-x read write, run read, run
436 r---wxrw- read write, run read, write
437 r---wxrwx read write, run read, write, run
440 r--r----- read read nothing
441 r--r----x read read run
442 r--r---w- read read write
443 r--r---wx read read write, run
444 r--r--r-- read read read
445 r--r--r-x read read read, run
446 r--r--rw- read read read, write
447 r--r--rwx read read read, write, run
450 r--r-x--- read read, run nothing
451 r--r-x--x read read, run run
452 r--r-x-w- read read, run write
453 r--r-x-wx read read, run write, run
454 r--r-xr-- read read, run read
455 r--r-xr-x read read, run read, run
456 r--r-xrw- read read, run read, write
457 r--r-xrwx read read, run read, write, run
460 r--rw---- read read, write nothing
461 r--rw---x read read, write run
462 r--rw--w- read read, write write
463 r--rw--wx read read, write write, run
464 r--rw-r-- read read, write read
465 r--rw-r-x read read, write read, run
466 r--rw-rw- read read, write read, write
467 r--rw-rwx read read, write read, write, run
470 r--rwx--- read read, write, run nothing
471 r--rwx--x read read, write, run run
472 r--rwx-w- read read, write, run write
473 r--rwx-wx read read, write, run write, run
474 r--rwxr-- read read, write, run read
475 r--rwxr-x read read, write, run read, run
476 r--rwxrw- read read, write, run read, write
477 r--rwxrwx read read, write, run read, write, run
5xx — 64 modes where the owner can read, run
Octal Symbolic Owner Group Others
500 r-x------ read, run nothing nothing
501 r-x-----x read, run nothing run
502 r-x----w- read, run nothing write
503 r-x----wx read, run nothing write, run
504 r-x---r-- read, run nothing read
505 r-x---r-x read, run nothing read, run
506 r-x---rw- read, run nothing read, write
507 r-x---rwx read, run nothing read, write, run
510 r-x--x--- read, run run nothing
511 r-x--x--x read, run run run
512 r-x--x-w- read, run run write
513 r-x--x-wx read, run run write, run
514 r-x--xr-- read, run run read
515 r-x--xr-x read, run run read, run
516 r-x--xrw- read, run run read, write
517 r-x--xrwx read, run run read, write, run
520 r-x-w---- read, run write nothing
521 r-x-w---x read, run write run
522 r-x-w--w- read, run write write
523 r-x-w--wx read, run write write, run
524 r-x-w-r-- read, run write read
525 r-x-w-r-x read, run write read, run
526 r-x-w-rw- read, run write read, write
527 r-x-w-rwx read, run write read, write, run
530 r-x-wx--- read, run write, run nothing
531 r-x-wx--x read, run write, run run
532 r-x-wx-w- read, run write, run write
533 r-x-wx-wx read, run write, run write, run
534 r-x-wxr-- read, run write, run read
535 r-x-wxr-x read, run write, run read, run
536 r-x-wxrw- read, run write, run read, write
537 r-x-wxrwx read, run write, run read, write, run
540 r-xr----- read, run read nothing
541 r-xr----x read, run read run
542 r-xr---w- read, run read write
543 r-xr---wx read, run read write, run
544 r-xr--r-- read, run read read
545 r-xr--r-x read, run read read, run
546 r-xr--rw- read, run read read, write
547 r-xr--rwx read, run read read, write, run
550 r-xr-x--- read, run read, run nothing
551 r-xr-x--x read, run read, run run
552 r-xr-x-w- read, run read, run write
553 r-xr-x-wx read, run read, run write, run
554 r-xr-xr-- read, run read, run read
555 r-xr-xr-x read, run read, run read, run
556 r-xr-xrw- read, run read, run read, write
557 r-xr-xrwx read, run read, run read, write, run
560 r-xrw---- read, run read, write nothing
561 r-xrw---x read, run read, write run
562 r-xrw--w- read, run read, write write
563 r-xrw--wx read, run read, write write, run
564 r-xrw-r-- read, run read, write read
565 r-xrw-r-x read, run read, write read, run
566 r-xrw-rw- read, run read, write read, write
567 r-xrw-rwx read, run read, write read, write, run
570 r-xrwx--- read, run read, write, run nothing
571 r-xrwx--x read, run read, write, run run
572 r-xrwx-w- read, run read, write, run write
573 r-xrwx-wx read, run read, write, run write, run
574 r-xrwxr-- read, run read, write, run read
575 r-xrwxr-x read, run read, write, run read, run
576 r-xrwxrw- read, run read, write, run read, write
577 r-xrwxrwx read, run read, write, run read, write, run
6xx — 64 modes where the owner can read, write
Octal Symbolic Owner Group Others
600 rw------- read, write nothing nothing
601 rw------x read, write nothing run
602 rw-----w- read, write nothing write
603 rw-----wx read, write nothing write, run
604 rw----r-- read, write nothing read
605 rw----r-x read, write nothing read, run
606 rw----rw- read, write nothing read, write
607 rw----rwx read, write nothing read, write, run
610 rw---x--- read, write run nothing
611 rw---x--x read, write run run
612 rw---x-w- read, write run write
613 rw---x-wx read, write run write, run
614 rw---xr-- read, write run read
615 rw---xr-x read, write run read, run
616 rw---xrw- read, write run read, write
617 rw---xrwx read, write run read, write, run
620 rw--w---- read, write write nothing
621 rw--w---x read, write write run
622 rw--w--w- read, write write write
623 rw--w--wx read, write write write, run
624 rw--w-r-- read, write write read
625 rw--w-r-x read, write write read, run
626 rw--w-rw- read, write write read, write
