Chmod Calculator

The permission model

Every file has one owner, one group, and everyone else (others). Each of the three gets its own read / write / execute flags — nine bits total. ls -l prints them as three rwx triads after the type character: -rwxr-xr-- means a regular file (-), owner rwx, group r-x, others r--. The rule that applies to you is the first one that matches — if you're the owner, only the owner triad counts, even if it's more restrictive than the others.

Octal is just addition

Each triad is one octal digit: read = 4, write = 2, execute = 1. Add what you want: rwx = 7, r-x = 5, r-- = 4 — hence 754. Three digits, owner-group-others, always in that order.

Files vs directories — the x surprise

The bits mean different things on directories:

bit	on a file	on a directory
`r`	read the contents	list the filenames
`w`	modify the contents	create, delete, rename entries — even files you don't own
`x`	run it as a program	traverse into it (cd, open files inside)

A directory with r but not x lets you see names but touch nothing; x without r lets you open files inside if you already know their names. Directories almost always want r-x together.

The special bits (the 4th octal digit)

setuid (4000) — an executable runs with its owner's identity instead of yours. It's how passwd edits a root-owned file. Shown as s in the owner's x slot (S if x is off — almost always a mistake). On modern systems setuid on shell scripts is ignored.
setgid (2000) — on executables, same idea with the group. On directories it's genuinely useful: new files inherit the directory's group — the standard trick for shared project folders.
sticky (1000) — on a world-writable directory, only a file's owner can delete it. That's why /tmp is 1777 (drwxrwxrwt).

Common recipes

mode	use
`755`	directories and executables — owner full, everyone else read/traverse
`644`	ordinary files — owner writes, everyone reads
`600`	private files — SSH keys, credentials (ssh refuses keys looser than this)
`700`	private directories — `~/.ssh`
`2775`	shared group directory with setgid inheritance
`1777`	world-writable drop box with sticky protection — /tmp

umask — why new files aren't 777

The umask subtracts bits from what programs request. With the usual 022, a program creating a file as 666 gets 644, a directory requested as 777 gets 755. Check yours with umask; a stricter 077 makes everything private by default.