The converter
| read r=4 | write w=2 | execute x=1 | |
|---|---|---|---|
| owner | |||
| group | |||
| other |
chmod 644 file
Paste an ls -l line
A full line or just the 10/11-character mode field — permbits reads the type character, the s/S/t/T letters and the trailing + ACL marker.
Apply symbolic chmod clauses
Type a clause list like u+x, go-w, a=rX or u=rw,go= and see it applied to the current mode, changed slots marked. Copy-from-class forms like u=g are not supported and say so.
Umask
The umask is subtracted (bitwise) from what programs ask for: files request 666, directories 777.
Cited recipes
The situations people actually search — each with the exact command, a one-line why, the upstream citation and the date we verified it. Entries that vary by system are marked beta: load them, then edit the octal to match your system.
Tip: printing this page produces a one-page cheat sheet of all 24 recipes.
The reference — 12 cited facts
Special bits, umask arithmetic, the ls -l layout — each fact carries a verbatim quote from POSIX, the GNU Coreutils manual or the relevant man page.
FAQ
What does chmod 755 mean?
755 is rwxr-xr-x: the owner can read, write and execute; group and others can read and execute but not write. On a directory, execute means permission to enter and traverse it. It is the standard mode for web directories and executable scripts.
How do I fix “UNPROTECTED PRIVATE KEY FILE”?
Run chmod 600 on the key (chmod 400 for AWS .pem keys). OpenSSH refuses private keys other users can read. The recipe above cites the exact upstream wording.
What is the difference between 777 and 755?
777 lets every local user write to the file — almost never safe, and permbits flags it. 755 keeps write for the owner only. If 777 “fixes” a web-server error, the real problem is usually ownership, not permissions.
Does permbits work offline? Is my input private?
Yes. This is a static page whose Content-Security-Policy is connect-src 'none' — the browser itself blocks any network send. Your input never leaves this device; only your last mode and recent recipes are kept in this browser’s localStorage.
What permbits deliberately does not do
- Classic POSIX mode bits only. The trailing + ACL marker in ls -l is recognised and explained, but ACLs, SELinux/AppArmor contexts, capabilities and Windows permissions are out of scope — use getfacl/setfacl and friends.
- It cannot read or modify real files. It produces a command you run yourself — verify against your own system.
- Recipes cite upstream man pages and vendor docs with a verified-on date; distro packaging can differ (e.g. /etc/shadow), and such entries are flagged beta — load them, check your system, and edit the octal to override.
- ls -l parsing targets POSIX/GNU output; for exotic or localised formats paste just the 10-character mode field.
- Symbolic clauses cover the everyday grammar (ugoa, +-=, rwxXst, comma lists); copy-from-class forms like u=g are rejected with a clear message. Clauses with no who letter (like +x) are treated as a here; real chmod additionally masks those with your umask. On directories, = follows GNU chmod and preserves setuid/setgid unless you mention s — POSIX leaves this implementation-defined, so some systems clear them (use u-s/g-s to clear explicitly).
- No ownership: chown/chgrp are different tools for a different job.