Type or paste a mode in any form, or tick the boxes below. A line from ls -l such as -rw-r--r-- works too.
| Class | Read | Write | Execute |
|---|---|---|---|
| Owner | |||
| Group | |||
| Others |
Result
Common modes
| rw-r--r-- | Regular files: owner edits, everyone reads (web pages, configs) | |
| rwxr-xr-x | Programs, scripts and directories | |
| rw------- | Private files: SSH keys, .env, credentials | |
| rwx------ | Private directories such as ~/.ssh | |
| rw-r----- | Owner edits, group reads, others nothing | |
| rwxrwxr-x | Directories a team writes to | |
| rwxrwsr-x | Shared team directory: new files keep the group | |
| rwxrwxrwt | Shared scratch space like /tmp | |
| r-------- | Read-only key files (cloud .pem keys) |
How Linux permissions work
Every file has three sets of permissions: for its owner, for its group, and for others (everyone else). Each set says whether they may read, write or execute it. In octal each permission is a number, read = 4, write = 2, execute = 1, and the three are added up per class: rwx is 7, r-x is 5, r-- is 4. So 755 means the owner can do everything and the group and others can read and run.
On a directory, read lets you list its names, write lets you create, rename and delete files in it, and execute lets you enter it and reach the files inside. A directory without execute permission is effectively closed even if it can be read.
Setuid, setgid and the sticky bit
A fourth leading digit holds three special bits. Setuid (4000) makes a program run as its owner, which is how passwd can change a root-owned file; it is a common target for attackers, so use it sparingly. Setgid (2000) runs a program as its group, and on a directory makes new files inherit the directory’s group, which is useful for shared project folders. The sticky bit (1000) on a directory lets only a file’s owner delete it, as on /tmp. In symbolic form they appear as s or t in the execute position, and as capital S or T when execute itself is off.
Applying permissions safely
Avoid 777: it lets every user and every compromised process on the server change the file. If a web server needs to write somewhere, give that directory to the web server’s group and use 775 or 770. Be careful with chmod -R, which gives files the same execute bit as directories; to set them separately use find /path -type d -exec chmod 755 {} + and find /path -type f -exec chmod 644 {} +.
This calculator only builds the mode; it does not change any file. Everything happens in your browser.