Every file on a Unix-like system carries a small set of permissions that decide who can read it, write to it and execute it. Those permissions are the reason a script sometimes refuses to run, a website sometimes returns a forbidden error, and a shared file sometimes opens for one colleague but not another. The notation looks intimidating at first: a string such as rwxr-xr-x, or a number such as 755, both describing the same thing. Once you see how the two notations map onto each other, the mystery disappears. The Chmod Calculator converts between symbolic form and numeric form, so you can check a permission in whichever notation you were given.

Permissions are organised around three groups of people. The owner is the user who owns the file. The group is a set of users grouped together, often a team or a project. Others means everyone else on the system. For each of those three groups, three switches exist: read, write and execute. Read lets you view a file's contents, or list a directory's contents. Write lets you change a file, or add and remove entries in a directory. Execute lets you run a file as a program, or enter a directory to reach files inside it. Three groups times three switches gives nine switches in total, and every permission setting is just a choice of which switches are on.

How the tool works

You enter a permission in either notation and the calculator shows the other one. Symbolic notation writes the nine switches as nine characters, grouped in threes: the first three for the owner, the next three for the group, the last three for others. Each position shows the letter r, w or x when that switch is on, or a dash when it is off. Numeric notation compresses each group of three switches into a single digit from 0 to 7, because three binary switches have exactly eight combinations. Read is worth 4, write is worth 2, and execute is worth 1, so you add the values of the switches that are on. The calculator runs in your browser and does this conversion in both directions, including the special bits described below.

The special bits are where many people get confused, so they are worth explaining carefully. Beyond the nine ordinary switches, three extra bits exist. The setuid bit, shown as s in the owner's execute position, makes a program run with the owner's privileges. The setgid bit, shown as s in the group's execute position, makes a program run with the group's privileges, and on directories it makes new files inherit the directory's group. The sticky bit, shown as t in the others' execute position, is most famous on shared directories, where it means users can only delete their own files. When a special bit is set, the numeric form gains a fourth digit in front, so 4755 means setuid plus 755, and 1755 means the sticky bit plus 755.

A worked example

Start with rwxr-xr-x. Split it into owner rwx, group r-x and others r-x. The owner has read (4) plus write (2) plus execute (1), which is 7. The group has read (4) plus execute (1), which is 5. Others have read (4) plus execute (1), which is also 5. The numeric form is therefore 755, and converting 755 back gives rwxr-xr-x. A second example: rw-r--r-- splits into rw- (4 plus 2, which is 6), r-- (4) and r-- (4), giving 644, the classic setting for an ordinary file that its owner can edit and everyone else can only read.

The special bits follow the same logic with the extra leading digit. The string rwsr-xr-x has an s in the owner's execute position, which signals setuid, and the underlying nine switches are still rwxr-xr-x, so the numeric form is 4755: the leading 4 stands for setuid, followed by 755. The string rwxr-xr-t has a t in the others' execute position, which signals the sticky bit, and the underlying switches are again 755, so the numeric form is 1755, with the leading 1 standing for the sticky bit. Working through these by hand once or twice is enough to make the notation feel mechanical rather than mysterious, and the calculator lets you check your hand calculation instantly.

Common mistakes

The most damaging mistake is setting permissions too loosely to fix a problem quickly. Making a file readable or writable by everyone, or setting 777 on a directory, may silence an error, but it also removes the protection the permissions were providing. The right fix is to work out which group needs which switch and set exactly that. A second mistake is confusing directory and file permissions. Execute on a directory does not mean running it; it means being allowed to reach files inside it, so a directory without execute permission is closed even to users who can read the files it contains in principle.

A third mistake is forgetting that the special bits exist when reading symbolic output. A lowercase s or t means the bit is set and the underlying execute switch is also on, while an uppercase S or T means the bit is set but the execute switch is off, which is usually a sign of a misconfiguration. A fourth mistake is applying permissions recursively without thinking. Changing every file under a directory to the same setting can accidentally make data files executable or strip execute permission from scripts that need it. Check what a recursive change will touch before you run it.

Honest limitations

A calculator converts notations; it does not inspect your system and it does not change any real file. It cannot tell you which permission a particular file on your server should have, because that depends on your application, your web server's user, and your team's workflow. It also does not cover access control lists, which are a finer-grained system that sits alongside the classic nine switches on many systems, nor does it audit whether your current permissions are safe. Use it to understand and translate permissions, and make the actual changes on your system deliberately, one file or directory at a time, testing as you go.

Closing

Permissions are nine switches and three special bits, and every setting you will ever meet is a combination of them. Learn the 4-2-1 addition, check your conversions with the calculator, and resist the urge to open everything up when something fails. The narrowest permission that lets the work happen is almost always the right one. For neighbouring jobs, the Password Generator and Hash Generator cover other small security tasks, while How to Configure HTTP Security Headers looks at the server side of keeping a site safe.