Every chmod tutorial starts with "read is 4, write is 2, execute is 1" and then abandons you. This one goes the whole way: where the numbers come from, why directories behave differently, what the fourth digit does, and how to stop guessing between 755 and 644 for good.
Unix stores permissions as bits. Read, write, and execute for three audiences — owner (user), group, and others — make nine bits, and octal is just a compact way to write nine bits as three digits. Each digit encodes one audience:
Want read plus write plus execute? Add the values: 4+2+1 = 7. Read only is 4. Read plus execute — what you need to run a program or enter a directory without editing it — is 5. So chmod 755 means owner 7, group 5, others 5, or symbolically rwxr-xr-x. Once the arithmetic clicks, you never re-memorize it. You just add.
| Mode | Symbolic | Owner / group / others get | Typical target |
|---|---|---|---|
644 | rw-r--r-- | rw- / r-- / r-- | Ordinary files: configs, HTML, source |
755 | rwxr-xr-x | rwx / r-x / r-x | Directories, shared executables, scripts |
600 | rw------- | rw- / nothing / nothing | SSH keys, .env files, credentials |
700 | rwx------ | rwx / nothing / nothing | Private directories like ~/.ssh |
640 | rw-r----- | rw- / r-- / nothing | Files a service user must read |
711 | rwx--x--x | rwx / --x / --x | Enterable but unlistable directories |
Notice the pattern: directories and files differ by the execute bit, and the only question for the trailing digits is whether strangers get read-only (5 or 4) or nothing at all (0). That single distinction covers 90% of daily chmod decisions.
On a directory, execute doesn't mean "run" — it means "pass through." Without it, you can't cd into the directory or reach files inside it, even ones you own. Read on a directory only lets you list names. That's why 711 exists: others can traverse to a known file inside (the execute bits) but can't run ls on the directory (no read). It's the standard layout for FTP roots and web roots where structure should be guess-proof.
Above the nine permission bits sit three special ones, written as a leading fourth octal digit:
chmod 4755 runs an executable as its owner instead of whoever launched it. This is how /usr/bin/passwd, owned by root, edits /etc/shadow for ordinary users. Powerful, audited, and a security review flag when it appears on unexpected binaries.chmod 2775 on a program runs it under the file's group. On a directory, it's more useful: every file created inside inherits the directory's group, which is how team project folders stay shared without constant chgrp.chmod 1777 is the /tmp trick: anyone can create files, but only the file's owner (or root) can delete them. Without sticky, 777 on /tmp would let any user shred anyone else's temp files.In ls -l output these bits replace execute positions: setuid plus execute shows as s, setuid without execute as S (usually a mistake), sticky plus execute as t, sticky alone as T.
chmod 755 file and chmod u=rwx,go=rx file land in the same place, but they behave differently in scripts. Numeric is absolute — every bit gets set exactly as written, so nothing survives from the old mode. Symbolic can be relative: chmod +x script.sh adds execute for all three audiences, chmod u+x just the owner, chmod g-w strips group write. The classic footgun is chmod a+r on a directory you meant to open — it makes the listing readable, but without x nobody can still enter. When in doubt, set the full mode numerically.
Toggle checkboxes or type an octal and get the symbolic string, special bits, and the copy-paste command.
Open the Chmod Calculator →You rarely chmod files you just created, because the system already did. A default umask 022 subtracts write permission for group and others from new files: programs create files as 666 & ~022 = 644 and directories as 777 & ~022 = 755. Tighten your shell with umask 077 and everything you create lands 600/700 — private by default. Umask explains why the "standard" modes are standard; chmod is for fixing things that drifted.
600 on the private key and 700 on ~/.ssh. Stray group access is enough for sshd to refuse.For anything beyond these, run the number both directions before you commit it: our chmod calculator converts numeric to symbolic and back, including the special bits. And when a task is really about time-based scheduling rather than permissions, the cron expression generator covers the other half of every sysadmin's cheat sheet. Testing the regex that matches those file names? The regex tester runs it live.
Each digit is a sum of permissions: read 4, write 2, execute 1. The first digit is the owner, second the group, third everyone else. In 755 the owner gets 4+2+1 (read, write, execute) while group and others get 4+1 (read and execute). Written symbolically that's rwxr-xr-x.
Directories need the execute bit to be enterable at all, so a usable directory is usually 755. Ordinary files don't need execution, and most files shouldn't be world-writable, so 644 (owner reads and writes, everyone else reads) is the sane default. That's also what a typical umask of 022 produces when files are created.
It sets special bits: setuid 4, setgid 2, sticky 1. The sticky bit on 1777 is why /tmp works — everyone can create files, but you can only delete files you own. Setgid (2775) on a shared directory makes new files inherit the directory's group, and setuid (4755) runs a program as its owner, like /usr/bin/passwd.
Rarely, and almost never on a multi-user system or a web server. 777 lets any local user or compromised process modify the file. The usual underlying problem is ownership — fix it with chown or chgrp, or restructure the directory, and 777 stops being tempting.
They set the same end state. The numeric form is absolute: every permission gets set exactly as written. The symbolic form can be absolute with = or relative with + and -, so chmod +x adds execute for everyone while chmod u+x adds it only for the owner. Numeric is easier for full resets; symbolic is safer for small tweaks.