Updated: 22 October 2026 · Applies to: GNU coreutils 9.7 on Debian 13 and uutils coreutils 0.10.0 on Ubuntu 26.04, tested (same results); works the same on Ubuntu 24.04, AlmaLinux and Rocky Linux

Octal notation writes Linux permissions as one digit per group (owner, group, others), and each digit is the sum of read = 4, write = 2 and execute = 1. So rwxr-xr-x is 7, 5, 5, which is 755. To see the octal value of a file directly, ask stat:

stat -c '%a %n' index.html

Output:

644 index.html

The values behind each digit

  • r (read) = 4
  • w (write) = 2
  • x (execute) = 1
  • - (not set) = 0

Adding them gives eight possible digits:

  • 0 = ---
  • 1 = --x
  • 2 = -w-
  • 3 = -wx
  • 4 = r--
  • 5 = r-x
  • 6 = rw-
  • 7 = rwx

Convert rwx to octal, step by step

Take the permission string from ls -l, for example -rw-r-----:

  1. Drop the first character. It is the file type (- for a file, d for a directory, l for a link), not a permission. You are left with rw-r-----.
  2. Split the rest into three groups of three: owner rw-, group r--, others ---.
  3. Add the values in each group: rw- = 4 + 2 = 6, r-- = 4, --- = 0.
  4. Write the digits in order: 640.

Two more examples: rwxr-x--- is 4+2+1, 4+1, 0 = 750, and rw------- is 600.

Convert octal back to rwx

Work the other way: split each digit into 4, 2 and 1. For 750: 7 = 4+2+1 = rwx, 5 = 4+1 = r-x, 0 = ---, so the result is rwxr-x---. You can check it on a test file:

chmod 750 uploads
ls -ld uploads

Output:

drwxr-x--- 2 root root 4096 Oct 22 14:02 uploads

Show octal and rwx for many files at once

The stat format codes do the conversion for you: %a is the octal mode, %A the rwx form and %n the name. For everything in the current folder:

stat -c '%a %A %n' *

Output (lab example):

755 -rwxr-xr-x deploy.sh
600 -rw------- id_rsa
644 -rw-r--r-- index.html
640 -rw-r----- notes.txt
2775 drwxrwsr-x shared
4755 -rwsr-xr-x suidtool
1777 drwxrwxrwt tmpdir
750 drwxr-x--- uploads

Add %F for the file type and %U:%G for the owner and group:

stat -c '%a %F %U:%G %n' deploy.sh uploads

To list a whole directory tree with octal modes, find has its own code, %m:

find /srv/demo -printf '%m %M %p\n'

A symbolic link always shows 777 because the link itself has no real permissions. Add -L to see the mode of the file it points to:

stat -L -c '%a %A %n' link.html

The fourth digit: setuid, setgid and sticky bit

When a mode has four digits, the first one holds the special bits, added up the same way:

  • 4 = setuid: a program runs with its owner's rights. 4755 shows as -rwsr-xr-x (an s in the owner's execute place).
  • 2 = setgid: on a directory, new files inherit the directory's group. 2775 shows as drwxrwsr-x.
  • 1 = sticky bit: in a shared directory, only a file's owner can delete it. 1777 shows as drwxrwxrwt, like /tmp.

A capital S or T means the special bit is set but the execute bit under it is not: 4644 shows as -rwSr--r-- and 1770 as drwxrwx--T. That is usually a mistake worth fixing.

stat %a prints the fourth digit only when a special bit is set. To always see a leading digit, use %#a:

stat -c '%#a %n' deploy.sh shared

Output:

0755 deploy.sh
02775 shared

One trap: on a directory, chmod 755 keeps an existing setgid bit. In our test, shared went from 2775 to 2755, not 755. To remove the setgid bit, clear it by name:

chmod g-s shared

Symbolic chmod and umask in octal terms

Symbolic chmod sets the same bits. This command gives the owner rwx, the group r-x and others nothing:

chmod u=rwx,g=rx,o= notes.txt

Check the result in octal:

stat -c '%a %A %n' notes.txt

Output:

750 -rwxr-x--- notes.txt

The umask is also octal, but it lists the bits to take away from 666 for files and 777 for directories. With root's default umask 0022, new files get 644 and new directories 755. Normal users on Debian 13 and Ubuntu 26.04 have umask 0002, which gives 664 and 775. Show your own with:

umask

Related guides

Official documentation: GNU stat invocation.

Related services

KVM VPS hosting

NVMe SSD and full root access, with Free Basic Managed Support.

Unmanaged dedicated servers

full root access and free IPMI KVM, with Free Basic Managed Support.

Managed dedicated servers

our engineers look after the server for you, from $135 a month.

Was this answer helpful?

Still stuck? Open a ticket