# chmod permissions explained: what 755, 644 and 777 actually mean

> Every file on Linux and macOS carries nine permission bits. chmod 755 sets them in one go, but only if you can read the number. This guide decodes the digits, lists the values you will use most, explains umask and the special bits, and shows why 777 is almost never the answer.

Published 2026-10-09 by Toolcloak. 5 minute read. Original: https://toolcloak.pages.dev/articles/chmod-permissions-explained-what-755-644-and-777-actually-mean
Related free tool: [Chmod Calculator](https://toolcloak.pages.dev/tools/chmod-calculator)

When you run `ls -l` you see something like `-rwxr-xr-x`. That string of ten characters is the whole access policy for the file: who may **read** it, who may **write** it and who may **run** it. `chmod` changes it. The three-digit number you type after it, such as 755, is just a compact way of writing those nine switches.

> **In short**
> - Permissions come in **three groups** (owner, group, others) and **three kinds** (read = 4, write = 2, execute = 1).
> - Add the numbers for each group. **7 = rwx**, **6 = rw-**, **5 = r-x**, **4 = r--**, **0 = ---**.
> - **755** is the usual value for programs and folders. **644** is the usual value for ordinary files. **600** is for private keys.
> - **777 lets everyone change the file.** It is rarely needed and often a security hole.

## Reading the permission string

Take `-rwxr-xr-x`. The first character is the file type (`-` for a normal file, `d` for a directory, `l` for a link). The next nine are three triplets, in this order: owner, group, others.

**-rwxr-xr-x, piece by piece**

1. **-.** A regular file. A `d` here would mean a directory.
2. **rwx.** Owner: can read, write and execute.
3. **r-x.** Group: can read and execute, but not write.
4. **r-x.** Others (everyone else): can read and execute, but not write.

*Written as numbers this is 7, 5, 5, so the command is `chmod 755 filename`.*

Try it: [Chmod Calculator](https://toolcloak.pages.dev/tools/chmod-calculator). Tick the boxes to get the octal number and the chmod command, or type a number to see the boxes.

## Why the numbers are 4, 2 and 1

Each triplet is three on-or-off switches, which is a three-digit binary number. Read is the left bit (4), write the middle (2) and execute the right (1). Adding the values you want gives a single digit from 0 to 7.

| Digit | Binary | Symbolic | Meaning |
| --- | --- | --- | --- |
| 0 | 000 | --- | No access |
| 1 | 001 | --x | Execute only |
| 2 | 010 | -w- | Write only |
| 3 | 011 | -wx | Write and execute |
| 4 | 100 | r-- | Read only |
| 5 | 101 | r-x | Read and execute |
| 6 | 110 | rw- | Read and write |
| 7 | 111 | rwx | Full access |

*Three digits, eight options each: 8 × 8 × 8 = 512 possible permission settings before the special bits.*

## The values you will actually use

| Mode | Symbolic | Typical use |
| --- | --- | --- |
| `644` | rw-r--r-- | Web pages, images, config files. Owner edits, everyone else reads. |
| `755` | rwxr-xr-x | Scripts, programs and folders. Everyone can run or enter, only the owner changes. |
| `600` | rw------- | SSH private keys, secrets. Only the owner can touch it. |
| `700` | rwx------ | Private folders and personal scripts. |
| `664` | rw-rw-r-- | Shared project files, where the group may edit. |
| `775` | rwxrwxr-x | Shared project folders for a team group. |
| `640` | rw-r----- | Files a service group may read but others may not, such as some logs. |
| `444` | r--r--r-- | Read-only for all, even the owner. |

*If you are unsure, start with 644 for files and 755 for folders and tighten from there.*

**How much access each common mode gives (read + write + execute bits set, out of 9)**

|  | Bits set |
| --- | --- |
| 600 | 2 |
| 644 | 4 |
| 664 | 5 |
| 755 | 7 |
| 775 | 8 |
| 777 | 9 |

*The more bits that are set, the more people can do. 777 sets all nine.*

## What the permissions mean on folders

On a folder the bits do slightly different jobs. This catches many people out.