627 rw--w-rwx read, write write read, write, run
630 rw--wx--- read, write write, run nothing
631 rw--wx--x read, write write, run run
632 rw--wx-w- read, write write, run write
633 rw--wx-wx read, write write, run write, run
634 rw--wxr-- read, write write, run read
635 rw--wxr-x read, write write, run read, run
636 rw--wxrw- read, write write, run read, write
637 rw--wxrwx read, write write, run read, write, run
640 rw-r----- read, write read nothing
641 rw-r----x read, write read run
642 rw-r---w- read, write read write
643 rw-r---wx read, write read write, run
644 rw-r--r-- read, write read read
645 rw-r--r-x read, write read read, run
646 rw-r--rw- read, write read read, write
647 rw-r--rwx read, write read read, write, run
650 rw-r-x--- read, write read, run nothing
651 rw-r-x--x read, write read, run run
652 rw-r-x-w- read, write read, run write
653 rw-r-x-wx read, write read, run write, run
654 rw-r-xr-- read, write read, run read
655 rw-r-xr-x read, write read, run read, run
656 rw-r-xrw- read, write read, run read, write
657 rw-r-xrwx read, write read, run read, write, run
660 rw-rw---- read, write read, write nothing
661 rw-rw---x read, write read, write run
662 rw-rw--w- read, write read, write write
663 rw-rw--wx read, write read, write write, run
664 rw-rw-r-- read, write read, write read
665 rw-rw-r-x read, write read, write read, run
666 rw-rw-rw- read, write read, write read, write
667 rw-rw-rwx read, write read, write read, write, run
670 rw-rwx--- read, write read, write, run nothing
671 rw-rwx--x read, write read, write, run run
672 rw-rwx-w- read, write read, write, run write
673 rw-rwx-wx read, write read, write, run write, run
674 rw-rwxr-- read, write read, write, run read
675 rw-rwxr-x read, write read, write, run read, run
676 rw-rwxrw- read, write read, write, run read, write
677 rw-rwxrwx read, write read, write, run read, write, run
7xx — 64 modes where the owner can read, write, run
Octal Symbolic Owner Group Others
700 rwx------ read, write, run nothing nothing
701 rwx-----x read, write, run nothing run
702 rwx----w- read, write, run nothing write
703 rwx----wx read, write, run nothing write, run
704 rwx---r-- read, write, run nothing read
705 rwx---r-x read, write, run nothing read, run
706 rwx---rw- read, write, run nothing read, write
707 rwx---rwx read, write, run nothing read, write, run
710 rwx--x--- read, write, run run nothing
711 rwx--x--x read, write, run run run
712 rwx--x-w- read, write, run run write
713 rwx--x-wx read, write, run run write, run
714 rwx--xr-- read, write, run run read
715 rwx--xr-x read, write, run run read, run
716 rwx--xrw- read, write, run run read, write
717 rwx--xrwx read, write, run run read, write, run
720 rwx-w---- read, write, run write nothing
721 rwx-w---x read, write, run write run
722 rwx-w--w- read, write, run write write
723 rwx-w--wx read, write, run write write, run
724 rwx-w-r-- read, write, run write read
725 rwx-w-r-x read, write, run write read, run
726 rwx-w-rw- read, write, run write read, write
727 rwx-w-rwx read, write, run write read, write, run
730 rwx-wx--- read, write, run write, run nothing
731 rwx-wx--x read, write, run write, run run
732 rwx-wx-w- read, write, run write, run write
733 rwx-wx-wx read, write, run write, run write, run
734 rwx-wxr-- read, write, run write, run read
735 rwx-wxr-x read, write, run write, run read, run
736 rwx-wxrw- read, write, run write, run read, write
737 rwx-wxrwx read, write, run write, run read, write, run
740 rwxr----- read, write, run read nothing
741 rwxr----x read, write, run read run
742 rwxr---w- read, write, run read write
743 rwxr---wx read, write, run read write, run
744 rwxr--r-- read, write, run read read
745 rwxr--r-x read, write, run read read, run
746 rwxr--rw- read, write, run read read, write
747 rwxr--rwx read, write, run read read, write, run
750 rwxr-x--- read, write, run read, run nothing
751 rwxr-x--x read, write, run read, run run
752 rwxr-x-w- read, write, run read, run write
753 rwxr-x-wx read, write, run read, run write, run
754 rwxr-xr-- read, write, run read, run read
755 rwxr-xr-x read, write, run read, run read, run
756 rwxr-xrw- read, write, run read, run read, write
757 rwxr-xrwx read, write, run read, run read, write, run
760 rwxrw---- read, write, run read, write nothing
761 rwxrw---x read, write, run read, write run
762 rwxrw--w- read, write, run read, write write
763 rwxrw--wx read, write, run read, write write, run
764 rwxrw-r-- read, write, run read, write read
765 rwxrw-r-x read, write, run read, write read, run
766 rwxrw-rw- read, write, run read, write read, write
767 rwxrw-rwx read, write, run read, write read, write, run
770 rwxrwx--- read, write, run read, write, run nothing
771 rwxrwx--x read, write, run read, write, run run
772 rwxrwx-w- read, write, run read, write, run write
773 rwxrwx-wx read, write, run read, write, run write, run
774 rwxrwxr-- read, write, run read, write, run read
775 rwxrwxr-x read, write, run read, write, run read, run
776 rwxrwxrw- read, write, run read, write, run read, write
777 rwxrwxrwx read, write, run read, write, run read, write, run

