Stop guessing chmod values
It’s 11pm, your deployment is broken, and you need to figure out if the permission on that config file should be 644 or 640. You know owner needs read-write, group needs read, and others should get nothing, but translating that to an octal number in your head while SSH’d into a production server isn’t great.
Toggle the checkboxes here. The octal value, symbolic notation (rw-r-----), and the actual chmod command update in real time. Or go the other direction: type 755 and see exactly what permissions that grants.
The permissions you’ll actually use
755 (rwxr-xr-x), Your default for directories and executable scripts. Owner can do everything, everyone else can read and execute.
644 (rw-r--r--), Standard for regular files. Owner reads and writes, everyone else just reads. This is what most HTML, CSS, and config files should be.
700 (rwx------), Owner only. Lock out everyone else. Your .ssh directory better be this.
600 (rw-------), Owner reads and writes, nobody else touches it. SSH keys that aren’t 600 will be rejected by ssh with a “permissions too open” error. Ask me how I know.
777 (rwxrwxrwx), The “I don’t care about security” setting. Every user on the system can read, write, and execute. Never use this in production. When you see it in a Stack Overflow answer, keep scrolling.
444 (r--r--r--), Read-only for everyone. Good for files that should never be modified.
How the math works
Each digit is a sum of three values: 4 for read, 2 for write, 1 for execute. So 7 = 4+2+1 (read, write, execute), 5 = 4+1 (read, execute), 6 = 4+2 (read, write), 0 = nothing.
Three digits, three levels: owner, group, others. 754 means owner gets rwx, group gets r-x, others get r--.
One thing that trips people up: execute on a directory means you can cd into it and access its contents. Without execute, you can’t enter the directory, even if you have read permission. That’s why directories are typically 755 and not 644.
Works the same on macOS, Linux, and any Unix-like system. The Number Base Converter can help if you want to see the binary behind these octal values.
FAQ
What’s the difference between 644 and 755?
644 doesn’t include execute permission. Use 644 for regular files (config, HTML, text). Use 755 for directories and scripts that need to run.
Why does SSH reject my key?
Your private key file needs to be 600 (or 400). If group or others have any access, ssh refuses to use it. Run chmod 600 ~/.ssh/id_rsa and try again.
Does this work for macOS?
Yes. macOS is Unix under the hood, same chmod, same permission system, same octal values.
Should I ever use 777?
Basically never. Maybe temporarily while debugging on a dev machine. In production, it’s a genuine security risk, any process on the system can modify your files.