chmod Calculator

Unix file modes divide basic access among the owning user, the owning group, and everyone else. Each class receives some combination of read, write, and execute permission. The same bits have different practical effects on regular files and directories, which is why copying a familiar file mode onto a directory can break access.

For a regular file, read permits its contents to be read, write permits its contents to be changed, and execute permits it to be run when the file format and system allow it. On a directory, read lists names, write changes directory entries, and execute provides search or traversal. Reading a directory without traversal may reveal names while still preventing access to the entries.

• Octal modes such as 640 replace the base owner, group, and others bits with one compact value.
• Symbolic assignments such as u=rw,g=r,o= express the same selected base bits in a form that is often easier to review.
• Special bits add set-user-ID, set-group-ID, or sticky behavior. Their effect depends on object type and platform policy.

A mode is only one part of access control. File ownership, parent-directory traversal, access control lists (ACLs), security labels, mount options, and service policy can grant, restrict, or change effective access. Recursive changes add another hazard: one mode can make ordinary data files executable or remove traversal from directories, while followed symlinks or a mistaken root path can extend the operation far beyond the intended target.

How to Use This Tool:

Build and review one exact permission change before running it in a shell.

1. Enter a three- or four-digit Octal mode, or use the permission matrix to select owner, group, others, and special bits. Only digits 0 through 7 are valid.
2. Choose whether the target is a regular file or directory, then select a Review profile. The profile is a comparison prompt, not a universal recommendation.
3. Enter the target path and choose Portable POSIX or GNU Coreutils plus octal or explicit symbolic command style. Shell-sensitive paths are single-quoted in the preview.
4. Enable Recursive change only when every object in the tree should receive the same mode. Review Symlink traversal; P avoids following directory symlinks.
5. Read every Review check, inspect the target with stat, namei, and ACL tools when available, then test the command on a narrow path before broader use.

Interpreting Results:

The generated command is a quoted preview. It is not executed and cannot confirm that the current user owns the target, the platform accepts every option, or the resulting effective access is correct.

• Ready means no configured high or review condition fired. It is not a security approval.
• Review flags a condition such as recursive use, missing owner traversal on a directory, or execute bits on ordinary web content.
• High review covers wider-write and privilege combinations, unsafe symlink traversal, or an unguarded recursive root target.
• The changed-bit count compares the selected mode with a repository-authored profile baseline. Confirm ownership, ACLs, service needs, and host policy even when the count is zero.

Technical Details:

An octal permission digit is a three-bit value. Read has weight 4, write has weight 2, and execute or search has weight 1. Three ordinary digits describe owner, group, and others. A leading fourth digit uses the same weights for set-user-ID, set-group-ID, and sticky.

Formula Core:

For each owner, group, or others class, let r, w, and x be 1 when the bit is present and 0 when absent. The octal digit is:

Thus 6 is read plus write, 5 is read plus execute, and 0 grants none of the three base permissions. A three-digit input is normalized internally with a leading zero for the absent special-bit digit, but the displayed command omits that zero.

Transformation Core:

Each class is converted independently to an explicit assignment. Mode 0644 becomes u=rw,g=r,o=r. Selected special bits are appended as u+s, g+s, or o+t. The chosen mode token and a safely single-quoted path are then placed into the command preview; recursive GNU previews may also include --preserve-root.

Rule Core:

Profile baselines are 644/755 for general and web file/directory pairs, 600/700 for private material, and 660/2770 for group-shared material. They are comparison aids rather than standards.

Safety and Platform Limits:

• No filesystem is inspected. The preview cannot see ownership, existing mode, ACLs, SELinux or AppArmor labels, parent-directory permissions, mount behavior, or whether the path is a symlink.
• Special-bit behavior and symlink handling vary by operating system and filesystem. Review the local chmod manual before using non-portable options.
• Applying one numeric mode recursively replaces base bits on both files and directories. Use a file-aware method such as a reviewed find procedure when the two object types need different modes.
• Inspect the command text and target path in a trusted shell. A generated preview cannot protect against an operator copying the wrong command or running it with excessive privilege.

Worked Examples:

References:

• chmod: Change access permissions, GNU Coreutils 9.11.
• Setting Permissions, GNU Coreutils 9.11.
• How to change file and folder permissions in Linux, Simplified Guide.
• How to check file and folder permissions in Linux, Simplified Guide.