Chmod Explained: How Linux File Permissions Actually Work
Every file and folder on a Linux, macOS or Unix system carries a small set of rules that decides who may open it, who may change it and who may run it. The command that changes those rules is called chmod, short for change mode, and the rules themselves are called permissions or the mode. When a website suddenly shows a forbidden error, when a script refuses to run, or when a shared folder will not let a teammate save their work, permissions are almost always the cause — and almost always the fix takes less than a minute once you understand the pattern. Chmodly exists to make that pattern obvious: tick boxes, read the number, copy the command. This guide explains the thinking behind the grid so the numbers stop feeling like magic codes you have to memorise.
Three audiences, three actions
Permissions are organised around three audiences. The owner is the single user account that owns the file, usually whoever created it. The group is a named collection of users — a team, a class, a department — and a file belongs to exactly one group at a time. Others means literally everyone else with access to the machine: every other account, and by extension any process running under those accounts. Against each audience the system checks three possible actions. Read allows a file to be opened and copied, and allows a folder to be listed so you can see the names inside it. Write allows a file to be edited or truncated, and allows files inside a folder to be created, renamed or deleted. Execute allows a file to be run as a program or script, and — in a famous source of confusion — allows a folder to be entered, which means execute on a folder really means traverse or open. A folder with read but no execute shows you names you cannot actually reach, while a folder with execute but no read lets you open files only if you already know their exact names. Keeping the three audiences and three actions separate in your mind is the whole game; everything else is notation.
Where the numbers come from: the 4-2-1 trick
The octal notation that chmod is famous for looks arbitrary until you see the arithmetic. Each action is assigned a power of two: read is 4, write is 2 and execute is 1. For one audience you simply add the values of the actions you want to grant. Read plus execute is 4 plus 1, which is 5. Read plus write is 6. Everything together is 7, nothing at all is 0, and write alone is 2. Because each combination of three switches produces a unique total from 0 to 7, one digit captures an entire row of the grid with no ambiguity. Do that three times — owner, group, others, always in that order — and you have the classic three-digit mode. When someone says a file is 754, they are saying the owner can do everything (7), the group can read and execute (5), and everyone else can only read (4). The grid in Chmodly performs exactly this addition live, and typing a number performs it backwards, lighting up the same boxes, so you can move between thinking in switches and thinking in digits without friction.
Reading the symbolic form: rwxr-xr-x
The other notation you will meet everywhere is the symbolic or letter form, printed by commands such as ls -l. It shows nine characters in three blocks of three. Within each block the positions are always read, write, execute, and a dash means the action is denied. So rw- means read and write but no execute, while r-x means read and execute but no write. A leading tenth character, when present, describes the type of thing you are looking at: a dash for a plain file, d for a directory and l for a symbolic link. Chmodly accepts that leading character when you paste a symbolic string, and it also understands the special letters s and t that appear in the execute positions when setuid, setgid or the sticky bit are involved — a lowercase letter means the special bit and execute are both on, an uppercase letter means the special bit is on but execute is off, a combination that usually signals a mistake worth fixing.
The presets worth remembering
Although 512 combinations are possible, daily life uses a handful. The mode 755 is the workhorse for folders and executable scripts: owner everything, everyone else read and execute. The mode 644 is its partner for ordinary files: owner read and write, everyone else read only. Together they describe the default posture of most web servers, which is why uploading a site so often involves exactly these two numbers. The mode 600 locks a file down to its owner alone and is the right choice for private keys, credential files and personal notes; its folder equivalent, 700, makes a directory completely private. For team work, 775 and 664 extend write access to the group while keeping the rest of the world read-only or out entirely. The mode 444 makes a file read-only for everyone, useful for templates and frozen releases you do not want edited by accident — although remember that the owner of a folder can still delete a read-only file inside it, because deletion is governed by the folder permissions, not the file. Chmodly ships all of these as one-tap presets with a plain-English note on each, so you choose by intent rather than by memory.
Why 777 keeps causing trouble
No mode attracts more warnings than 777, the setting that grants every action to every audience, and Chmodly flags it with an unmissable warning for good reason. Tutorials suggest it constantly because it reliably makes permission errors disappear — of course it does, it removes permission as a concept. The cost is that any account on the machine, and any compromised program running under any account, can rewrite or replace the file. On shared hosting, one neighbour with a vulnerable site can use your world-writable files as a doorway into your own site. On a team server, a stray script can overwrite things nobody intended to share. There is nearly always a narrower fix: if a web server needs to write uploads, give the specific folder group write with 775 and the right group ownership, or use 755 and let the application own its working directory. If a one-off experiment on your own laptop genuinely needs 777, treat it like leaving your house keys in the door — fine for five minutes while you stand there, never as the permanent arrangement, and change it back the moment the test ends.