Eight blocks of 64 rows: 512 modes, which is every three-digit value from 000 to 777 with none skipped. Each block is collapsed until you open it so the page stays navigable; all of them are already in the HTML of this page, so opening a block fetches nothing.

The fourth digit

Add a leading digit and you reach the three special bits. They are not "more permission"; they change execution and inheritance semantics, and two of the three do nothing at all on the kind of target people usually apply them to.

The eight values of the leading digit. The sticky-bit row on directories is quoted behaviour from POSIX §4.5; the rest describes how the bits are used.
Leading digit Bits On a file On a directory
0 none ordinary file ordinary directory
1 sticky (S_ISVTX) POSIX leaves the behaviour unspecified for a non-directory in a writable directory, only the entry’s owner or the directory’s owner may remove or rename it
2 setgid (S_ISGID) the program runs with the file’s group new entries inherit the directory’s group instead of the creator’s primary group
3 setgid + sticky setgid applies; the sticky half is unspecified shared group directory that members cannot delete each other out of
4 setuid (S_ISUID) the program runs as the file’s owner, not as the caller ignored on Linux
5 setuid + sticky setuid applies; the sticky half is unspecified only the sticky half does anything
6 setuid + setgid runs as both the file’s owner and its group only the setgid half does anything
7 setuid + setgid + sticky setuid and setgid apply; the sticky half is unspecified setgid inheritance plus sticky deletion protection

Start with the sticky bit. Deleting a file is a write to the directory, not to the file, so in a world-writable directory anyone can delete anyone's work. POSIX §4.5 says that with S_ISVTX set, a process may remove or rename an entry only if it owns the entry, owns the directory, or has appropriate privileges. That single bit is the entire difference between 1777 on /tmp and a shared directory that quietly loses files.

