Chmod Calculator – Understand and Build Unix File Permissions
Every file and directory on Linux, macOS and other Unix-like systems carries a small set of permission bits that decide who may read, change or run it. The chmod command sets those bits, but its notations (octal numbers such as 755, strings such as -rwxr-xr-x and symbolic expressions such as u+x,go-w) are easy to mix up. This chmod calculator shows one mode in every notation at once, explains what it allows in plain English, and generates the commands and code you need.
The 12 permission bits
A mode has nine basic bits in three classes: the owner (u), the file's group (g) and others (o). Each class gets read (r, weight 4), write (w, weight 2) and execute (x, weight 1). Adding the weights gives one octal digit per class, so rwx is 4 + 2 + 1 = 7 and r-x is 4 + 0 + 1 = 5. Three more special bits (setuid 4, setgid 2 and sticky 1) form an optional leading digit, which is why you see four-digit modes such as 2775 or 1777.
Reading ls -l output
The first column of ls -l is ten characters: a file type (- for a regular file, d for a directory, l for a symlink) followed by three groups of rwx. Special bits fold into the execute column: a lowercase s or t means the special bit and execute are both set, while a capital S or T means the special bit is set without execute. A trailing + signals an ACL, . an SELinux context and @ macOS extended attributes.
Numeric vs symbolic modes
A numeric mode sets every bit at once: chmod 644 notes.txt. A symbolic mode changes only what you name: chmod g+w report.csv adds group write and leaves everything else alone. Symbolic clauses combine a class (u g o a), an operator (+ - =) and letters (r w x X s t), separated by commas. The simulator tab evaluates these expressions step by step, including the subtle cases:
| Expression | What happens |
|---|---|
+w | No class given, so the umask filters it: on 444 with umask 022 the result is 644 |
a+X | Adds execute only to directories and to files that already have an execute bit |
g=u | Copies the owner's permissions to the group: 754 becomes 774 |
o+s | No effect: s only exists for the owner and group |
What permissions mean on directories
On a directory, r lets you list names, x lets you enter it and reach entries by name, and w lets you create, delete and rename entries, but only together with x. That is why directories almost always need execute and why deleting a file depends on its directory's permissions, not its own. Unix also checks classes in order: if you own the file, only the owner bits apply, even when the group or others are granted more.
Special bits: setuid, setgid and sticky
Setuid on a compiled program makes it run with the file owner's privileges, which is how passwd edits system files. Setgid on a directory makes new files inherit the directory's group, the usual setup for shared team folders (2775). The sticky bit on a directory such as /tmp (1777) stops users from deleting each other's files even though everyone can write there.
umask is a mask, not a subtraction
When a program creates a file it usually requests 666 (or 777 for directories), and the kernel clears every bit set in your umask. With umask 022, files become 644 and directories 755. Because it is a bitwise mask, umask 033 gives files 644, not 633. The umask tab shows both directions, including which umask produces a given directory mode.
Recursive pitfalls
chmod -R 755 project makes every file inside executable too. A safer approach sets directories and files separately with find -type d and find -type f, or uses a capital X so execute lands only on directories.
750 for a directory shared with one group, or 1777 when everyone genuinely needs a drop folder.