Loading Techie Utils…

Chmod Calculator (Unix Permissions)

Convert between 755 and rwxr-xr-x, and say what each bit allows. Free, and runs entirely in your browser — nothing you enter is uploaded or stored.

About Unix Permissions Calculator

The same twelve bits, written both ways. 755 and rwxr-xr-x say exactly the same thing, and which one you are holding depends on where you just read it — the octal out of a Dockerfile or an Ansible task, the letters out of ls -l. Paste either and this answers in both, along with the chmod line and the umask that would produce it.

The top three bits are where the surprises are. Setuid, setgid and the sticky bit share their display column with the execute bit, so one character carries two bits at once — and the case of the letter is what tells them apart. rwsr-xr-x is setuid *with* execute; rwSr--r-- is setuid *without* it, which does nothing at all and almost always means a digit landed in the wrong column. That capital S has been quietly reporting mistakes since the 1970s and is the single most misread thing in ls output.

The mode can be typed or ticked. Under the box is the grid it stands for — owner, group and others against read, write and execute, with setuid, setgid and sticky below — and ticking a box rewrites the text in whichever form it was already in, while typing re-ticks the boxes. The three-dot menu holds the modes people actually set, from 644 to 1777.

What the bits mean also depends on what they are attached to, which is why the tool asks. On a file, execute means it can be run. On a directory it means the directory can be entered at all — so a directory with read and no execute lets you list the names inside and open none of them, which is a confusing state to be in and an easy one to create.

The umask is worked out from the right base, which is the part most references get wrong. A umask only ever *removes* permissions, and a new file starts from 666 while a new directory starts from 777. So 755 on a file is not reachable by any umask — execute cannot be masked on — and rather than answering 022 anyway, this says so.

Where it helps

  • Takes octal or symbolic without being told which, because you paste whichever you were just looking at.
  • Always shows four octal digits, so the special bits are visible rather than hidden behind a three-digit habit.
  • Gets the capital S and T right in both directions — the case is meaning, not decoration.
  • Says what the bits allow in words, and changes those words for a directory, where they mean something different.
  • Works out the umask from the correct base — 666 for a file, 777 for a directory — and says when no umask can produce the mode at all.
  • Gives the chmod line in both the numeric and the letters form.
  • Points out the modes worth a second look: world-writable files, 777, a world-writable directory with no sticky bit, a directory readable but not enterable.
  • Runs entirely in your browser.

Limits

  • It describes the mode bits and nothing else. ACLs, SELinux labels, macOS flags and mount options such as noexec can all override what the bits appear to allow.
  • Ownership is not part of a mode: rw------- means nothing until you know who the owner is.
  • The warnings are about the mode in isolation. 777 on a scratch directory inside a container is not the same problem as 777 on /etc, and this cannot tell which one you have.
  • Most kernels ignore setuid on scripts entirely, so a mode that sets it may simply have no effect.
  • It does not read or change anything on disk — it explains a number you type.

Frequently asked questions

What is the fourth digit for?

The special bits: 4 is setuid, 2 is setgid, 1 is sticky. They are usually left off, which is why chmod 755 and chmod 0755 do the same thing. They are shown here always, because a mode written as three digits silently claims the fourth is zero — and when it is not, that is exactly the thing you wanted to notice.

What is the difference between rwsr-xr-x and rwSr--r--?

The case of the S. A lowercase s means the special bit is set *and* the execute bit under it is set — the normal, working combination. A capital S means the special bit is set and execute is *not*, so there is nothing for it to act on. The same applies to t and T in the last triad. Unix has used the letter case to carry that difference for decades, and it is the quickest way to spot a mode that was typed wrong.

Why does it say no umask can produce my mode?

Because a umask subtracts and never adds. The system creates a file from a base of 666 and a directory from 777, then turns off whatever the mask names. Execute is not in the base for a file, so no umask produces 755 on one — the execute bit has to be set afterwards, usually by the compiler, the installer or an explicit chmod. Answering with a number anyway would be confidently wrong.

Someone told me to chmod 777 to fix a permissions problem. Should I?

It will usually make the symptom go away and it is almost never the right fix. 777 means every account on the machine can read, change and run the thing — including anything that has already got a foothold. The actual problem is nearly always ownership or the group, and chown or a 775 with the right group fixes it without handing the file to everyone.

Why can I delete a file I do not have write permission on?

Because deleting is not writing to the file — it is writing to the *directory* that holds it. The permissions that matter for removing something belong to its parent, which is why a read-only file in a writable directory can still be deleted, and why the sticky bit exists to stop exactly that in shared directories such as /tmp.

Related tools

More Calculators tools