chmod 755 Explained: Unix File Permissions Without the Guesswork

chmod 755 sets rwxr-xr-x — full control for the owner, read-and-execute for everyone else — and once you know that each digit is just read (4) + write (2) + execute (1) added up, every chmod number reads itself. Build any permission by clicking the read/write/execute boxes, or type a number and see what it grants, with the chmod calculator; here’s the whole system in five minutes.

The number is a sum

Unix gives every file three sets of permissions — for the owner, the group, and others (everyone else) — and each set has three bits: read, write, execute. The chmod number encodes them with a simple trick: read is worth 4, write 2, execute 1, and each digit is whatever you add up.

So the digit tells you the permissions at a glance:

Digit	Bits	Meaning
7	4+2+1	rwx — read, write, execute
6	4+2	rw- — read, write
5	4+1	r-x — read, execute
4	4	r— — read only
0	—	--- — no access

Read chmod 755 left to right: owner 7 (rwx), group 5 (r-x), others 5 (r-x) → -rwxr-xr-x, which is exactly what ls -l prints. The calculator converts both ways live — tick the boxes to get the number, or type the number to light up the boxes.

The values you’ll actually type

In practice a handful of modes cover almost everything:

• 644 (rw-r—r—) — ordinary files: documents, images, HTML, config. Owner can edit; everyone can read; nobody executes. The sensible default for content.
• 755 (rwxr-xr-x) — directories and executables. Owner has full control; others can read and execute. Directories need the execute bit — on a directory, “execute” means permission to enter it and access what’s inside, not “run it as a program”.
• 600 (rw-------) — private files. Only the owner can read or write; nobody else sees it. This is mandatory for SSH private keys — ssh refuses to use a key file that others can read.
• 700 (rwx------) — a private directory, entering and listing restricted to the owner.

Why chmod 777 is a red flag

777 grants read, write and execute to everyone — the file is now world-writable. It’s the classic “just make it work” move, and it’s almost always wrong:

• On any shared host, world-writable means any other account — including a compromised one — can overwrite your file. It’s a genuine security hole, and it’s why web servers and many tools refuse to run scripts that are group- or world-writable.
• When something “only works with 777”, the actual problem is usually ownership, not permissions. The web server runs as a different user than the one who uploaded the files, so the right fix is chown (change the owner to the service account) with a tight mode like 644/755, not opening the file to the entire machine.

If you’re reaching for 777, pause and ask who needs access — the answer is usually one specific user or group, which chown/chgrp plus 644/755 handles cleanly.

The fourth digit: setuid, setgid, sticky

chmod modes sometimes have a leading fourth digit for special bits:

• Setuid (4) — an executable runs with the permissions of its owner, not the user launching it. passwd uses this so ordinary users can update the root-owned password file. 4755 is 755 plus setuid.
• Setgid (2) — runs as the file’s group; on a directory, new files inside inherit that group, which is handy for shared project folders.
• Sticky bit (1) — on a shared-writable directory like /tmp (mode 1777), it restricts deletion so only a file’s owner can remove it, even though everyone can write there.

These are powerful and occasionally dangerous (a setuid-root binary with a bug is a privilege escalation), so use them deliberately. The chmod calculator includes the special bits and shows how, say, 4755 differs from 755 in the symbolic string (the x becomes s).

Quick summary

chmod permissions are three sets — owner, group, others — of read (4), write (2), execute (1), summed into each digit. 755 (rwxr-xr-x) is the norm for directories and programs, 644 for files, 600 for private keys; the execute bit on a directory means “enter”, not “run”. Treat 777 as a warning sign that the real fix is ownership. Convert any mode both ways, special bits included, with the chmod calculator — and while you’re automating server tasks, the cron expression parser does the same demystifying for schedules.

Sources: GNU coreutils — chmod manual · Linux man-pages — chmod(1) and chmod(2) · Filesystem Hierarchy Standard.