The error index

When a mode is wrong, you rarely see "the mode is wrong" — you see a sentence from sshd, or nginx, or cron, and the sentence usually does not contain the word chmod. Below, each of those sentences is matched to the exact test in the program's source that produces it, and to the command that satisfies that test.

Every string was copied out of the project's own source file, not from memory or from another blog post; each row links to the file and names the function. Of the 12 rows in the full index, 10 are mode-driven — some modes fire them and some do not, so chmod changes the outcome — and 2 are not, which means no chmod command will ever help. That second group is small and exists precisely because it is where escalating to 777 comes from.

Five of the 12 are below, one per program and including one of the two that chmod cannot touch. The complete index, with the verdict grid that crosses ten common modes against every rule in it, is on the permission denied page.

Five representative rows. Each message was copied out of the source file named beside it; the last one fires on no mode at all, which is why it is here.
What you see Where it comes from Fires on Fix
Permissions 0644 for '/home/deploy/.ssh/id_ed25519' are too open.

OpenSSH client (ssh, scp, sftp, git over ssh) · stderr, before the connection is attempted

shown for mode 644 on ~/.ssh/id_ed25519 (a private key)

  • @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
  • @ WARNING: UNPROTECTED PRIVATE KEY FILE! @
  • @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
  • It is required that your private key files are NOT accessible by others.
  • This private key will be ignored.

verbatim format string: Permissions 0%3.3o for '%s' are too open.

OpenSSH (portable) — authfile.c · sshkey_perm_ok()

(st.st_uid == getuid()) && (st.st_mode & 077) != 0

quoted verbatim from the source

4032 of the 4096 modes fire it.

chmod 600 /home/deploy/.ssh/id_ed25519

least-privilege mode 600
access to /index.html denied (filesystem path '/var/www/html/index.html') because search permissions are missing on a component of the path

Apache HTTP Server · error_log, tagged AH00035

shown for mode 750 on a directory on the path to the document root

verbatim format string: access to %s denied (filesystem path '%s') because search permissions are missing on a component of the path

Apache HTTP Server — server/request.c · ap_directory_walk(), APLOGNO(00035)

APR_STATUS_IS_EACCES(rv) inside ap_directory_walk() — a branch on the errno the kernel returned while resolving a component, not an expression over st_mode

described, not quoted — the message is not guarded by one expression

2048 of the 4096 modes fire it.

Assumes that the Apache worker user is neither the owner nor in the owning group, so it is judged by the "others" digit. If the worker is in the group, read the group digit instead.

 chmod 755 /var/www/html

least-privilege mode 755
open() "/var/www/html/index.html" failed (13: Permission denied)

nginx · error.log; the client gets HTTP 403

shown for mode 640 on a static file under the document root

verbatim format string: %s "%s" failed

nginx — src/http/modules/ngx_http_static_module.c · ngx_http_static_handler()

nginx — src/core/ngx_log.c · ngx_log_errno()

ngx_http_static_handler() logs the format above with of.failed ("open()") and the path; ngx_log_errno() then appends " (%d: ", the C library’s description of the errno, and ")". EACCES is 13 on Linux.

 the case NGX_EACCES: arm of switch (of.err), which sets rc = NGX_HTTP_FORBIDDEN — a switch branch on the errno open() returned, with no st_mode test anywhere in it

described, not quoted — the message is not guarded by one expression

2048 of the 4096 modes fire it.

Assumes that the nginx worker user is neither the owner nor in the owning group, so the "others" digit decides. A file owned by the worker user needs only the owner read bit.

 chmod 644 /var/www/html/index.html

least-privilege mode 644
(deploy) BAD FILE MODE (/var/spool/cron/deploy)

cron (cronie) · syslog / journalctl -u crond

shown for mode 700 on the crontab file itself, e.g. /var/spool/cron/deploy

verbatim format string: (%s) %s (%s)%s%s

cronie — src/database.c · check_open()

cronie — src/misc.c · log_it()

check_open() in database.c calls log_it(uname, pid, "BAD FILE MODE", tabname, 0); log_it() in misc.c formats it for syslog with the format above, and the two trailing conversions stay empty because the err argument is 0.

