chmod Explained: Reading and Writing Unix File Permissions
What 755 and 644 actually mean, how numeric and symbolic permissions map to each other, and when you need setuid, setgid, or the sticky bit.
The first time chmod 755 fixes a broken deploy, it feels like a magic spell. You copy it off Stack Overflow, the 500 error goes away, and you move on without ever learning what the number meant. That works until the day 755 is the wrong answer and you have no idea why. The Chmod Calculator turns the number into something you can actually read.
Three digits, three audiences
Every Unix file carries permissions for three groups of people: the owner, the owner’s group, and everyone else. That’s what the three digits in 755 are, left to right: owner, group, others.
Each digit is a sum of three values:
- read = 4
- write = 2
- execute = 1
Add up the ones you want. Read plus write is 6. Read plus execute is 5. All three is 7. Nothing is 0. So 755 reads as: owner gets everything (7), group and others get read and execute (5 and 5). In symbolic form that same mode is rwxr-xr-x, which is just the nine on/off switches spelled out.
The modes you’ll actually type
You don’t need to memorize all 512 combinations. In practice a handful cover almost everything:
- 644 (
rw-r--r--) — a normal file. Owner edits it, everyone else reads it. Config files, HTML, images. - 755 (
rwxr-xr-x) — scripts, programs, and directories. The execute bit on a directory means “you’re allowed to enter it,” which trips people up constantly. - 600 (
rw-------) — private files. Your SSH key lives here. If it’s readable by anyone else,sshwill refuse to use it. - 700 (
rwx------) — a directory only you can open.
That directory execute bit deserves a second look. A folder set to 644 looks readable, but you can’t cd into it or list its contents properly, because on directories “execute” means “traverse.” I’ve watched people spend twenty minutes debugging a permissions error that a single +x on the folder would have fixed.
Symbolic mode, when numbers get tiring
Numeric mode replaces the whole permission set at once. Sometimes you only want to nudge one bit, and that’s where symbolic mode earns its keep:
chmod +x script.sh— make it executable, leave everything else alonechmod u+w file— give the owner write accesschmod go-r secret.txt— take read away from group and others
The difference matters. chmod 700 says “set it to exactly this.” chmod +x says “add this one thing to whatever’s already there.” On a shared file, the second one is a lot safer.
The fourth digit nobody explains
Occasionally you’ll see a four-digit mode like 4755 or 1777. That leading digit controls the special bits:
- setuid (4) runs a program as its owner instead of as you. This is how
passwdcan edit/etc/shadowwhile you can’t. - setgid (2) does the same for the group, and on a directory it makes new files inherit the folder’s group — handy for shared project directories.
- sticky bit (1) protects a shared directory.
/tmpis1777: anyone can create files, but you can only delete your own. Without it, any user could wipe another’s temp files.
These are worth understanding rather than copying blindly, because a stray setuid bit on the wrong binary is a genuine security hole.
Check before you run it
Permissions are one of those things where a wrong guess is silent until it isn’t — a leaked key, a script that won’t run, a web server throwing 403. Type a mode into the Chmod Calculator and it shows you the symbolic string, the ls -l line, the exact command, and a plain-English note on who can do what. Read that once, then run the command with a clear conscience.