Convert chmod Octal and Symbolic Permissions

Someone hands you a deployment note that says "set the key to 600 and the folder to 755", while the error message you are staring at says "Permissions 0644 for 'id_rsa' are too open". One document speaks in octal numbers, the other in nine letters, and you would like to be sure of both before you type anything into a production server. That translation, and the one command that goes with it, is what a permissions calculator is for.

The short version: Chmod Calculator keeps three views of a Unix permission in sync, the checkboxes, the octal number such as 755, and the symbolic text such as rwxr-xr-x, and it writes the matching chmod command for you to copy.

How the numbers work

Every file has three groups of people: the owner, the group and everyone else (called other). Each group gets three switches: read, write and execute. The octal system gives read the value 4, write the value 2 and execute the value 1, and adds up the ones that are on. So read plus write is 6, read plus execute is 5, and all three is 7.

Write the three totals side by side and you have the familiar three-digit number. 755 means the owner has 7 (read, write, execute), and the group and others each have 5 (read and execute). The symbolic text lists the same facts as nine characters in three triplets, with a dash for each switch that is off: rwxr-xr-x. The tool shows all of this at once, so you can tick a box and watch the number change, or type a number and watch the boxes follow.

Here are the common pairs. The first five and the sticky-bit 1777 are the tool's preset buttons, and 640 is one you can type in:

• 755 is rwxr-xr-x: the owner can do everything, others can read and run. Typical for scripts and folders.
• 644 is rw-r--r--: the owner can read and write, others can only read. Typical for ordinary files such as web pages.
• 600 is rw-------: the owner only. This is what private keys need.
• 700 is rwx------: the owner only, including running. Private scripts and folders.
• 640 is rw-r-----: the owner reads and writes, the group reads, others get nothing. A common choice for config files with a shared service group.
• 777 is rwxrwxrwx: everyone can do everything. The tool's own preset note says to avoid it on a server, and that is good advice.

Three ways to type a mode

The tool has an Octal box and a Symbolic box, and between them they accept three forms. Both read what you type and update the checkboxes and the other box.

First, octal. You can type 755, or 0644 with a leading zero, or a four-digit mode like 4755. Leading zeros are fine, so 0644 and 644 give the same result. Digits 8 and 9 are rejected with a clear message that octal only goes from 0 to 7, and anything longer than four digits is rejected too.

Second, the nine-character text. Typing rwsr-xr-x gives 4755, because the s in the owner triplet means the setuid bit is on. Typing rwxrwxrwt gives 1777, the sticky bit used by shared folders such as the system temp directory. A capital letter matters: in the owner triplet, rwSr--r-- gives 4644, which means setuid is set but the owner does not have the execute bit. That combination is almost always a mistake, and the tool shows it rather than hiding it.

Third, in the Symbolic box, chmod's own clauses, such as u+x, go-w, a+r or u=rwx,go=rx. These work from whatever mode is currently shown. Starting from 644, u+x gives 744, go-w leaves 644 because group and others had no write bit to remove, and u=rwx,go=rx gives 755. Because the clauses are relative, the order of your edits matters, the same as it does on the command line.

The special bits, briefly

A fourth leading digit carries three special bits. Setuid (4) makes a program run with its owner's rights, setgid (2) makes new files in a folder inherit the folder's group, and the sticky bit (1) stops people from deleting each other's files in a shared folder. So 2775 is rwxrwsr-x, a team folder where everything created inside belongs to the team group, and 1777 is the classic shared folder. The tool handles all three, and you can ignore them unless you have a specific reason to set them.

The command it writes, and the quoting trap

The copy button next to the command gives you a ready command such as chmod 644 file. The tool quotes the path when it needs quoting. A name with a space, such as my file.txt, comes out as chmod 644 'my file.txt', with single quotes around the name. A path that starts with a dash is quoted as well, so a file called -x is not mistaken for an option. Plain names with only letters, digits and a few safe symbols are left alone.

That small detail avoids a classic accident: an unquoted name with a space becomes two arguments and you change the permissions of the wrong thing.

The recursive trap, with a worked example

The most expensive mistake with chmod is the recursive flag. Say you want your website folder, called site, to be readable by everyone, and you reach for chmod -R 644 site. The files become 644, and so do the folders. A folder needs the execute bit before anyone can open it, so the whole tree is now closed. The server cannot enter any folder and every page returns an error.

The tool watches for this. When you tick Recursive (-R) with a mode in which anyone can read or write but nobody can execute, it shows a warning that recursive 644 removes the execute bit from sub-folders, and offers these replacements:

• chmod -R u=rwX,g=rX,o=rX site
• find site -type d -exec chmod 755 {} +
• find site -type f -exec chmod 644 {} +

The first line uses a capital X, which means "execute, but only for folders and for files that already have it". The last two lines treat folders and files separately: folders get 755, files get 644. For a private tree the same logic gives 700 for folders and 600 for files. If the mode already has an execute bit for everyone, such as 755, no warning appears, because recursion is safe in that case.

Fixing the SSH key error

The most common reason people open a permissions calculator is the SSH message that a private key is too open. SSH refuses to use a key that other users can read, so 0644 is rejected. The fix is chmod 600 followed by the path of the key. Type 600 into the calculator, confirm it reads rw-------, enter the key's path in the path box and copy the command. If you generate a new key pair, give it a strong passphrase from Password Generator, because the file permission protects the key from other users on the machine while the passphrase protects it if the file is ever copied.

To check what you changed, run ls -l before and after and paste the two listings into Diff Checker. It marks exactly which lines changed, which is a good habit before you apply a permission change across a server. The tool also fits next to the JSON Formatter in a debugging session.

Steps

1. Open Chmod Calculator and start from a preset, or type your mode into the Octal or Symbolic box.
2. Check the three views agree: the boxes, the octal number and the nine letters.
3. Enter the file or folder name in the File or folder box so that the command is written with correct quoting.
4. If you are changing a whole folder, tick Recursive (-R) and read any warning before you copy the command.
5. Copy the command and run it on a test file first.
6. Run ls -l afterwards to confirm the result matches what the tool showed.

The tool is a Professional Tool with 10 trial uses a day, then a $1 day pass or the $4.99 monthly plan. Reading the three views is free; copying a command is what uses a trial use, so one visit is usually enough.

Common mistakes

Using 777 to make an error go away, which fixes the symptom and opens the file to every user on the machine. Running chmod -R 644 on a folder and locking everyone out of the tree. Forgetting that a private key must be 600. Typing a digit 8 or 9 by mistake. Setting setuid on a script without understanding it. Treating u+x as absolute when it is relative to the current mode. And leaving a path with spaces unquoted.

Summary

Unix permissions are three small sums, and a calculator keeps you from adding them wrong. Use Chmod Calculator to move between octal, symbols and checkboxes, to get a safely quoted command, and to catch the recursive mistake before it reaches a server. More tools for engineers are in the security tools category.

Open Chmod Calculator→

Is there a permission case this post missed? Tell us on the contact page.