Question 1

What does chmod 755 actually mean?

Accepted Answer

755 is three octal digits, one per identity class. The first
digit (7) is the owner, the second (5) is the group, the
third (5) is everyone else (others). Each digit is the sum
of three bits: read = 4, write = 2, execute = 1. So 7 is
4+2+1 = read + write + execute, and 5 is 4+0+1 = read +
execute (no write). 755 reads as "owner can read, write
and execute; group and others can read and execute but
not write" — the default for scripts you intend to run and
for directories you want others to enter and list.

Question 2

When should I use 644 vs 755 vs 600?

Accepted Answer

644 (rw-r--r--) is the right default for normal files —
source code, configs, documents. Owner edits, everyone
else reads. 755 (rwxr-xr-x) is for things that must be
executable: shell scripts, compiled binaries, and every
directory (directory "execute" means "you can cd into it
and stat names inside"). 600 (rw-------) is for files no
one but the owner should even read — SSH private keys,
credential files, .env. OpenSSH actively refuses to use a
private key with looser permissions than 600. 700
(rwx------) is the directory equivalent of 600: only the
owner can enter or list. If you remember three numbers,
remember these three.

Question 3

Why is 777 dangerous, and 4777 worse?

Accepted Answer

777 means everyone — every local user, every service
account, every process — can read, write, and execute
the file. That is rarely what you want and almost never
what you need; the usual reason it appears is somebody
was debugging "permission denied" and reached for the
biggest hammer. World-writable files can be replaced by
any other user on the box, which means anything that
later runs them runs attacker-controlled code. 4777 adds
setuid on top: a world-writable setuid-root binary is a
textbook local privilege-escalation — anyone overwrites
it with their own program and it runs as root the next
time it is invoked. If 777 looks like it solves your
problem, the real fix is almost always a smaller number
and the right owner / group.

Question 4

What are setuid, setgid and the sticky bit for?

Accepted Answer

They are three optional bits that sit above the regular
rwx triads and are shown by ls -l as letters in the
execute positions. setuid (octal 4xxx, symbolic s on
owner execute, e.g. rwsr-xr-x) means "when this file is
executed, run it as the file's owner, not the caller" —
this is how /usr/bin/passwd lets you change a root-owned
file. setgid (octal 2xxx, s on group execute) does the
same for the group, and on a directory it also forces new
files inside to inherit the directory's group, which is
how shared project folders stay shared. sticky (octal
1xxx, t on others execute) on a directory means only the
file's owner can rename or delete it — that is what keeps
/tmp safe even though it is world-writable. So 4755 is
setuid + 755, 2755 is setgid + 755, 1777 is sticky + 777
(which is exactly /tmp).

Question 5

What is the relationship between chmod and umask?

Accepted Answer

umask is the mask of bits to subtract from the default
permissions when a new file or directory is created;
chmod sets the permissions of a file that already exists.
A typical umask is 022, which means "remove group-write
and others-write from defaults"; defaults are 666 for
files and 777 for directories, so new files come out
666 & ~022 = 644 and new directories come out 777 & ~022
= 755. Set umask = 077 in your shell rc to make new files
owner-only (600 / 700). Note that umask is per-process,
inherited by child processes, and it cannot grant
permissions — only remove them. If you need to enforce
permissions after the fact, chmod is the tool.

Question 6

Does this tool send my values anywhere?

Accepted Answer

No. Conversion is three lines of arithmetic — parse
octal, build the rwx triads, build the ls -l line — all
running in the tab. No network requests, no analytics on
the values you type, no server round-trip. The page works
on an air-gapped jump host, behind a corporate proxy,
and on a plane. Open DevTools → Network and type any
value — zero outbound requests for the calculator itself.

Linux Permission (chmod) Calculator — Octal, Symbolic & ls -l, with Safety Warnings

Common presets

Plain-English explanation

What this tool does

Tool details

How to use

1. Input

2. Process

3. Copy / Download

How Linux Permission (chmod) Calculator fits into your work

File jobs

File checks

Good next steps

Real-world use cases

Fixing an SSH key that OpenSSH refuses to load

Reviewing a Dockerfile COPY that ships a setuid binary

Writing a runbook line non-Linux teammates can follow

Debugging a CGI script that returns 403 instead of running

Common pitfalls

Privacy

FAQ

Tool combos

Linux Permission (chmod) Calculator — Octal, Symbolic & ls -l, with Safety Warnings

Common presets

Plain-English explanation

What this tool does

Tool details

How to use

1. Input

2. Process

3. Copy / Download

How Linux Permission (chmod) Calculator fits into your work

File jobs

File checks

Good next steps

Real-world use cases

Fixing an SSH key that OpenSSH refuses to load

Reviewing a Dockerfile COPY that ships a setuid binary

Writing a runbook line non-Linux teammates can follow

Debugging a CGI script that returns 403 instead of running

Common pitfalls

Privacy

FAQ

awk + sed Cheatsheet

Stair Calculator

Nginx Cheatsheet

Docker Cheatsheet

curl Cheatsheet

Vim Cheatsheet

Number Base Converter

PX REM EM Converter

Aspect Ratio Calculator

Scientific Calculator

AI Eval Planner

Apache Cheatsheet