**Read, write and execute on a directory**

| Box | What it means |
| --- | --- |
| Read (r) | You can list the names of the files inside, for example with `ls`. |
| Write (w) | You can create, rename and delete files inside. This works only together with execute. |
| Execute (x) | You can enter the folder and reach files whose names you know. Without it, the folder is closed. |
| Why 755 and not 644 | A folder at 644 cannot be entered, because the x bit is missing. That is why folders usually get 755. |

*A folder with read but no execute shows its file names but denies access to the files themselves.*

## Why 777 is a bad habit

A stubborn 'permission denied' error tempts people to run `chmod 777`. It works because it removes every barrier, including the ones that were protecting you. On a shared server or a website folder, any other user or any compromised process can now change or replace the file.

**Fixing a permission error**

| Quick but risky | Better |
| --- | --- |
| chmod 777 | Right owner, 755 or 644 |
| Anyone can edit or replace the file | Use `chown` so the right user owns the file |
| Uploaded malware can overwrite your scripts | Give only the access that is needed |
| Hides the real cause of the error | Fixes the cause, not the symptom |

*Most 'permission denied' errors are really about the wrong owner or group. Check with `ls -l` before changing the mode.*

## Symbolic mode: change one bit at a time

You do not have to type numbers. Letters let you add or remove a single permission without touching the rest.

| Command | What it does |
| --- | --- |
| `chmod u+x script.sh` | Give the owner (user) execute permission |
| `chmod go-w file` | Remove write from group and others |
| `chmod a+r file` | Give everyone read permission (a = all) |
| `chmod u=rw,go=r file` | Set exactly rw- for owner and r-- for group and others (same as 644) |
| `chmod -R 755 folder` | Apply 755 to the folder and everything inside it |

*Careful with -R. Setting 755 on every file makes data files executable, which is rarely what you want.*

## umask: the default for new files

New files do not start at 777. The system removes the bits named in the **umask**. A umask of 022 removes write from group and others, so new folders start at 755 and new files at 644. Files never start with execute, which is why you must chmod a new script yourself.

| umask | New folders | New files | Meaning |
| --- | --- | --- | --- |
| `022` | 755 | 644 | Common default. Others may read. |
| `002` | 775 | 664 | Group may write, used for shared teams. |
| `027` | 750 | 640 | Others get nothing. |
| `077` | 700 | 600 | Private. Only the owner has access. |

*Note the numbers are not a plain subtraction in every case. The umask switches bits off, so check the result with `ls -l`.*

## The special fourth digit

You may see four-digit modes like `4755` or `2775`. The extra leading digit sets three special bits.

**Special permission bits**

| When | What |
| --- | --- |
| 4 | setuid. A program runs with the rights of its owner, not the person who started it. `passwd` uses this. Dangerous on scripts. |
| 2 | setgid. On a program, it runs with the group's rights. On a folder, new files inherit the folder's group, useful for team folders. |
| 1 | sticky bit. On a folder, only a file's owner can delete it. `/tmp` uses this (mode 1777). |

*In the symbolic string these show as `s` in place of x for setuid and setgid, and `t` for the sticky bit.*

> **Keys need strict permissions:** SSH refuses to use a private key that other users can read, with a warning that the permissions are too open. Set it to 600, and the `.ssh` folder to 700.

## A quick checklist

1. **Look first.** Run `ls -l` to see the current owner, group and mode.
2. **Fix ownership before mode** when a service cannot read a file.
3. **Use 644 for files, 755 for folders and programs.**
4. **Use 600 or 700 for anything secret.**
5. **Avoid -R with 777.** Use `find` with `-type f` and `-type d` to set different modes for files and folders.

## Frequently asked questions

### What does chmod 755 mean?

It gives the owner read, write and execute (7), and the group and everyone else read and execute (5 each). It is the usual setting for programs and folders.

### What does chmod 644 mean?

The owner can read and write (6), while the group and others can only read (4). It is the usual setting for normal files such as web pages.

### Why is chmod 777 dangerous?

It lets every user on the system read, change and run the file. On web servers this can let attackers replace your files.

### How do I calculate a chmod number?

Add read = 4, write = 2 and execute = 1 for each of the owner, group and others. For example rw- is 4 + 2 = 6 and r-x is 4 + 1 = 5.

### What is umask?

It is a setting that removes permission bits from newly created files and folders. With a umask of 022, new folders are 755 and new files are 644.

### What do the first characters in ls -l mean?

The first character is the type: a dash for a file, d for a directory, l for a link. The next nine characters are the owner, group and others permissions.