chmod 755, 644 and 600 Explained: rwxr-xr-x Permission Codes

Updated: 11 October 2026 · Applies to: Linux and Unix file permissions, tested with GNU coreutils 9.7 and OpenSSH 10.0 on Debian 13, uutils coreutils 0.10.0 on Ubuntu 26.04 and GNU coreutils 9.5 on AlmaLinux 10

chmod 755 sets rwxr-xr-x: the owner can read, write and execute, the group and everyone else can read and execute. chmod 644 sets rw-r--r--: the owner can read and write, everyone else can only read. chmod 600 sets rw-------: only the owner can read and write. drwxrwxr-x is a directory (the leading d) with code 775. As a rule of thumb: 755 for directories and scripts, 644 for normal files, 600 for private files such as SSH keys and passwords.

How to turn rwx letters into a code

After the first character (the file type: - file, d directory, l link), the nine letters are three groups of three: owner, group, others. Each letter has a value, and you add the values in each group:

• r read = 4
• w write = 2
• x execute = 1
• - not allowed = 0

So rwx = 4+2+1 = 7, r-x = 4+0+1 = 5, rw- = 4+2+0 = 6 and r-- = 4. That makes rwx r-x r-x 755, rw- r-- r-- 644 and rw- --- --- 600. To let Linux do the sum for you, use stat:

$ stat -c '%a %A %n' run.sh site page.html config.php
755 -rwxr-xr-x run.sh
755 drwxr-xr-x site
644 -rw-r--r-- page.html
600 -rw------- config.php

More on this in translate rwx permissions into octal format, and every column of ls -l is explained in how to read ls -l output.

chmod 755 (rwxr-xr-x): directories, scripts and programs

755 lets everyone use the file or folder, but only the owner can change it. Directories need the x bit to be opened, and scripts need it to run. In our test, another user could run a 755 script. After chmod 644 on the same script, even its owner got:

sh: 1: /home/alice/run.sh: Permission denied

Running it through the shell (sh run.sh) still worked, because then the file is only read. Use chmod 755 script.sh or chmod +x script.sh.

chmod 644 (rw-r--r--): normal files

644 is the usual mode for web pages, images, CSS and most config files: the web server and other users can read them, only the owner can change them. Another user could read our 644 file but not write to it:

sh: 1: cannot create /home/alice/page.html: Permission denied

Do not give a directory 644. Without x, even the owner could not open it:

$ cd /home/alice/site
sh: 1: cd: can't cd to /home/alice/site
$ ls -l /home/alice/site
ls: cannot access '/home/alice/site/a.txt': Permission denied
total 0
-????????? ? ? ? ?            ? a.txt

chmod 600 (rw-------): private files and SSH keys

600 means nobody but the owner (and root) can read the file. Use it for SSH private keys, .env files and anything else that holds passwords. OpenSSH insists on it. With a private key at 644, ssh-keygen -y refused to load it:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/home/alice/.ssh/id_ed25519' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.

The key "will be ignored", so it cannot be used to log in. 640 was also "too open"; 600 and 400 (read-only) worked. The fix is chmod 600 ~/.ssh/id_ed25519, with chmod 700 ~/.ssh for the folder, which is what ssh-keygen created. A world-writable ~/.ssh/config (666) was refused with Bad owner or permissions on /home/alice/.ssh/config; 644 and 600 both worked. See set up SSH keys for authentication.

Be careful with 600 on website files: if PHP or the web server runs as a different user (for example www-data), it can no longer read the file, and in our test www-data got Permission denied. In that case use 640 with the web server's group, or keep 644.

775 and 664: folders and files a group shares

drwxrwxr-x (775) and -rw-rw-r-- (664) let the owner and the group write, and everyone else only read. New files get their mode from the umask: on Debian 13 and Ubuntu 26.04 a normal user's umask was 0002, so new folders were 775 and new files 664 (safe, because every user has a private group of the same name). For root, and for normal users on AlmaLinux 10, it was 0022, giving 755 and 644. Check yours with umask.

Some programs reject group-writable folders: an SFTP chroot folder must be 755 and owned by root (see SFTP-only users with a chroot).

Other common permission codes

• 700 drwx------ and 750 drwxr-x---: private directories, or private with read access for one group.
• 640 -rw-r-----: config files a service group must read.
• 400 -r-------- and 440 -r--r-----: read-only; 440 is used for sudoers files.
• 777 drwxrwxrwx: everyone may change everything. Avoid it, especially on web servers.

A fourth digit in front adds a special bit: 4755 shows -rwsr-xr-x (setuid), 2775 shows drwxrwsr-x (setgid: new files take the directory's group) and 1777 shows drwxrwxrwt (sticky bit, as on /tmp). See how to find files with SUID and SGID permissions.

What r, w and x mean for files and directories

• Files: r reads the content, w changes it, x runs it as a program or script.
• Directories: r lists the names inside, w creates, renames or deletes entries (together with x), x enters the directory and reaches the files in it. A directory without x is useless even with r, as the 644 test above shows.

Set and check permission codes with chmod

1. With numbers, and -c to see what changed:

   $ chmod -c 600 page.html
   mode of 'page.html' changed from 0644 (rw-r--r--) to 0600 (rw-------)

2. With letters (u owner, g group, o others, a all; + add, - remove, = set exactly). These gave the same codes in our test:

   chmod u=rwx,g=rx,o=rx file    # 755 -rwxr-xr-x
   chmod u=rw,go=r file          # 644 -rw-r--r--
   chmod u=rw,go= file           # 600 -rw-------
   chmod g-w file                # remove write for the group

3. For a whole website or folder tree, give directories 755 and files 644 in two steps:

   find /var/www/example.com -type d -exec chmod 755 {} +
   find /var/www/example.com -type f -exec chmod 644 {} +

4. Find files that do not have the mode you expect: find . -type f ! -perm 644 -printf '%m %p\n' printed 600 ./config.php in our test.

Do not run chmod -R 644 on a folder: it removes x from the directories too and locks out the owner, as shown above. chmod -R u=rwX,go=rX site repairs it, because a capital X adds execute only to directories and to files that already have an execute bit. It does not clean up after chmod -R 777 (files keep their x); use the two find commands for that.

Unix file mode: the full number

The permission code is part of a file's mode, which also stores the file type and the special bits. stat -c %f prints the whole mode in hexadecimal: 81a4 for a 644 file is 100644 in octal (100 = regular file, then 644), and 41ed for a 755 directory is 40755. Git shows the same numbers, and it only records whether a file is executable: our 600 file was stored as 100644 and the 755 script as 100755. The numeric codes are part of the POSIX standard, so they mean the same on other Unix-like systems: according to the OpenBSD chmod manual, 644 makes a file "readable by anyone and writable by the owner only" and 755 "readable/executable by everyone and writable by the owner only".

Special cases

• chmod 755 keeps setgid on a directory. On a 2775 directory, both chmod 755 and chmod 0755 left it at 2755 (drwxr-sr-x). Remove the bit with chmod g-s dir or a five-digit code, chmod 00755 dir.
• Ownership is separate from permissions. Change the owner and group with chown user:group file; see change file and folder ownership in Linux.
• One extra user needs access: rather than opening a folder to everyone, add an ACL; see how to configure ACLs on Linux.
• Ubuntu 26.04 uses the Rust coreutils for chmod, stat and ls; the codes and letters were the same as GNU in our tests.

Official documentation: GNU coreutils: File permissions and OpenBSD chmod(1).