Chmod & Umask Calculator
Convert between octal and symbolic permissions, plus why umask 022 gives 644 for a file and 755 for a directory — and why it is not subtraction.
Tick the boxes or type either form — they are the same nine bits. Nothing is uploaded.
The same umask gives files and directories different modes
umask 022 gives 644 for a file and 755 for a directory. Nothing about the mask explains that — the difference is the starting point. New files are created from 666 and new directories from 777, because a directory is useless without the execute bit that lets you enter it and a plain file has no business being executable by default.
| umask | New file | New directory | ||
|---|---|---|---|---|
| 000 | 666 | rw-rw-rw- | 777 | rwxrwxrwx |
| 002 | 664 | rw-rw-r-- | 775 | rwxrwxr-x |
| 022 | 644 | rw-r--r-- | 755 | rwxr-xr-x |
| 027 | 640 | rw-r----- | 750 | rwxr-x--- |
| 077 | 600 | rw------- | 700 | rwx------ |
| 007 | 660 | rw-rw---- | 770 | rwxrwx--- |
| 777 | 000 | --------- | 000 | --------- |
Which has a consequence worth knowing: no umask makes a new file executable. The base is 666, which has no execute bits, and a mask can only clear bits rather than set them. Checked over all 512 possible masks — not one produces an executable file. If a file needs the bit, something has to chmod it afterwards.
And umask is not subtraction
"666 minus 022 is 644" happens to be right — and so it is for 000 and 002, the other masks people actually type. That is exactly why the mental model survives. It is a bitwise clear, and the two agree only while no digit needs to borrow.
| umask | Real answer | Subtraction says |
|---|---|---|
| 000 | 666 | — same |
| 002 | 664 | — same |
| 022 | 644 | — same |
| 027 | 640 | 637 |
| 077 | 600 | 567 |
| 007 | 660 | 657 |
| 777 | 000 | -111 |
4 of the 7 masks here disagree, and the ones it gets right are precisely the familiar ones. At the extreme it does not merely give a wrong mode — umask 777 subtracts to a negative number, which is not a mode at all. The bitwise answer is always a valid mode, and applying the same mask twice changes nothing the second time, which subtraction certainly would not manage.
The modes worth recognising
| Octal | Symbolic | What it is |
|---|---|---|
| 755 | rwxr-xr-x | a script or a directory anyone may enter |
| 644 | rw-r--r-- | an ordinary file |
| 600 | rw------- | a private file — a key, a password store |
| 700 | rwx------ | a private directory |
| 777 | rwxrwxrwx | everything to everyone, almost always a mistake |
| 000 | --------- | nothing to anyone, including the owner |
The two forms carry exactly the same nine bits, so converting either way and back returns what you started with — checked over all 512 modes. Malformed symbolic input is rejected rather than guessed at, including the case where the right letters appear in the wrong order.
How to use
- Type an octal mode or a symbolic one.
- Or tick the boxes directly.
- Enter a umask to see what new files and directories get.
- Watch where subtraction gives the wrong answer.
Frequently asked questions
Why does umask 022 give 644 and 755?
Because files and directories start from different bases. New files are created from 666 and new directories from 777, since a directory is useless without the execute bit that lets you enter it and a plain file has no business being executable by default. The mask clears bits from whichever base applies.
Is umask just subtraction?
No, it is a bitwise clear, and the two agree only while no digit needs to borrow. 666 minus 022 really is 644, and it works for 000 and 002 as well — which is exactly why the mental model survives. But umask 007 gives 660 where subtraction gives 657, and umask 777 subtracts to a negative number that is not a mode at all.
Can a umask make a new file executable?
Never. The base is 666, which has no execute bits, and a mask can only clear bits rather than set them. Checked across all 512 possible masks — not one produces an executable file. If a file needs the bit, something has to chmod it afterwards.
What do the three digits mean?
Owner, group and everyone else, in that order. Each is read 4, write 2 and execute 1 added together, so 6 is read plus write and 7 is all three. The symbolic form spells the same nine bits out as rwx triplets.
What does execute mean on a directory?
Permission to enter it and reach what is inside, rather than to run it. That is why directories are created with execute set for anyone who can read them, and why 644 on a directory makes it effectively unusable even though the same mode is right for a file.
Which modes should I actually use?
644 for ordinary files, 755 for scripts and directories, 600 for anything private like a key or a password store, and 700 for a private directory. 777 is almost always a mistake — it grants write access to every user on the system.
Are octal and symbolic the same thing?
Exactly the same nine bits in two notations, so converting either way and back returns what you started with. That is checked here over all 512 modes rather than a handful of examples.
Does this send anything anywhere?
No. Everything is computed in your browser, and nothing is uploaded.
🔒 This tool runs entirely in your browser. Nothing you enter is uploaded, logged, or stored.