Special bits: the mysterious fourth digit
Sometimes you will see four digits, such as 4755 or 1777. The leading digit packs three extra switches using the same addition pattern: setuid is 4, setgid is 2 and the sticky bit is 1. Setuid makes an executable run with the permissions of its owner rather than whoever launched it — the classic example is the password-changing program, which must update a protected system file on behalf of ordinary users. Setgid does the same for the group, and on a folder it makes new files inherit that folder group, which quietly solves endless shared-directory headaches. The sticky bit, famous from the system temporary folder, means that inside a shared directory only a file owner can delete their own files, even when everyone has write access to the directory itself. These bits are powerful and narrow; most everyday files need none of them, which is why Chmodly tucks them into their own row, shows the fourth digit only when one is switched on, and still keeps the main grid front and centre.
Applying changes safely: targets, recursion and checking your work
A chmod command names a mode and a target, as in chmod 644 report.pdf. Add the capital flag -R and the change becomes recursive, flowing into a folder and everything beneath it. Recursion is convenient and dangerous in equal measure: it applies the same digits to files and folders alike, so a recursive 755 stamps execute onto innocent text files, and a recursive mistake can lock a whole tree or fling it wide open. Careful administrators often set folders and files separately with the find command instead. Whatever route you take, verify afterwards with ls -l and compare the letters against what you intended — Chmodly helps here too, because pasting the symbolic output back into the calculator should light exactly the boxes you chose. Also remember what chmod does not do: it does not change who owns a file (that is chown), it cannot override a read-only filesystem, and on systems using access control lists or mandatory security frameworks the simple grid is only part of the story. Finally, type target names carefully — a wildcard in the wrong folder is the permission equivalent of sending an email to the whole company.
A calm workflow for permission problems
When something refuses to open or run, resist the urge to reach for the broadest setting. First, find out who you are and who owns the file; most mysteries dissolve at this step, because the process hitting the error is often a server account rather than you. Second, decide the smallest change that expresses the real intention — perhaps the group needs read, or the owner needs execute — and build that mode in the grid. Third, apply it to the smallest target that covers the problem, test immediately, and only widen if the evidence demands it. Keep a note of the original mode before you change anything so you can restore it in seconds. Used this way, chmod stops being a superstition you copy from forum answers and becomes what it was designed to be: a tiny, precise language for saying exactly who may do what. Bookmark Chmodly, tick the boxes, read the sentence it writes about your choice, and copy a command you actually understand.
Frequently Asked Questions
What does chmod 755 mean?
Chmod 755 gives the owner full read, write and execute access (7), while the group and everyone else get read and execute only (5 and 5). In symbolic form that is rwxr-xr-x. It is the most common setting for folders and executable scripts because the owner can change things while visitors can safely browse and run them.
Why is chmod 777 dangerous?
Chmod 777 grants read, write and execute access to absolutely everyone, shown as rwxrwxrwx. Any account or compromised process on the machine can modify, replace or delete the file, which makes 777 a serious security risk on shared hosting and servers. Almost every problem blamed on permissions can be fixed with 755, 775 or 644 instead.
How do I convert rwx permissions to a number?
Give read a value of 4, write a value of 2 and execute a value of 1, then add the values for each group of three letters. For example rwx adds up to 7, r-x adds up to 5 and r-- adds up to 4. Do this separately for owner, group and others and place the three totals side by side to get the octal mode, such as 754.
What is the difference between 644 and 755?
Chmod 644 (rw-r--r--) is for regular files: the owner can read and write, everyone else can only read, and nobody can execute the file. Chmod 755 (rwxr-xr-x) adds execute for everyone, which folders need so people can open them and scripts need so they can run. A quick rule is files get 644 and folders get 755.
What do setuid, setgid and the sticky bit do?
These are three special bits shown as a fourth leading digit. Setuid (4) runs a program with the file owner rights, setgid (2) runs it with the group rights or makes new files inherit the folder group, and the sticky bit (1) stops people deleting files they do not own inside a shared folder, like /tmp. Together they turn 755 into forms such as 4755, 2755 or 1755.
How do I apply permissions to a folder and everything inside it?
Add the capital -R flag, for example chmod -R 755 myfolder, and chmod walks through the folder applying the mode to every file and subfolder inside it. Use it carefully: it gives files the same mode as folders, so executable bits can land on ordinary documents. Many people run separate find commands for files and folders when precision matters.