chmod 755, 644 and 600 explained
Three digits decide who can read, change and run a file on Linux and macOS. Once you see they are just added-up flags, every chmod number reads like a sentence.
How the digits add up
| Digit | Letters | Means |
|---|---|---|
| 7 (4+2+1) | rwx | read, write, execute |
| 6 (4+2) | rw- | read, write |
| 5 (4+1) | r-x | read, execute |
| 4 | r-- | read only |
| 0 | --- | nothing |
Each digit is one octal (base 8) number, which is really three bits. That is why the number base converter turns 755 in octal into 111 101 101 in binary: one bit per letter in rwxr-xr-x.
The common numbers
| Mode | Letters | Use it for |
|---|---|---|
755 | rwxr-xr-x | Directories, scripts and programs other users may run |
644 | rw-r--r-- | Ordinary files: web pages, images, most config |
700 | rwx------ | Private directories such as ~/.ssh |
600 | rw------- | Private keys, .env files, anything with a password in it |
640 | rw-r----- | Secrets a service reads through its group |
777 | rwxrwxrwx | Almost never: anyone on the machine can change or replace it |
Directories are different
On a directory, r lets you list the names inside, w lets you create, rename and delete files in it, and x lets you enter it and reach the files at all. Without x on every directory along the path, even a readable 644 file is out of reach. That is why directories are usually 755 and files 644, and why chmod -R 644 on a folder breaks it. To set them separately:
find site/ -type d -exec chmod 755 {} +
find site/ -type f -exec chmod 644 {} +
chmod u+x deploy.sh # just add execute for the owner
chmod -R u=rwX,go=rX site/ # capital X: execute only on directories (and files already executable)Two errors this fixes
SSH: “WARNING: UNPROTECTED PRIVATE KEY FILE! Permissions 0644 are too open.” SSH refuses a key that others can read. Fix it with chmod 600 ~/.ssh/id_ed25519 and chmod 700 ~/.ssh.
nginx or Apache: “403 Forbidden”. The web server runs as its own user (often www-data or nginx), so it needs read on the files and x on every directory above them, including your home directory if the site lives there. namei -l /path/to/file shows the permissions of each step. More on that error in HTTP 401 vs 403.
umask: where the defaults come from
New files start from 666 and new directories from 777, and the umask removes bits. The usual umask 022 removes write for group and others, which gives the familiar 644 files and 755 directories. A umask of 077 makes everything you create private.
The fourth digit
A leading extra digit sets special bits: 4 setuid (run as the file’s owner, as passwd does), 2 setgid (new files in a directory inherit its group), 1 sticky (in a shared directory only a file’s owner can delete it). /tmp is 1777 for exactly that reason. In ls -l these show up as s or t in place of an x.
Seeing permission denied on /var/run/docker.sock? That one is about group membership, not chmod: see Docker socket permission denied.
Script won’t run even though you can read it? See ./script.sh: Permission denied.
Questions
What does chmod 755 mean?
rwxr-xr-x: the owner can read, write and execute; the group and everyone else can read and execute but not change it. It is the usual mode for directories and scripts.
Is chmod 777 safe?
Rarely. Any user or compromised process on the machine can then modify or replace the file. Fix the owner or group instead, for example with chown, and use 755 or 775.
What is the difference between 644 and 755?
755 adds execute. Files that are not programs should be 644; directories need 755 so people can enter them.
Why does my script say Permission denied?
It probably lacks the execute bit. Run chmod u+x script.sh, or start it with bash script.sh, and check the file system is not mounted with noexec.
Published .