What does chmod 755 mean?

Each digit is a sum of read (4), write (2), and execute (1) for one class of user: owner, group, others, in that order. 755 is 7 (4+2+1, rwx) for the owner and 5 (4+1, r-x) for group and others: the owner can do everything, everyone else can read and execute but not modify. It is the standard mode for directories, scripts, and binaries. 644 is the file equivalent: owner reads and writes, everyone else only reads, and nobody executes. If translating digits in your head gets old, the chmod calculator on this site converts between octal, symbolic, and checkbox form.

Why is chmod 777 bad?

777 gives every user on the system write access, so any process or account, including a compromised web app, can replace the file with anything. On a web server that turns one small exploit into a persistent backdoor. 777 is usually reached for when the real problem is ownership: the web server runs as www-data but the files belong to root or your user. The correct fix is chown -R www-data:www-data on the writable directories plus 755/644 modes, or adding your user to the right group with 775/664. The only mostly-legitimate 777-style mode is 1777 on /tmp, where the sticky bit stops users deleting each other's files.

What permissions does an SSH key need?

The private key must be readable by you alone: chmod 600 ~/.ssh/id_ed25519 (400 also works and is what AWS suggests for .pem files). The ~/.ssh directory itself needs 700, authorized_keys on the server needs 600, and your home directory must not be group- or world-writable. OpenSSH enforces this: a private key with loose permissions is refused with an UNPROTECTED PRIVATE KEY warning, and a server with StrictModes (the default) silently ignores authorized_keys when the path to it is too open, which shows up as Permission denied (publickey).

What is the difference between chmod and chown?

chmod changes what the existing owner, group, and others may do with a file (its mode: read, write, execute). chown changes who the owner and group are: chown alice:developers file.txt. They solve different halves of a problem: if the web server cannot write uploads, the usual fix is chown to the server's user, not chmod 777. chown needs root, because giving files away has security implications; chmod only needs you to own the file. chgrp is the group-only subset of chown that you can run on your own files for groups you belong to.

How do I chmod all files in a directory recursively?

chmod -R applies a mode to everything under a directory, but one number is usually wrong for a tree: files want 644 and directories want 755, because execute on a directory means permission to enter it, and 644 directories become untraversable while 755 files become needlessly executable. Either run two find commands, find dir -type d -exec chmod 755 {} + and find dir -type f -exec chmod 644 {} +, or use the capital X in one pass: chmod -R u+rwX,go+rX dir, which sets execute only on directories and files that are already executable.

chmod Cheat Sheet: Numbers 755, 644 & Recursive (2026)

Octal Numbers

Three digits: owner, group, others. Each digit adds read 4, write 2, execute 1. Decode or build any mode with the chmod calculator.

Digit	Meaning
	rwx: read, write, execute
	rw-: read and write
	r-x: read and execute
	r--: read only
	---: nothing

The modes that cover almost every real case:

Command	When to use it
	Directories, scripts, binaries: owner full, others read and enter
	Normal files: owner edits, others read
	Private files: owner only (SSH keys, credentials)
	Private directories: owner only
	Read-only key files (AWS .pem)
	Group-writable directory for a team
	Group-writable file
	Almost never right; see Web Server Permissions below

Symbolic Syntax

Who ( owner, group, others, all), then add, remove, set exactly, then , , .

Command	What it does
	Owner may execute
	Everyone may execute (the usual "make it runnable")
	Remove write from group and others
	Everyone gets exactly read, nothing else
	Same as 755, spelled out
	Let the group write
	Others get nothing
	Capital X: execute on directories only (see Recursive)

Make a File Executable

Command	What it does
	Make a script executable
	Run it (the is required outside PATH)
	Confirm:

The first line of the script should name its interpreter ( or ), or you will get or the wrong shell.

Recursive Changes

hits every file and directory, and one number is usually wrong for one of them: makes directories unenterable, makes every file executable.