 (statbuf.st_mode & 07533) != 0400

quoted verbatim from the source

4088 of the 4096 modes fire it.

chmod 600 /var/spool/cron/deploy

least-privilege mode 600
client denied by server configuration: /var/www/html/members/report.pdf

Apache HTTP Server · error_log, tagged AH01630

shown for mode 644 on not a file mode at all

verbatim format string: client denied by server configuration: %s%s

Apache HTTP Server — modules/aaa/mod_authz_core.c · authorize_user_core(), APLOGNO(01630)

the AUTHZ_DENIED / AUTHZ_NEUTRAL branch of authorize_user_core() — a control-flow branch on the authorisation result, with no mode test anywhere in it

described, not quoted — the message is not guarded by one expression

No mode fires this — chmod cannot change the outcome.

edit the Require directive — no chmod will change this

ssh-privkey-too-open — The check only runs when the key is owned by the user running ssh. A key owned by somebody else is not mode-checked at all — the comment in the source says so explicitly. Note also that the printed number is st_mode & 0777, so a set-user-ID bit on the key never appears in the message.

httpd-search-permissions — Apache names the failing URI and the filesystem path separately, which is the fastest way to see that a parent directory is at fault when you had been staring at the file you were trying to serve.

nginx-open-failed-eacces — The message is assembled from two pieces: the module supplies the operation name and path, and the logger appends the numeric errno with the C library’s description. 13 is EACCES on Linux.

cron-bad-file-mode — The whole block is skipped when cron is built or configured with PermitAnyCrontab. Note what the mask permits: 0644 passes, and so does 0400. What fails is anything executable, anything group- or world-writable, and — the one that catches people — 0700.

httpd-authz-denied — If your error line says "client denied by server configuration", stop changing modes and read the <Directory> block.

Recommended modes, with the basis stated

"Use 755 for directories and 644 for files" is good advice with no reasoning attached, which makes it impossible to know when it stops applying. The table below gives a value per deployment context and, next to it, what kind of claim that value is: enforced means the program refuses to proceed and the condition is quoted from its source; documented means the project's own manual says so; checked means the program tests the mode, logs what it would prefer, and proceeds anyway; derived means it follows from the access rules plus a stated assumption; convention means it is what people do and I found no requirement. 4 of the 14 rows are enforced, 1 are checked-but-not-enforced, and 1 is only conventional.

Recommended mode per context. Read the basis column first: it says whether the value is forced on you, recommended by the project, checked and merely warned about, worked out from the access rules, or purely conventional.
Where Mode Basis The rule, and why
~/.ssh (the directory)

directory

 700

rwx------

 documented

ssh(1) FILES: "There is no general requirement to keep the entire contents of this directory secret, but the recommended permissions are read/write/execute for the user, and not accessible by others."

What sshd actually enforces is weaker: safe_path() rejects the directory only when (st_mode & 022) is non-zero, so 755 passes the login check. 700 is the documented recommendation, not the enforced floor — a distinction most cheat-sheets collapse.

OpenSSH (portable) — ssh.1 — FILES · misc.c

~/.ssh/id_ed25519, id_rsa (private keys)

file

 600

rw-------

 enforced

(st.st_uid == getuid()) && (st.st_mode & 077) != 0 → the key is ignored

The mask is 077, so every bit outside the owner triad fails, read included. Exactly 8 of the 512 three-digit modes satisfy it, and 600 is the only one of those that is both readable and writable by its owner without granting execute. (200 is writable without execute too, but you cannot read the key back.)

OpenSSH (portable) — authfile.c · ssh.1 — FILES

~/.ssh/authorized_keys (on the server)

file

 600

rw-------

 documented

ssh(1) FILES: "This file is not highly sensitive, but the recommended permissions are read/write for the user, and not accessible by others." Enforced floor: (st_mode & 022) == 0 when StrictModes is on.

Public keys are public, so readability is not the risk; writability is. Anyone who can append a line to this file owns the account.

OpenSSH (portable) — ssh.1 — FILES · misc.c

~/.ssh/config

file

 600

rw-------

 enforced

(sb.st_mode & 022) != 0 → fatal("Bad owner or permissions on %s")

ssh exits here; it does not warn and carry on. A writable client config lets somebody else add a ProxyCommand and route your sessions through a machine of their choosing.

