DE EN IT

~/tools / chmod-calculator

chmod calculator

Tick permissions or type a value like 755 or rwxr-xr-x — you get the conversion, ready-made commands and warnings about risky values.

Permissions
Read (r, 4)Write (w, 2)Execute (x, 1)Owner (u)Group (g)Others (o)
Special bits

umask helper

daniele@mikweb: ~/tools — less chmod-calculator.md

How file permissions work

Every file has three sets of permissions: for the owner (u), the group (g) and others (o). Each set has read (r = 4), write (w = 2) and execute (x = 1). The values add up: rwx = 7, r-x = 5, r-- = 4. That is how rwxr-xr-x becomes 755.

On directories the bits mean something different: r lets you list the names, x lets you enter the directory and reach the entries, and w (together with x) lets you create, rename and delete entries. A directory without x is practically unusable.

The fourth, leading digit holds the special bits: setuid (4) and setgid (2) make a program run with the rights of its owner or group; on a directory under Linux, setgid makes new files inherit the directory's group. The sticky bit (1) means that in a directory only the file's owner, the directory's owner and root may delete or rename entries — as with /tmp (1777).

Typical values for servers and Nextcloud

  • 644 for regular files, 755 for directories and scripts — the usual setup for web content.
  • 600 for private keys and files with credentials, 700 for ~/.ssh. OpenSSH refuses to use a private key that others can read.
  • Nextcloud: the data directory is usually 750, config/config.php 640 (it holds the database password and secrets), the other files in the web root 644 and the directories 755. What matters just as much is ownership: data directory and configuration must belong to the user PHP runs as (often www-data) or to its group.
  • 664 / 775 only when a group really should write together — then combine it with setgid on the directory (2775).

Common mistakes

  • chmod -R 777 “fixes” every permission problem by giving everything to everyone. That is a security problem; the real cause is almost always the wrong owner — use chown, not a more open chmod.
  • chmod -R 755 or 644 on a whole tree: with 755 regular files become executable, with 644 directories lose their x and can no longer be entered. Directories and files need different values; the find pattern above does that (-type d for directories, -type f for files).
  • Missing x on a parent directory: the file itself may be 644 and still unreachable when a parent directory cannot be searched.
  • setuid/setgid on scripts: under Linux the kernel ignores setuid on shell scripts; on programs it is a security risk. Only set it when you know exactly why.
  • A capital S or T in the symbolic notation means the special bit is set but the matching x is missing — usually unintended.

umask and questions

New files start from 666, new directories from 777. The umask removes bits from that: with umask 022 files get 644 and directories 755, with umask 077 600 and 700. The helper above shows it for any umask.

What does the leading 0 in 0755 mean? It is the place for the special bits; 0755 and 755 are the same. Why is 777 dangerous? Any user on the system can change or replace the file — for scripts and web content that can lead to code execution. Does this apply to symlinks? No: the permissions of a symbolic link are not evaluated, those of its target are what counts.

Privacy

Runs entirely in your browser; nothing is sent or stored.

daniele@mikweb: ~/tools — ls

Tools

SPF checkerCounts the DNS lookups of your SPF record (limit: 10).DNS TTL plannerPlans the TTL reduction and the move time.Cron explainerExplains cron expressions and shows the next runs.DMARC generatorBuilds a valid DMARC record to copy.Mail DNS checkChecks MX, reverse DNS, SPF, DMARC and MTA-STS of a domain.Certificate checkExpiry, chain and names of a TLS certificate.Security headersGrades HSTS, CSP and other security headers.JWT decoderShows header, claims and expiry of a JWT — in your browser only.SAML decoderDecodes SAML responses and spots typical errors.nginx for NextcloudGenerates an nginx config for Nextcloud with PHP-FPM.Explain an errorPaste an error — meaning, causes and checks (AI).Base64 encode/decodeEncode and decode Base64, files and Basic-auth headers included — in your browser only.Subnet calculatorWorks out CIDR, netmask, wildcard and hosts for IPv4 and IPv6 and splits networks into subnets.Redirect generatorGenerates redirects for nginx and Apache (.htaccess) with a curl test.

← Tools