chmod Calculator

Because it grants read, write and execute to everyone on the system, including any process running as any user. It is the reflexive fix when a permission error appears, and it works — by removing the protection rather than correcting it. On a shared host it means any other account can modify your files. For a web application it means a compromised process anywhere on the machine can rewrite your code. The permission error is telling you the owner or group is wrong; fixing that with chown is almost always the real answer.

One digit each for the owner, the group and everyone else, in that order. Within each digit, read is 4, write is 2 and execute is 1, and you add them together — so 7 is all three, 6 is read and write, 5 is read and execute. That is why 644 means the owner can read and write while everybody else can only read, and 755 adds execute for everyone, which is what a directory or a program needs. The arithmetic is just three bits per group written in octal.

Because on a directory execute means something entirely different from running a program — it means being allowed to enter the directory and access things inside it by name. Read on a directory only lets you list its contents. So a directory with read but not execute lets you see the file names and open none of them, which produces some genuinely baffling permission errors. This is why directories are normally 755 while ordinary files are 644.

An optional leading digit carries setuid (4), setgid (2) and the sticky bit (1). Setuid makes a program run as its owner rather than as whoever launched it, which is powerful and a classic privilege-escalation route if set carelessly. Setgid on a directory makes new files inherit the directory's group, which is genuinely useful for shared project folders. The sticky bit on a shared directory stops users deleting each other's files, which is why /tmp is 1777. Set these deliberately or not at all.

As a starting point, 644 for files and 755 for directories, with ownership set to the user the web server runs as. Directories that the application genuinely needs to write — an uploads folder, a cache directory — can be 775 with the right group, or 755 if the owner is the web server user. Nothing needs 777 and nothing needs to be world-writable. Configuration files holding credentials should be 600 or 640, so only the owner and possibly the group can read them at all.

umask is a mask that removes permission bits from newly created files. A typical umask of 022 subtracts write from group and other, which is why a file you create ends up 644 rather than the 666 the system would otherwise give it. It only affects creation, so it never changes an existing file, and it explains why files arrive with permissions nobody appears to have chosen. If new files consistently have the wrong permissions, umask is where to look rather than chmod.