Chmod Permission Generator
Build, decode, and understand Linux file permissions.
Generate, decode, and understand Linux chmod permissions. Convert between numeric and symbolic modes, preview permission changes, and copy safe chmod commands.
What is chmod?
chmod (short for “change mode”) is the Unix and Linux command used to control who can read, write, or execute a file or directory. Every file has an owner, belongs to a group, and is visible to everyone else on the system — chmod sets what each of those three groups is allowed to do with it.
You can run chmod with a numeric mode (chmod 755 file) or a symbolic one (chmod u=rwx,g=rx,o=rx file) — both set the exact same permissions, just written differently. This tool keeps both forms in sync so you can work in whichever one you're more comfortable with.
How Linux permissions work
Read, write, and execute
Every permission set is built from three flags. Read lets you view a file's contents, or list a directory's entries. Write lets you modify a file's contents, or create, delete, and rename entries inside a directory. Execute lets you run a file as a program or script, or — for a directory — enter (traverse) it at all.
Owner, group, and others
Permissions are set separately for three classes: the owner (usually whoever created the file), the group it belongs to (often shared by a team or service), and others — everyone else with access to the system. Each class gets its own read/write/execute combination, which is exactly what the permission matrix above lets you configure.
Numeric chmod permissions explained
Numeric (octal) mode adds up the values of the permissions you want: read is worth 4, write is worth 2, and execute is worth 1. Add whichever apply for a single digit per class — for example, read + write + execute is 4 + 2 + 1 = 7, and read + execute is 4 + 1 = 5. Three digits in a row — owner, group, others — give you a mode like 755.
| Digit | Permission | Symbol |
|---|---|---|
| 0 | No permission | --- |
| 1 | Execute | --x |
| 2 | Write | -w- |
| 3 | Write + Execute | -wx |
| 4 | Read | r-- |
| 5 | Read + Execute | r-x |
| 6 | Read + Write | rw- |
| 7 | Read + Write + Execute | rwx |
Symbolic permissions explained
Symbolic mode spells out the same information as nine characters — read, write, execute (or a dash for “not granted”), repeated for owner, group, and others. rwxr-xr-x means the owner has full access while the group and others can read and execute but not write.
chmod also accepts an exact assignment form, u=rwx,g=rx,o=rx, which sets each class explicitly rather than describing the end state — this is the form the tool generates as your “exact assignment” command.
Common chmod examples
| Command | Meaning | Action |
|---|---|---|
chmod 644 index.html | A regular file readable by everyone, writable by the owner | |
chmod 755 script.sh | A script or public directory, executable by everyone | |
chmod 600 id_rsa | A private key or secret, accessible only to the owner | |
chmod 700 ~/private-scripts | A private directory, accessible only to the owner | |
chmod 664 shared-doc.txt | A file the owner and group can both edit | |
chmod 775 public/uploads | A directory the owner and group can both write to | |
chmod 444 archive.log | A read-only file, not even the owner can write |
File vs directory permissions
The same three flags mean something different depending on what they're applied to. On a file, read/write/execute map fairly literally to viewing, editing, and running it. On a directory, execute controls whether you can enter it at all, read controls whether you can list what's inside, and write controls whether you can create, delete, or rename entries — which means a directory without execute permission is effectively unusable even if read and write are both granted.
Use the target-type selector in the builder above to switch between file, directory, and executable context — the explanation panel adapts its wording accordingly.
Setuid, setgid, and the sticky bit
Beyond the three standard permission digits, chmod supports an optional fourth, leading digit for three special bits: setuid(4), running an executable with its owner's privileges regardless of who runs it; setgid (2), running with the file's group privileges, or on a directory, making new entries inherit that directory's group; and the sticky bit(1), which on a directory restricts deleting or renaming files inside to their own owner, the directory's owner, or root.
Symbolically, these show up as a lowercase s or t when the matching execute bit is also set, and an uppercase S or T when it isn't — for example rwsr-xr-x (4755) versus rwSr-xr-x (4655).
Why chmod 777 is dangerous — and recursive chmod safety
chmod 777grants full read, write, and execute access to the owner, the group, and every other user on the system. In practice that means any local user or any process running as any other user can read, modify, replace, or run the file — including a compromised service account. It's rarely the correct fix for a permission error, even though it always makes the error disappear.
chmod -Rapplies one literal mode to every file and directory inside a path, without distinguishing between them. That commonly makes ordinary files executable when they shouldn't be, or strips execute permission that directories actually need to be entered. Prefer applying directory and file permissions separately for a mixed tree — for example with find … -type d -exec chmod 755 {} + and find … -type f -exec chmod 644 {} + — and always review what a recursive command will touch before running it.
More developer tools
Setting file permissions is usually one step in a bigger deployment or repo setup. If you're scripting a deploy, the Cron Expression Builder helps schedule what runs after permissions are set. Keeping generated files, keys, or logs out of version control is easier with the .gitignore Generator. And for more free tools like this one, browse the full Developer Resources Directory.
Common questions
What's the difference between 755 and 0755?+
Nothing — they're the same permission. The leading 0 is just an explicit way of saying "no setuid, setgid, or sticky bit," which is the default when you write a 3-digit mode like 755.
Does this tool support relative operators like u+x, g-w, or a+r?+
No. This builder only parses absolute symbolic forms — a full rwxr-xr-x string, or an explicit assignment like u=rwx,g=rx,o=rx. Relative operators aren't genuinely supported, so the tool flags them with a clear message instead of silently guessing what they'd change.
Why does pasting -rwxr-xr-x or drwxr-xr-x still work?+
The leading character in output like ls -l (a dash for a regular file, d for a directory, l for a symlink, and so on) describes the file type, not a permission. This tool recognizes and strips that character automatically, and tells you it did so — it's never part of the actual chmod value.
Is chmod 777 ever the right answer?+
Almost never for anything other than truly temporary, disposable test files. 777 makes a file or directory writable and executable by every user on the system, which means anyone with local access can modify or replace it. Nearly every case that seems to call for 777 is actually a group-ownership or path problem underneath.
What do setuid, setgid, and the sticky bit actually do?+
Setuid makes an executable run with its owner's privileges instead of the caller's. Setgid does the same for group privileges on executables, and makes new files inside a directory inherit that directory's group. The sticky bit, set on a directory, restricts deleting or renaming files inside it to their owner, the directory's owner, or root — even when the directory itself is group- or world-writable.
Does recursive chmod apply the exact same mode to files and directories?+
Yes — chmod -R applies one literal mode to everything inside the path, files and directories alike. That's often not what you actually want, since directories typically need execute permission to be entered while regular files usually shouldn't be executable. This tool warns you whenever recursive mode is enabled for exactly that reason.
Is my path or generated command sent anywhere?+
No. Every calculation — numeric and symbolic conversion, the security check, and the command text itself — happens locally in your browser with plain JavaScript. Nothing you type is uploaded, stored on a server, or sent to analytics, and this tool never executes anything on your machine.
Can I share a configuration with a teammate?+
Yes — the Share button copies a URL with your current mode, context, path, and recursive setting encoded as query parameters. Opening that link restores the exact same configuration.
More free resources
Have a project in mind? Let's build it.
Tell us about your goals and we'll get back to you within one business day with next steps.
Book a free call