OpenSSH (portable) — readconf.c · ssh.1 — FILES

/var/www/html and every directory above it

directory

 755

rwxr-xr-x

 derived

the server process needs the search bit on every component of the path

Apache names this failure precisely — "search permissions are missing on a component of the path" — and the component that fails is usually a parent directory somewhere above the document root. Without the search bit the request fails before the file’s own mode is consulted.

Assumes the worker user (www-data, nginx, apache) is neither the owner nor in the owning group, so the "others" digit applies. If you have put the worker in the owning group, 750 is enough.

Apache HTTP Server — server/request.c

static files under the document root

file

 644

rw-r--r--

 derived

the worker needs the read bit; it never needs write, and never needs execute for static content

nginx maps EACCES on open() to HTTP 403 and not to 500, so an unexplained 403 on a site with no auth configured is nearly always this. Execute on a static file buys nothing — the server reads it, it does not run it.

Assumes the same class assumption as the directory row: the worker falls in the "others" class. In the group, 640 is enough.

nginx — src/http/modules/ngx_http_static_module.c

/var/spool/cron/<user> (the crontab file itself)

file

 600

rw-------

 enforced

(statbuf.st_mode & 07533) != 0400 → "BAD FILE MODE", the whole crontab is skipped

Read the mask digit by digit: owner read must be set, owner execute must be clear, group and other must have neither write nor execute, and no special bit may be set. 0644 passes. 0700 does not — the owner execute bit alone is enough to disqualify a crontab, which is a genuinely surprising result and the reason this row exists.

cronie — src/database.c

the script a cron line runs

file

 755

rwxr-xr-x

 derived

cron executes it, so it needs an execute bit for the user the job runs as

A cron job that produces nothing and logs nothing is usually this. The shell exits 126 when it finds the command and cannot execute it, and 127 when it cannot find it — worth checking which one your job’s mail says.

Assumes the job runs as the file’s owner. For a root job on a user-owned script, the others digit is what matters.

POSIX.1-2024 (IEEE Std 1003.1-2024) — XCU §2.8.2 Exit Status for Commands

/etc/systemd/system/<name>.service (the unit file)

file

 644

rw-r--r--

 checked

stat_warn_permissions(): (st_mode & 0111) → "marked executable. Please remove executable permission bits."; (st_mode & 0002) → "marked world-writable. Please remove world writability permission bits."; and, only when getpid_cached() == 1, (st_mode & 0044) != 0044 → "marked world-inaccessible". Each ends "Proceeding anyway."

Three warnings, no refusal. unit_load_fragment() calls config_parse(), which calls stat_warn_permissions() on the file it is about to read, so the guards above run on every unit PID 1 loads. Together they select exactly the shape of 644: no execute bit, no world-write bit, and both read bits set. None of it is a rule — a unit at 600 or 755 still starts, and the only trace is a log line.

systemd — src/basic/fs-util.c · src/shared/conf-parser.c

the binary or script named by ExecStart=

file

 755

rwxr-xr-x

 derived

it is executed, so it needs an execute bit for the unit’s User=

This is the file to check when a unit fails immediately with no output of its own. The unit file being 644 is fine; the target of ExecStart= being 644 is not.

Assumes the unit runs as a user who reaches the file through the owner or group triad.

POSIX.1-2024 (IEEE Std 1003.1-2024) — XCU §2.8.2 Exit Status for Commands

.env and similar secret files

file

 600

rw-------

 convention

No enforcement found. None of the loaders whose behaviour this site verified refuses to read a world-readable .env — unlike an SSH private key, nothing stops you.

The reason to use 600 is that everything else on a shared host can read a 644 file, not that a program will complain. If your deployment needs the application user to read it and the file is owned by a deploy user, 640 with a shared group is the usual shape.

No source cited, because none was found. That is the whole content of a “convention” row.

/etc/sudoers.d/<name>

file

 440

r--r-----

 enforced

sudo_check_secure(): (sb->st_mode & S_IWOTH) → "%s is world writable"; ISSET(sb->st_mode, S_IWGRP) && (gid == (gid_t)-1 || sb->st_gid != gid) → the group-writable refusal. Either one and sudo refuses to run.