Command	What it does
	Everything 755 (fine for a tree of scripts, wrong for docs)
	Directories to 755 only
	Files to 644 only
	One pass: X sets execute on dirs (and already-executable files) only

More find patterns in the find cheat sheet.

Directories vs Files

The same three letters mean different things on a directory.

Bit	On a file	On a directory
	Read the contents	List the file names
	Modify the contents	Create, rename, delete entries inside
	Run it as a program	Enter it () and reach files inside

Deleting a file needs on the directory, not on the file. A directory without blocks access to everything under it no matter what the files say.

setuid, setgid, Sticky Bit

A fourth leading digit, or / in symbolic form.

Command	What it does
	setuid: runs as the file's owner (how edits /etc/shadow)
	setgid on a directory: new files inherit its group
	Sticky bit: anyone writes, only owners delete their own files
	setuid, symbolic
	setgid, symbolic
	Sticky bit, symbolic
	List every setuid binary (audit)

In , setuid/setgid show as in the owner/group execute slot and the sticky bit as at the end ( on /tmp). A capital or means the bit is set but execute is missing, which is usually a mistake.

SSH Key Permissions

OpenSSH refuses keys and ignores when permissions are loose. Full command list in the SSH cheat sheet.

Command	What it does
	The .ssh directory, both ends
	Private key (fixes "UNPROTECTED PRIVATE KEY")
	Public key
	On the server; ignored if too open
	Client config
	AWS-style read-only key

If key auth fails even with these set, check the home directory is not group-writable, then work through Permission denied (publickey).

Reading ls -l Output

-rwxr-xr--  1 alice developers  4096 Sep  5 10:30 deploy.sh

Type, then three triads: owner , group , others . That file is 754.

First character	Meaning
	Regular file
	Directory
	Symlink

Command	What it does
	Long listing with permissions
	The directory itself, not its contents
	Show the octal mode (GNU/Linux)
	Show the octal mode (macOS)

A trailing means ACLs are set ( shows them); on macOS means extended attributes.

chown and chgrp

chmod changes what is allowed; chown changes who the owner is.

Command	What it does
	Change the owner
	Owner and group at once
	Recursive, the web-uploads fix
	Group only (works without root for your own files)
	See current owner and group

umask

umask decides the default mode of new files: files start from 666 and directories from 777, minus the mask.

Command	What it does
	Show the current mask (022 is the common default)
	New files 644, new directories 755
	New files 600, new directories 700 (private by default)
	Group-writable: files 664, directories 775

Set it in or to make it stick.

Web Server Permissions

The convention on Debian/Ubuntu (nginx and Apache run as ; on RHEL it is or ):

Command	What it does
	Server owns its files
	Directories 755
	Files 644
	Writable dirs: group-writable, with the right group

When an app "needs" 777 to work, the real problem is ownership: the process user cannot write because it does not own the path. to the process user (or share a group) and keep 755/644. 777 hands write access to every account on the box.

Options and Flags

Option	What it does
	Recursive
	Report every file touched
	Report only files that actually changed
	Silence error messages
	Copy another file's mode (GNU)
	Change a symlink itself instead of its target (macOS/BSD)

Fixing chmod Errors

Error	Fix
(you own it, still fails)	Immutable flag: then (Linux); then (macOS)
on macOS system paths	SIP protects them; you cannot chmod /System and friends
	You do not own the file: , or fix ownership with chown
chmod "works" but nothing changes	FAT32/exFAT/NTFS mounts have no Unix permissions; set them at mount time with /
	Remount first:

macOS and Windows

Environment	Situation
macOS	Same chmod (BSD flavour); everything above works, flags differ as shown
Windows (native)	No chmod; is the closest equivalent
Windows (WSL, Git Bash)	chmod works on Linux paths; on NTFS mounts it is mostly a no-op
Git anywhere	Git tracks only the execute bit; sets it in the index

chmod Cheat Sheet