chmod Calculator

chmod is short for "change mode", the Unix command that changes the mode (permission bits) of a file or directory. It first appeared in AT&T Unix in the early 1970s and remains the standard way to set file permissions on Linux, macOS, BSD, and any other POSIX-compliant operating system. The related command chown changes the owner, and chgrp changes the group.

Both give the owner full read, write, and execute permissions. The difference is what the group and other (everyone else) can do. With 755 (rwxr-xr-x), the group and other can read and execute but cannot modify the file. This is the safe default for scripts, web files, and directories. With 777 (rwxrwxrwx), anyone on the system can read, modify, or replace the file, which is almost never what you want. Use 755 for executables and 644 for regular files; 777 should be a red flag in code reviews.

Private SSH keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519) require chmod 600, read and write for the owner only. Some users prefer chmod 400 to make the key read-only and prevent accidental edits. The ~/.ssh directory itself should be chmod 700, and authorized_keys should be chmod 600. If permissions are looser than this, SSH will refuse to use the key with a "permissions are too open" warning. Public keys (.pub files) can safely be chmod 644.

Use the -R (recursive) flag: chmod -R 755 mydir applies 755 to the directory and everything inside it. Be careful with recursive chmod on directories that mix files and subdirectories. Files usually need 644 while directories need 755 (because 'execute' on a directory means 'list contents'). A common idiom is: find mydir -type d -exec chmod 755 {} ; and find mydir -type f -exec chmod 644 {} ; to set them independently.

chmod 777 grants read, write, and execute permission to every user on the system, including the web server, other unprivileged accounts, and (on shared hosts) other tenants. Anyone who lands a shell on the box can modify the file, replace it with a malicious version, or execute it. For web applications, 777 on a directory means an attacker who can upload a file can also run it as a script. The fix is almost always to set the file's owner correctly with chown, then use 755 or 644.