Two mode conditions, not one. World-writable is rejected outright; group-writable is rejected as well unless the file’s group is the sudoers group sudo was built to expect. 440 is the conventional value that clears both. 400 clears them too and grants strictly less, so 440 is simply what people settle on here — no source makes it a minimum. Edit these with visudo, which validates before replacing the file.

sudo — lib/util/secure_path.c · plugins/sudoers/sudoers.c

/tmp and other world-writable drop directories

directory

 1777

rwxrwxrwt

 documented

POSIX §4.5: with S_ISVTX set on a writable directory, a process may remove or rename a file only if it owns the file, owns the directory, or has appropriate privileges.

Without the sticky bit, 777 on a shared directory lets any user delete any other user’s files, because deleting an entry writes to the directory itself and never touches the file. The leading 1 is the entire difference between /tmp and a disaster.

POSIX.1-2024 (IEEE Std 1003.1-2024) — XBD §4.5 Directory Protection

a directory a team writes to through a shared group

directory

 2775

rwxrwsr-x

 derived

inode_init_owner(): if (dir && dir->i_mode & S_ISGID) the new inode takes dir->i_gid, and a new subdirectory inherits S_ISGID as well

Without it, every file lands in the creator’s primary group and the next person cannot write to it. Note the citation: this is Linux kernel behaviour, not POSIX. POSIX leaves the new file’s group unspecified between the parent directory’s group and the creating process’s effective group, and never mentions S_ISVTX-style inheritance for S_ISGID — so this row is derived from the kernel that implements it. Combine with a umask of 002 so the group write bit survives creation: the setgid bit sets the group, the umask decides whether the group can use it.

Assumes every collaborator is a member of the owning group, and the filesystem is a Linux one.

Linux kernel — fs/inode.c

  • enforced the program refuses to proceed otherwise — the condition is quoted from its source
  • documented the project’s own manual recommends this value
  • checked the program tests the mode and logs what it would prefer, then proceeds anyway — the condition is quoted from its source
  • derived it follows from the access rules plus the assumption in the same row
  • convention no enforcement and no documented requirement was found — this is what people do

The ~/.ssh claim almost every cheat-sheet gets wrong

You have read that ~/.ssh must be 700. It need not be. OpenSSH's safe_path() walks from the key file upward to the home directory and rejects a component only when (st_mode & 022) != 0 — that is, when it is writable by the group or by others. 755 passes that test; so does 750. 700 is what ssh(1) recommends in its FILES section, and recommending is not enforcing. One is a rule, the other is advice — and telling them apart is the difference between fixing the one writable directory and chmod-ing every directory in the path.

The private key is the opposite case, and stricter than people assume. The mask there is 077, not 022: a key that is merely group-readable is refused, with Permissions 0640 for '…' are too open. Only 8 of the 512 three-digit modes satisfy it. The full breakdown, mask by mask, is on the SSH key permissions page.

Recursion without breaking the tree

chmod -R 755 . marks every text file executable, which is untidy but harmless. Its mirror image, chmod -R 644 ., is not: it strips the search bit from every directory and makes the whole tree unreachable, including to you. The two get typed by the same reflex. The fix is not a different single mode; it is to stop treating files and directories as the same thing: 

find /var/www/html -type d -exec chmod 755 {} +
find /var/www/html -type f -exec chmod 644 {} +

The one-line alternative uses capital X, which POSIX defines as the execute/search bits "if the file is a directory or if the current (unmodified) file mode bits have at least one of the execute bits set". So chmod -R u=rwX,g=rX,o=rX /var/www/html gives directories their search bit, leaves already-executable scripts executable, and does not touch plain files. Tick the recursive box in the calculator and it prints all three forms for whatever mode you have built.

How this page is built

Two rules, both of which you can check. First, no table here has a hand-typed number. The 512-row grid and the umask table are generated by iterating the mode space; the digit table's two prose columns are written by hand, but its digit and rwx columns are derived from the bits, so the words can be wrong and the arithmetic cannot. The test suite re-derives every generated cell from the digits before the build is allowed to finish, checks that the symbolic renderer is a bijection onto all 4096 modes, and stops the build if either fails.

