The common numbers, decoded
Every one of these is a trade between convenience and exposure. "What breaks" is what stops working if you go tighter; "what's exposed" is who gets in at this setting.
| Octal | Meaning | Typical use | What breaks / what's exposed |
|---|---|---|---|
| 644 | rw-r--r-- | Regular files: web pages, configs, documents | Everyone on the system can read it — fine for public content, wrong for anything with credentials. Nobody but the owner can change it. |
| 755 | rwxr-xr-x | Directories and executables/scripts | Everyone can enter the directory or run the program, but not modify it. The standard for web directories — going tighter (750) locks out the web server unless it's the group. |
| 600 | rw------- | Private files: SSH keys, credentials, mail | Nothing exposed — owner only. SSH actually refuses a private key looser than this, so "what breaks" at 644 is your login. |
| 700 | rwx------ | Private directories and scripts (~/.ssh) | Owner-only everything. Group collaborators are locked out — that's the point. |
| 664 | rw-rw-r-- | Group-edited files (shared project) | The whole group can modify — appropriate only when the group is deliberately curated. |
| 775 | rwxrwxr-x | Group-managed directories | Group members can add and delete files; the world can read. Pair with setgid (2775) so new files inherit the group. |
| 777 | rwxrwxrwx | Almost never the right answer | Every user on the system can modify or replace the file. On a shared host, that includes a compromised neighbor process rewriting your script. It "fixes" permission errors by removing the security that caused them — see the FAQ. |
Recursive chmod, and the files-vs-directories problem
The naive chmod -R 755 mydir/ makes every file executable too — which is how a web root ends up full of executable JPEGs. The problem: directories need execute (that's what "enter this directory" means), plain files usually shouldn't have it. Two clean solutions:
# Capital X: execute only for directories (and files already executable)
chmod -R u=rwX,g=rX,o=rX mydir/
# Or explicitly, with find:
find mydir/ -type d -exec chmod 755 {} +
find mydir/ -type f -exec chmod 644 {} +The capital X is the one-liner: it sets execute on directories but leaves regular files alone. It only exists in symbolic mode — there is no octal spelling of it, which is the single best argument for learning the symbolic syntax.
setuid, setgid, sticky — the fourth digit
A leading fourth octal digit sets the special bits: 4755 is setuid + 755. setuid on an executable runs it with the file owner's privileges regardless of who launches it — this is how passwd edits a root-owned file, and it's a serious security lever: a writable setuid-root binary is a system compromise. setgid on an executable does the same for group; on a directory it's benign and useful — new files inside inherit the directory's group, which is the standard fix for shared project folders (chmod 2775 shared/). sticky on a directory means users can delete only their own files even in a world-writable directory — it's why /tmp is 1777 and doesn't descend into chaos. The calculator above shows how these render in ls -l: a lowercase s/t when the underlying execute bit is also set, an uppercase S/T — almost always a mistake — when it isn't.
umask: why new files aren't 666
The umask is a subtractive filter applied when files are created: programs request 666 for files and 777 for directories, and the umask's bits are removed from that request. Calculate yours:
Common values: 022 (default on most systems — group and other lose write), 077 (private: only the owner gets anything), 002 (group-collaborative — group keeps write).
Frequently asked questions
Why is chmod 777 bad if it makes the error go away?
Because the error was a symptom and 777 deletes the alarm system. World-writable means any account on the machine — including a compromised service running as nobody — can replace your file's contents. On a web server that's the difference between "the upload folder didn't work" and "the upload folder now serves someone else's PHP." The correct fix is almost always narrower: identify which user needs access (usually the web server's user), then grant that via ownership (chown), group membership, or 755/644. If 777 fixes it, 755 with the right owner almost certainly fixes it too.
What's the "d" at the start of ls -l output?
The first character is the file type, not a permission: d for directory, - for a regular file, l for a symlink, b/c for block and character devices, s for a socket, p for a pipe. The nine characters after it are the three permission triplets this calculator edits. So drwxr-xr-x is a 755 directory — the d isn't part of the 755.
Numeric or symbolic — which should I use?
Numeric (chmod 644 file) sets the complete permission state in one shot — ideal in scripts and docs because the result doesn't depend on what was there before. Symbolic (chmod g+w file) makes relative changes — add group write, remove other read — without touching the rest, and it's the only way to get the capital-X directory trick. Rule of thumb: absolute states → numeric; surgical adjustments and recursion → symbolic. Both are shown live above, so you can learn each from the other.
I set execute on a directory — what does that even do?
On a directory the three bits mean different things: read lets you list the names inside, execute lets you enter it and access things inside (traverse), and write lets you create, rename, and delete entries. The odd consequence: execute-without-read means you can open files inside if you already know their names, but can't list them — occasionally used deliberately for drop-box style directories.