Linux File Permissions and chmod, Explained
What chmod 755, 644 and 777 mean: owner, group and others, read, write and execute, octal and symbolic modes, umask, setuid, setgid and the sticky bit.
By Udit Agarwal · Updated October 18, 2026
chmod 755 lets a file's owner read, write and execute it, and lets everyone else read and execute it but not change it. Every file and directory on Linux, macOS and other Unix-like systems carries three sets of permissions, for its owner, its group and all other users, and each digit of a mode such as 755 encodes one set as a sum of read (4), write (2) and execute (1). Learn that addition and every mode from 600 to 777 becomes readable.
Every file belongs to one user, its owner, and to one group. Its permissions cover three classes: the owner (u), the group (g) and others (o), meaning every other account, including those that services such as a web server run as. ls -l shows them:
-rwxr-xr-x 1 alice developers 2048 Oct 18 09:30 deploy.sh
After the type character (- for a file, d for a directory) come three triplets: rwx for alice, r-x for the group and r-x for everyone else. That is mode 755.
Only one class applies to a user, checked in order, so if you own the file the owner bits decide even when others get more: a file at 044 (----r--r--) is readable by everyone except its owner. Only the owner or root can change a mode, and chown and chgrp change the owner and group.
On a file, read lets you open it, write lets you change it and execute lets you run it as a program. A script needs read as well as execute, because its interpreter has to open the file, while a compiled program needs only execute. Deleting or renaming a file depends on write permission on its directory, not on the file's own bits, so a read-only file in a folder you can write to can still be deleted.
A directory is a list of names, and the same bits mean something different on it:
| Bit | On a directory it lets you |
|---|---|
| r | List the names inside (ls) |
| w | Create, delete and rename entries (together with x) |
| x | Enter it (cd) and reach the files inside by name |
The execute bit, also called search permission, is the one people forget. Without it nothing inside can be opened, not even your own files. With r but no x you can see the names in a directory but open none of them; with x but no r you can open a file whose exact name you know, but you cannot list the rest.
It is behind many "403 Forbidden" pages. To serve /var/www/example.com/index.html, the web server's user needs x on /, /var, /var/www and /var/www/example.com, plus r on the file. Miss one and nginx logs (13: Permission denied) while the visitor sees a 403; on Linux, namei -l with the full path shows the permissions of every step. The Nginx Config Generator uses a document root like this in its static mode, and HTTP status codes, explained covers the 403 itself.
Read is worth 4, write 2 and execute 1. A class's digit is the sum of the bits it has, so it runs from 0 to 7, exactly the range of one octal (base-8) digit:
| Digit | Built from | Symbolic | Meaning |
|---|---|---|---|
| 0 | 0 | --- |
No access |
| 1 | 1 | --x |
Execute only |
| 2 | 2 | -w- |
Write only |
| 3 | 2 + 1 | -wx |
Write and execute |
| 4 | 4 | r-- |
Read only |
| 5 | 4 + 1 | r-x |
Read and execute |
| 6 | 4 + 2 | rw- |
Read and write |
| 7 | 4 + 2 + 1 | rwx |
Read, write and execute |
The digits go owner, group, others. 755 is 7 (4 + 2 + 1, rwx) followed by 5 (4 + 1, r-x) twice, so rwxr-xr-x. 640 is 6 (4 + 2, rw-), 4 (r--) and 0 (---), so rw-r-----. Backwards, rwxr-x--- adds up to 7, 5 and 0, which is 750. Each digit is really three bits: 755 is the binary number 111 101 101, or 493 in decimal, as the Number Base Converter shows.
| Mode | Symbolic | Use it for |
|---|---|---|
| 644 | rw-r--r-- |
Ordinary files: web pages, images, most configuration |
| 755 | rwxr-xr-x |
Directories, and scripts or programs anyone may run |
| 600 | rw------- |
Secrets: SSH private keys, .env files, credentials |
| 700 | rwx------ |
Private directories such as ~/.ssh, personal scripts |
| 640 | rw-r----- |
Configuration a service's group must read and others must not |
| 664 / 775 | rw-rw-r-- / rwxrwxr-x |
Files and folders a team edits through a shared group |
| 777 | rwxrwxrwx |
Almost never (see below) |
For a website, 644 for files and 755 for directories is the usual starting point, with tighter modes for anything that holds a password. SSH insists on it: its manual says private keys must not be accessible by others, so a key left at 644 draws a "too open" warning and is ignored until you chmod 600 it. The SSH Key Generator creates a key pair in your browser; set the private key to 600 after you save it.
Octal sets every bit at once, while symbolic mode changes only the bits you name. It combines who (u, g, o, or a for all three), an operator (+ adds, - removes, = sets exactly) and the permissions (r, w and x, plus X, s and t):
| Command | Before | After |
|---|---|---|
chmod u+x deploy.sh |
644 rw-r--r-- |
744 rwxr--r-- |
chmod g-w report.txt |
664 rw-rw-r-- |
644 rw-r--r-- |
chmod a=r notes.txt |
755 rwxr-xr-x |
444 r--r--r-- |
chmod go-rwx secrets.txt |
644 rw-r--r-- |
600 rw------- |
chmod u=rwx,go=rx run.sh |
anything | 755 rwxr-xr-x |
Leave out the who, as in chmod +x script.sh, and the change applies to all three classes except the bits your umask blocks, as POSIX specifies. With the common umask 022, 644 becomes 755; with umask 077 it becomes 744.