Second, no error string is quoted from memory. All 26 sources — OpenSSH, Apache, nginx, cronie, sudo, Git, systemd, the Linux kernel and POSIX itself — were opened and read on 2026-08-15, and each row links to the exact file. Where I could not find a requirement, the table says so instead of inventing one: the .env row is marked convention, because that is all the evidence supports. The full list, and the things this site could not verify, are on the about page.

## Questions people actually ask

What does chmod 755 actually mean?

Three octal digits, one per class of user. The first is the owner, the second the group, the third everyone else. Inside each digit, 4 is read, 2 is write and 1 is execute, added together — so 7 is 4+2+1 and 5 is 4+1. 755 therefore reads rwxr-xr-x: the owner can read, write and execute; the group and everyone else can read and execute but not write. On a directory the execute bit means something different from "run": it is search permission, the right to resolve a name inside the directory. That is why a directory almost always wants 755 and a static file almost never does.

Why does chmod 777 not fix my “Permission denied”?

Because a lot of the errors that read like permission problems are not file-mode problems. Of the 12 messages indexed on this page, 2 cannot be changed by any mode at all — Apache's client denied by server configuration comes from a Require directive, and cron's WRONG FILE OWNER is about ownership. Of the ones that are mode-driven, several get worse with 777: cronie refuses a world-writable crontab, sudo refuses a world-writable sudoers file, and sshd refuses a group-writable ~/.ssh. Paste your actual error into the error index instead of escalating.

What is the fourth digit for?

Set-user-ID (4000), set-group-ID (2000) and the sticky bit (1000). They sit in front of the nine ordinary bits, which is why the mode space is 4096 values rather than 512. 3584 of those 4096 carry at least one special bit. They also change how ls -l prints the execute column: a special bit turns x into s or t, and if the execute bit underneath is off it becomes an uppercase S or T instead. 2368 modes render with at least one uppercase letter. That is worth reading precisely: an uppercase letter means the special bit is set with no execute bit in that same class, and whether the bit is then inert depends on which bit it is. Setgid on a regular file genuinely does nothing without group-execute. Setuid on a file still applies if any class can execute it, and setgid and the sticky bit on a directory are tested on their own, with no execute bit involved — 1770 is a working shared drop-box and prints rwxrwx--T.

Is chmod -R safe on a website?

Not with a single mode, no. Directories need the search bit and regular files do not, so chmod -R 755 makes every HTML file, config file and image executable, and chmod -R 644 makes every directory unreachable — which locks you out of the tree until you fix it. Use the two find commands the calculator prints when you tick the recursive box, or the capital-X form, which POSIX defines as "the execute/search portion of the file mode bits if the file is a directory or if the current (unmodified) file mode bits have at least one of the execute bits set".

Does this send my paths anywhere?

No. The page is static and the calculator is JavaScript running in your tab. There is no server component, no account and no request while you type — you can confirm that in your browser's network panel. The path box exists purely so the generated command is one you can paste without editing.

What is the difference between symbolic and octal chmod?

Octal is absolute: chmod 644 f sets all nine bits at once and discards whatever was there. Symbolic can be relative: chmod u+x f adds one bit and leaves the other eight alone. That difference matters on a file you did not create. There is also something symbolic can express that octal cannot when you are writing three digits — chmod +t and chmod g+s reach the fourth digit without you having to know its current value. The calculator prints all three forms; the relative one is computed as the difference from where you started, so 644 → 755 comes out as a+x.

Where do the error messages in the table come from?

Out of the source code of the programs that print them. Each row names the file and the function — OpenSSH's sshkey_perm_ok() in authfile.c, cronie's check_open() in database.c, and so on. The "fires on" column quotes the guard verbatim for the 8 rows where one expression guards the message, and describes the branch for the other 4, where the message is reached through a switch arm, or through an errno the kernel produced with no test on st_mode anywhere in the path. Each row says which of the two it is. If a row is wrong you can click through and see that it is wrong, which is the only property that makes a table like this worth reading.

Link to this calculator

Answering a permissions question on a forum or in a wiki? This snippet drops in a plain link — no script, no iframe, nothing that can break a page:

<a href="https://chmodcalc.pages.dev/">Chmod Calculator — octal, rwx and the command, in sync</a>

elsewhere on this site

other tools we run