Every chmod command you’ll ever type manipulates twelve bits. That’s the entire system: nine permission bits in three groups of three, plus three special bits. Once you see the shape, rwxr-xr-x, 644 and u+x are three notations for the same twelve switches.

The three classes: who is asking

Unix answers “may this account do this thing?” by slotting the account into one of three classes:

• owner (u) — the user who owns the file. Usually whoever created it; changeable with chown.
• group (g) — accounts that belong to the file’s owning group. The original idea: a team shares files through a group. Changeable with chgrp (or chown :team file).
• others (o) — everyone else on the system: other users, service accounts, the web server, daemons. o is what “the public” means on a shared machine.

ls -l shows the owner and group between the permission string and the size:

-rwxr-xr-x 1 alice staff 4096 Sep 24 10:15 deploy.sh
└─┬┘└┬┘└┬┘   └─┬─┘ └─┬─┘
  │   │   │        │     └─ owning group: "staff"
 type u   g   o    └────── owner: "alice"

The rule that surprises people: checking stops at the first class that matches. If you’re the owner, only the owner bits are consulted — the group and other bits are irrelevant to you. An owner can lock themselves out (chmod 044 — owner gets nothing, group and others keep read) while leaving the file readable to everyone else, which is legal and occasionally useful. (chmod 000 goes further and strips every class, owner included.)

The three bits: what you may do

Each class holds read (r), write (w) and execute (x) — but they mean slightly different things on files versus directories:

bit	on a file	on a directory
r	read the contents	list the names inside (ls)
w	modify or truncate it	create, delete, rename entries inside
x	run it as a program	enter it and reach items inside (cd, open a path through it)

Two consequences worth memorizing:

• Directory x is “search”, not execute. You can open dir/secret.txt without read on dir/ (you can’t list it, but you can reach in by name) — but without x on dir/ you can’t reach it at all. This is how go-rx “private but shareable on request” home directories work.
• Deleting a file is a directory operation. rm asks “may I modify this directory?” — the file’s own permissions don’t matter. That’s why the sticky bit exists on shared directories (see special bits) and why chmod -w file doesn’t stop rm file.

Octal: three digits that are really four

Each class’s three bits sum to one octal digit — read=4, write=2, execute=1:

rwx = 4+2+1 = 7      rw- = 4+2   = 6      r-x = 4+1 = 5
r-- = 4     = 4      -w- = 2     = 2      --x = 1     = 1      --- = 0

chmod 755 is just shorthand for rwx r-x r-x. The digit order never changes: owner, group, others. A fourth leading digit sets the special bits (4755 = setuid + 755), which is why ls -l sometimes shows s or t where you’d expect x.

The classic pair to internalize:

mode	meaning	typical use
644	rw-r--r--	files the world may read: web pages, code, images
755	rwxr-xr-x	files/dirs the world may read and enter/run
600	rw-------	private files: SSH keys, .env, credentials
700	rwx------	private directories and personal scripts

The calculator expands any octal into checkboxes plus a plain-English sentence — handy for double-checking 1777 or 2750 before you run them.

Symbolic mode: editing instead of replacing

Octal replaces the whole mode. Symbolic clauses perform surgery: [who][op][perms] where who is u/g/o/a (all — the default), op is + (add), - (remove), = (set exactly), and perms are r w x (plus X s t u g o).

chmod u+x script.sh      # owner gains execute
chmod go-w file          # group and others lose write
chmod o= private.txt     # others get nothing — "=" is absolute per class
chmod a=r notes.txt      # everyone: read-only → 444
chmod u=rwx,go=rx dir    # two clauses, one command → 755

Two subtleties people hit for real:

1. Omitting who doesn’t mean “everyone” — it means “everyone, filtered by your umask.” With umask 022 (the usual default), chmod +w file adds write for the owner only; the group/other write bits are masked out. Explicit letters (a+w) bypass the filter. Our clause box applies the same rule so results match your shell.
2. X is conditional x — it sets execute only on directories and on files that already have some x. chmod -R a+rX dir/ is the safe recursive “make everything readable, keep dirs traversable” that plain -R a+rx gets wrong by marking every file executable.

Putting it together: reading a real listing

drwxr-x---  alice  www   app/
-rw-------  alice  www   .env
-rwxr-xr-x  alice  www   build.sh
-rw-r--r--  alice  www   index.html

app/ (750): alice lists, creates and enters; team www lists and enters but can’t create files; everyone else is shut out. .env (600): only alice touches it — correct for secrets. build.sh (755): anyone on the box may read and run it, only alice edits it. index.html (644): world-readable, owner-writable — the web-server default.

If any of that still feels abstract, open the calculator, click boxes and watch the octal and ls -l string change together — thirty seconds of clicking teaches the mapping faster than any table.

Frequently asked questions

What do the three numbers in chmod 644 mean?

Each digit is one class: owner, group, others — in that order. Each digit is a sum of read (4) + write (2) + execute (1). So 644 = owner rw- (4+2), group r-- (4), others r-- (4): you can edit it, everyone else can only read it.

What does execute mean on a directory?

Not 'run' — it means search: the right to enter the directory and reach files inside it (by name). Without x on a directory you can't cd into it or open anything inside, even if the files themselves are readable. Read on a directory means you may list filenames; write means you may create, delete or rename entries.

Why can I read a file but still get Permission denied opening it?

Reaching a file needs execute (search) on every directory in its path, not just read on the file. If /home/alice is 700, nobody else can open /home/alice/public.txt no matter how open that file's own permissions are. Check the path components with namei -l /path/to/file.

Who counts as 'group' and 'others'?

Every file has one owner (a user) and one owning group (see them in ls -l). If you're the owner, the owner bits apply. Otherwise, if you're a member of the owning group, the group bits apply. Everyone else — including web-server accounts and daemons — gets the 'other' bits. Root ignores all of this except it still needs some execute bit set to run a file.

Is there a chmod that removes all access?

chmod 000 file (or chmod a= file) makes it untouchable: nobody can read, write or execute it — not even you — until you chmod it back. Root is the exception; it can still open the file.

Do permissions work the same on macOS and Linux?

The rwx model and octal numbers are identical — both come from the same Unix heritage. Differences live at the edges: macOS/BSD treats the sticky bit a little differently in symbolic clauses (o+t doesn't work there, +t does), macOS adds ACLs on top (ls -le), and setgid on executables has OS-specific rules. The calculator on the home page follows GNU/Linux conventions.