Recursive changes need care. chmod -R 755 site/ makes every file executable, and chmod -R 644 site/ strips execute from the folder itself, locking out every ordinary user, the owner included. A capital X adds execute only to directories and to files that already have it, so this command leaves directories at 755 and ordinary files at 644:
chmod -R u=rwX,go=rX site/
A fourth digit in front adds the special bits: 4 for setuid, 2 for setgid and 1 for the sticky bit, which the POSIX chmod specification defines as 4000, 2000 and 1000. A leading 0 sets none of them, so 0644 and 644 are the same mode.
| Mode | ls -l shows |
Typical use |
|---|---|---|
| 4755 | rwsr-xr-x |
A program that runs as its owner, such as passwd |
| 2775 | rwxrwsr-x |
A shared folder whose new files keep the folder's group |
| 1777 | rwxrwxrwt |
/tmp: anyone may create files, only owners may delete them |
Setuid runs a program with its owner's identity instead of the caller's. On most Linux systems /usr/bin/passwd is owned by root with mode 4755, which is how ordinary users can update the root-owned password database. Linux ignores setuid on scripts, and because setuid-root programs attract attackers, find / -perm -4000 -type f is a routine audit.
Setgid on a directory (chmod g+s shared/) gives new files inside it the directory's group rather than the creator's, and on Linux new subdirectories inherit the bit, which keeps a 2775 team folder workable. The sticky bit on a directory (chmod +t shared/) lets only a file's owner, the directory's owner or root delete or rename that file, even though everyone may write to the directory.
In ls -l, an s replaces the owner's or group's x, and a t the others' x. An uppercase S or T means the execute bit underneath is missing, usually a mistake: 4644 shows as rwSr--r--.
Most programs ask for 666 (rw-rw-rw-) when they create a file and 777 for a directory, and the process's umask switches off every bit that is set in it:
| umask | New files | New directories | Typical use |
|---|---|---|---|
| 022 | 644 | 755 | A common default |
| 002 | 664 | 775 | Teams sharing a group |
| 027 | 640 | 750 | Hardened servers: nothing for others |
| 077 | 600 | 700 | Private: owner only |
The umask works on individual bits, so subtracting it from 666 goes wrong whenever one of its digits is odd. With umask 027 a new file comes out as 640, whereas 666 − 027 would give 637 and full access for others. umask shows your value (such as 0022), umask -S shows it symbolically (u=rwx,g=rx,o=rx), and umask 027 changes it for the current shell; add that line to your shell's startup file to keep it. Because programs rarely ask for execute, a script you have just written needs chmod +x before it will run.
Mode 777 lets every account on the machine change or replace a file and, on a directory, create, delete and rename anything inside. That includes the accounts services run as, so one weak spot is enough:
It can break sites too. Apache's suEXEC, which many shared hosts use, refuses to run a program that anyone else can write to, or one inside such a directory, so visitors get a server error instead of the page. Mode 666 on a file has the same weakness, minus execute.
Close the actual gap instead. If the web server (often the www-data or nginx user) must write to an uploads folder, make it the folder's owner or group with chown or chgrp and use 755 or 775, or 2775 for a folder a team shares, keeping files at 644 or 664.
The Chmod Calculator is a grid of nine checkboxes, read (4), write (2) and execute (1) for owner, group and others, plus three more for setuid (4), setgid (2) and the sticky bit (1), above an Octal field, a Symbolic field and a ready-made command. They stay in step: tick a box and the octal value, the rw-r--r-- string and the command change together, or type a mode into either field and the grid follows as soon as the mode is complete. It starts at 644. The Symbolic field also takes the string from ls -l, such as drwxr-xr-x or -rw-r--r--@, and ignores the file-type letter and a trailing @, + or .. The command reads like chmod 644 file and has a copy button; replace file with your path.
Special bits appear the way ls -l shows them: 4755 reads rwsr-xr-x, 1777 reads rwxrwxrwt and 4644 reads rwSr--r--. The Symbolic field accepts s and S in the owner and group execute slots and t and T in the others' slot. The fourth digit appears only when a special bit is set, and the command uses it, as in chmod 4755 file. On Linux, GNU chmod leaves a directory's setuid and setgid bits in place when given a mode such as 755, so to remove them from a directory use chmod g-s and chmod u-s, or a five-digit mode such as 00755.
While you type, a half-finished value such as 75 stays in its field and the grid keeps the last complete mode, and an impossible one, such as 758 or a t in the owner's slot, is explained instead of ignored. The calculator converts complete permission strings, not changes such as u+x, and the command never includes -R. Everything is calculated in your browser.
What does chmod 755 mean? The owner can read, write and execute (7 = 4 + 2 + 1), and the group and everyone else can read and execute (5 = 4 + 1) but not modify. It shows as rwxr-xr-x and is the usual mode for directories and for scripts others may run.
What is the difference between chmod 644 and 755? The execute bit. 644 (rw-r--r--) suits ordinary files that are read but never run, and 755 (rwxr-xr-x) suits directories and programs. A directory at 644 cannot be entered, and a script at 644 will not run directly.
Is chmod 777 ever safe? Rarely. A directory that everyone must write to should be 1777, like /tmp, so users cannot delete each other's files. Everywhere else, give the account that needs access ownership or group membership and use 775 or less.
What permissions should an SSH private key have? 600 (rw-------), or 400 to make it read-only, with the ~/.ssh directory at 700. ssh ignores a private key that other users can read. The matching .pub file can safely be 644.
How do I see a file's permissions as a number? On Linux, stat -c '%a %A %n' file prints something like 644 -rw-r--r-- file. On macOS, use stat -f '%Lp %Sp %N' file. ls -l shows only the symbolic form.
Why do I get "Permission denied" when the file is 644? A 644 file can be read by everyone but changed only by its owner. If reading fails, the usual culprit is a parent directory that lacks the execute bit for you; namei -l on the full path, or ls -ld on each parent directory, shows which one.
All Web & DevOps tools · All guides