Convert between 9-bit mode, octal, symbolic, and decimal

Permission bits, three ways.

Tap the 9-bit permission grid (owner, group, other × read, write, execute) and watch octal, symbolic, and decimal values stay in sync. Read-only, no login.

Unix file permissions and chmod numbers

On Linux, macOS and other Unix systems, every file and directory has three sets of permissions: one for its owner, one for its group and one for everyone else. Each set can allow reading, writing and executing. The chmod command changes them, and it accepts either a three-digit octal number such as 644 or a symbolic form such as u+x.

Tick the boxes in the permission grid and this calculator shows the octal number, the symbolic string you would see in ls -l and the decimal value. You can also type an octal number to see what it allows.

How to use it

Tick read, write and execute for owner, group and other, or type an octal mode such as 755.
Read the octal value to use in chmod, for example chmod 644 notes.txt.
Check the symbolic string: it matches the permissions column of ls -l.
Before applying a mode, make sure write for other stays off unless you really mean it.

Example: the four modes you will use most

Input

Output

644: -rw-r--r--
755: -rwxr-xr-x
600: -rw-------
777: -rwxrwxrwx

644 is the usual mode for ordinary files, 755 for scripts and directories, 600 for private files such as SSH keys. 777 lets anyone change the file and is almost never right.

How the octal digits work

Each digit is the sum of three values: read is 4, write is 2 and execute is 1. So 7 is read, write and execute; 6 is read and write; 5 is read and execute; 4 is read only; 0 is nothing. The first digit is the owner, the second the group and the third everyone else. 640 therefore means the owner can read and write, the group can read, and others have no access.

Execute means something different on directories

On a file, execute allows running it as a program. On a directory, it allows entering the directory and reaching the files inside, while read allows listing their names. A directory with read but no execute shows names you cannot open, which is why directories almost always have execute wherever they have read: 755 or 700, not 644.

Safe defaults

SSH refuses to use a private key that others can read, so keys need 600 and the .ssh directory 700. Web server files are usually 644 with directories 755, owned by a deploy user rather than the web server process. When something fails with permission denied, resist the urge to run chmod 777: find which user needs access and grant exactly that.

This calculator covers the nine standard bits. The special setuid, setgid and sticky bits form an optional fourth digit in front, as in 1777 for the shared /tmp directory.

Questions

What is the dash at the start of the symbolic string?

It is the file type position in ls -l output. A dash means a regular file; directories show d there instead.

Do permissions work on Windows?

Windows uses access control lists instead. Tools like Git for Windows and WSL emulate Unix modes, but the octal numbers only fully apply on Unix file systems.

Why does a new file get 644 by default?

Programs usually create files with 666 and your umask, commonly 022, removes write for group and others, leaving 644.