Reading chmod Like a Sentence: A Linux Permissions and chmod Calculator Guide

The first time chmod 755 made sense to me, I stopped guessing. Before that I treated those three digits like a magic number you copied from Stack Overflow and prayed over. They are not magic. They are a tiny sentence about who can do what to a file, and once you can read the sentence out loud you never have to look it up again. This guide walks through exactly how that sentence is built, how to translate between the symbolic form (rwxr-xr-x) and the octal form (755), what the special bits do, and why 777 is the number that gets servers compromised.

If you want to follow along without doing arithmetic in your head, keep the Linux Permission (chmod) Calculator open in another tab. Type any form and the other two update live.

Three audiences, three digits

Every regular file and directory on Linux carries permissions for three classes of user, always in this order:

owner — the single user who owns the file (usually whoever created it)
group — the file's group; every member of that group shares these permissions
others — literally everyone else with an account on the machine

When you write 755, the digits line up with those three classes left to right: the 7 is the owner, the first 5 is the group, the last 5 is others. Three audiences, three digits, in a fixed order. That part never changes, so the only thing left to learn is what a single digit means.

The read 4, write 2, execute 1 math

Each digit is a sum of three permission bits:

read = 4 — see the file's contents, or list a directory's entries
write = 2 — change the file, or add and remove names in a directory
execute = 1 — run the file as a program, or cd into and traverse a directory

You add up only the permissions you want, and the total is one octal digit. Because 4, 2, and 1 are powers of two, every combination produces a unique number from 0 to 7, with no overlap:

| Octal | Bits | Symbolic | Meaning | |------:|------|----------|---------| | 7 | 4+2+1 | rwx | read, write, execute | | 6 | 4+2 | rw- | read, write | | 5 | 4+1 | r-x | read, execute | | 4 | 4 | r-- | read only | | 0 | — | --- | no access |

So a 7 for the owner means read + write + execute, and a 5 for the group means read + execute with no write (4 + 0 + 1). Stitch three of those together and you have the whole permission set. That is the entire conversion. If you ever need to convert the underlying numbers between octal, binary, and decimal to see why the math lands where it does, the base converter shows the same bits in every radix.

Worked example: 644 and 755, both ways

Two values cover most of what you type at a shell. Let's translate each one in both directions.

644, octal to symbolic. Owner digit is 6 = 4 + 2 = read + write = rw-. Group digit is 4 = read only = r--. Others digit is 4 = read only = r--. Concatenate the triads: rw-r--r--. Read it as a sentence: the owner can read and write, the group can read, everyone else can read, and nobody but the owner can change it. That is the correct default for ordinary files — source code, config, documents.

755, octal to symbolic. Owner digit is 7 = 4 + 2 + 1 = rwx. Group is 5 = 4 + 1 = r-x. Others is 5 = 4 + 1 = r-x. Together that is rwxr-xr-x. The owner can read, write, and run; group and others can read and run but not modify. This is the value for shell scripts, compiled binaries, and every directory — because a directory's execute bit is what lets you enter it and stat the names inside.

Now run it backwards, symbolic to octal. Take rwxr-xr-x and chop it into three groups of three: rwx / r-x / r-x. For each group, add 4 for r, 2 for w, 1 for x, and 0 for a dash. First group rwx = 4 + 2 + 1 = 7. Second r-x = 4 + 0 + 1 = 5. Third r-x = 5. The answer is 755. The ls -l line just prepends a file-type character, so a directory at 755 shows as drwxr-xr-x and a regular file at 644 shows as -rw-r--r--.

The fourth digit: setuid, setgid, and sticky

Sometimes you'll see a four-digit value like 4755. That leading digit is a separate set of special bits that sit on top of the regular triads, and it follows the same add-the-values logic:

setuid = 4 — when an executable runs, it runs as the file's owner, not as the user who launched it. This is how /usr/bin/passwd lets an ordinary user edit a root-owned file. In symbolic form it shows as an s in the owner's execute slot: rwsr-xr-x.
setgid = 2 — same idea for the group. On a directory it also forces new files inside to inherit the directory's group, which keeps shared project folders shared.
sticky = 1 — on a directory, only a file's owner can rename or delete it, even if others can write to the directory. This is exactly what keeps /tmp (mode 1777) safe despite being world-writable.

So 4755 is setuid + 755 = rwsr-xr-x, 2755 is setgid + 755, and 1777 is the sticky bit plus 777 — the precise permission set of /tmp. The fourth digit is just one more sum of 4, 2, and 1, applied to a different row of bits.

Why 777 is dangerous

777 means owner, group, and others all get read, write, and execute — rwxrwxrwx. It nearly always shows up because someone hit "permission denied," reached for the biggest hammer, and moved on. The problem is what world-writable actually grants: any local user, service account, or compromised process on the box can overwrite that file. Anything that later runs it then runs whatever code the attacker dropped in.

4777 is worse because it stacks setuid on top. A world-writable, setuid-root binary is a textbook local privilege escalation: an attacker overwrites it with their own program, and the next time it executes, their code runs as root. If 777 looks like the fix for your problem, the real fix is almost always a smaller number plus the right owner — for example chown www-data:www-data file followed by chmod 644 file. Set the permissions to match who genuinely needs access, not to silence the error.

A quick mental checklist before you ever type 777:

Does others really need write, or just the owner and group?
Would chown to the correct user solve it without loosening anything?
Is this an executable? If so, world-write plus execute is a loaded gun.

Keep the cheat sheet close

You don't have to memorize tables. Remember three numbers — 644 for files, 755 for scripts and directories, 600 for private keys — and the read 4, write 2, execute 1 math to derive anything else. When you're knee-deep in a deploy and just want the symbolic form, the octal form, and the ls -l line side by side with a red warning on the dangerous values, the chmod calculator does the arithmetic so you can stay focused on the fix.

Made by Toolora · Updated 2026-06-13