The basics

How chmod numbers work

Every file has three sets of permissions: one for the owner, one for the file’s group, and one for others (everyone else). Each set is a single digit made by adding up these values:

4 = Read (r)

View the contents of a file, or list the files inside a folder.

2 = Write (w)

Change or delete a file, or create, rename and delete files inside a folder.

1 = Execute (x)

Run a file as a program or script, or open (cd into) a folder.

So 7 is 4 + 2 + 1 (read, write and execute), 5 is 4 + 1 (read and execute), and 6 is 4 + 2 (read and write). Put the three digits together, owner first, and you get a mode like 755.

Cheat sheet

Common chmod permissions

Mode	Symbolic	Who can do what	Typical use
`644`	`rw-r--r--`	Owner reads and writes; everyone else reads	Regular files, web pages, images
`755`	`rwxr-xr-x`	Owner has full access; everyone else reads and executes	Folders, scripts and programs
`600`	`rw-------`	Only the owner can read and write	SSH private keys, secrets, config files
`700`	`rwx------`	Only the owner has any access	Private folders like `~/.ssh`
`664`	`rw-rw-r--`	Owner and group read and write; others read	Files shared by a team group
`775`	`rwxrwxr-x`	Owner and group have full access; others read and execute	Shared project folders
`400`	`r--------`	Only the owner can read; nobody can write	Read-only keys, like AWS .pem files
`777`	`rwxrwxrwx`	Everyone can do everything	Almost never. It’s a security risk

Command line

chmod command examples

Make a script executable

chmod +x deploy.sh

Set a folder and everything in it

chmod -R 755 public_html

Files 644 and folders 755 (typical website)

find . -type f -exec chmod 644 {} + && find . -type d -exec chmod 755 {} +

Lock down your SSH folder and key

chmod 700 ~/.ssh && chmod 600 ~/.ssh/id_ed25519

Check the current permissions with ls -l, or see the numeric mode directly with stat -c %a filename on Linux (stat -f %Lp filename on macOS). Be careful with -R: it applies the same mode to files and folders, which usually isn’t what you want. Want to run a script on a schedule? Build the timing with our Cron Expression Generator.

Symbolic mode

Using letters instead of numbers

chmod also accepts letters. Pick who: u (owner), g (group), o (others) or a (all). Then an operator: + adds, - removes and = sets exactly. Then the permissions: r, w and x.

chmod u+x file lets the owner run it
chmod go-w file removes write access for group and others
chmod a=r file makes it read-only for everyone
chmod u=rwx,g=rx,o= dir is the same as 750

Special permissions: setuid, setgid and sticky bit

An optional fourth digit at the front sets special permissions:

4 = setuid. A program runs with its owner’s permissions. Shown as s in the owner’s execute spot.
2 = setgid. On a folder, new files inherit the folder’s group. Shown as s in the group’s execute spot.
1 = sticky bit. On a shared folder like /tmp, users can only delete their own files. Shown as t.

A capital S or T means the special bit is set but execute isn’t, which is usually a mistake.

FAQ

chmod questions, answered

What does chmod 755 mean?

The owner can read, write and execute (7), while the group and everyone else can read and execute (5). It is the standard permission for folders, scripts and programs. In symbolic form it is rwxr-xr-x.

What does chmod 644 mean?

The owner can read and write (6), and the group and everyone else can only read (4). It is the standard permission for regular files like web pages, images and documents. In symbolic form it is rw-r–r–.

Is chmod 777 safe?

Almost never. 777 lets every user on the system read, change and run the file, so a bug in any other program or website on the server could be used to modify it. Fix the file’s owner with chown or use 755 or 775 instead.

What permissions should an SSH private key have?

Use 600 so only you can read and write it, and 700 for the .ssh folder itself. If a private key is readable by others, SSH refuses to use it and shows an UNPROTECTED PRIVATE KEY FILE warning.

What is the difference between chmod and chown?

chmod changes what the owner, group and others are allowed to do with a file. chown changes who the owner and group actually are.

Why do folders need execute permission?

For folders, execute means you can enter the folder and access files inside it. Without it, you can’t cd into the folder or open its files, even if you have read permission.

Setting up SSH on a new server?

Create an Ed25519 or RSA key in your browser, then lock it down with chmod 600.

Open the SSH Key Generator

Chmod Calculator