Reading permissions as octal
Unix permissions break into three groups — owner, group, others — each with three bits: read (4), write (2), execute (1). Add the bits per group and you get one octal digit:
| Octal | Bits | Symbolic | Means |
|---|---|---|---|
| 7 | 4+2+1 | rwx | read, write, execute |
| 6 | 4+2 | rw- | read, write |
| 5 | 4+1 | r-x | read, execute |
| 4 | 4 | r— | read only |
So 755 = owner rwx, group r-x, others r-x. This calculator converts between the octal form and the symbolic rwxr-xr-x form interactively, with checkboxes for each bit.
The common values worth memorizing
| Mode | Use |
|---|---|
644 | Regular files (owner edits, others read) |
755 | Directories and executables/scripts |
600 | Private files — SSH keys, secrets |
700 | Private directories (~/.ssh) |
600 and 700 matter for security: SSH refuses to use a private key that’s readable by other users, so chmod 600 ~/.ssh/id_ed25519 is a required step, not optional.
Special bits
A fourth leading octal digit sets special permissions: setuid (4) runs an executable as its owner, setgid (2) runs as the group owner (or makes new files in a directory inherit the group), and the sticky bit (1) restricts deletion in a shared directory to each file’s owner — which is why /tmp is 1777. So chmod 1755 is 755 plus the sticky bit.
When the mode looks right but access is denied
If permissions seem correct but access still fails, look beyond the mode: extended ACLs (getfacl) or SELinux contexts (ls -Z) can override standard permissions, and on a mounted FAT/NTFS filesystem chmod may have no effect at all. The namei -l /path/to/file command shows the permissions of every directory along the path, which usually reveals the missing traverse bit. This tool calculates Unix/POSIX permissions; Windows uses a different ACL-based system entirely.