chmod Calculator

• Converts octal to symbolic - 644 becomes rw-r--r--, 2775 becomes rwxrwsr-x.
• Converts symbolic to octal, accepting both the bare 9-character string and full ls -l output with its type prefix.
• Decodes the special bits: setuid (4000), setgid (2000) and the sticky bit (1000), including the capital S/T form that means "set but not executable".
• Explains each class in words - what the owner, the group and everyone else may actually do with the file or directory.
• Flags risky modes: world-writable files and setuid binaries are called out with the reason they matter.
• Converts several modes at once - paste a column of modes and get a comparison table.

• Fixing "Permission denied" on a script, a deploy artifact or an SSH key.
• Translating a mode from a Dockerfile, Ansible task or Terraform file into what it actually allows.
• Reviewing ls -l output during a security review or an audit finding.
• Setting up a shared directory and deciding between setgid and plain group permissions.
• Working out why SSH refuses a private key (it must not be group or world readable).
• Explaining to a teammate why 777 is not the fix.

1. Type an octal mode such as 755, or paste a symbolic string such as rw-r--r--.
2. Read the verdict for the one-line summary and the panel for the full breakdown.
3. Switch Applies to to "A directory" so the execute bit is explained as "enter" rather than "run".
4. Open the Permission matrix tab for the read/write/execute grid and any risk notes.
5. Copy the generated chmod command straight into your terminal or playbook.

FAQ

• What does chmod 755 mean? Owner can read, write and execute; group and others can read and execute. It is the standard mode for directories and for scripts that everyone needs to run.
• What is the difference between 644 and 600? 644 lets the owner write and everyone read. 600 restricts the file to its owner entirely, which is what SSH private keys, .env files and credential stores need on a shared machine.
• Why is chmod 777 a bad idea? It lets any user on the system modify the file. On a web server that turns a single compromised process into arbitrary code changes. Fix ownership or group membership instead.
• What is the sticky bit? On a shared directory such as /tmp it lets everyone create files but only the owner delete their own. It shows as a t in the others-execute position - drwxrwxrwt.
• What does setgid do on a directory? New files created inside inherit the directory's group rather than the creator's primary group, which is the usual way to make a shared project folder work. It shows as an s in the group-execute position.
• What does a capital S or T mean in ls -l? The special bit is set but the matching execute bit is not - for example rwSr--r-- is setuid without owner execute. It is almost always a mistake.
• Can I paste ls -l output directly? Yes. A leading type character (-, d, l, b, c, p, s) and a trailing ACL marker (+ or .) are both accepted and reported.