Linux Permission Visualiser
See what the nine permission characters in ls -l actually do. Paste a line like
-rw-r--r-- 1 alice dev 4096 app.py, enter the mode as octal (644) or symbolic
(rw-r--r--), or upload an ls -l listing — it is read in your browser and never
sent anywhere. The visualiser draws the r, w and x bits as a colour-coded grid for the owner, the group and
everyone else, explains in plain English what each one means (and how the meaning changes between files and
directories), shows which actions each class can really take, decodes the setuid, setgid and sticky bits, and
flags the combinations that get people locked out or exposed.
100% private — nothing is uploaded or stored. The modes you type, paste or load are used only by the JavaScript in this tab to draw the grid and write the explanations. No file name, path or permission value is sent to this website or anywhere else, and an uploaded listing is read with the browser’s FileReader and never leaves your device.
Quick starts
1. What are the permissions?
Paste or load a whole listing instead
Paste the output of ls -l (or ls -la) or upload a saved copy — every line
that looks like an entry is parsed locally, and you can click any of them to load its mode.
A loaded listing is read with the browser’s FileReader and never leaves your device — handy for a saved ls -la of a web root or home directory.
Entries found in the listing
2. What each permission means
Mode
What the owner can do
What group & others can do
The nine characters, coloured
| Permission | Owner (u) | Group (g) | Others (o) |
|---|
In plain English
Actions, class by class
What each class can actually do with this entry, given the bits above. Deleting and renaming are decided by the parent directory’s write + execute bits, not by these.
| Action | Owner | Group | Others |
|---|
Checks on this mode
How it works
Every file-system entry on Linux carries a mode: one character for its type, then nine permission
characters split into three groups of three. The first group belongs to the entry’s owner,
the second to members of its group, and the third to everyone else. Each group can
contain read (r, worth 4), write (w, worth 2) and execute (x,
worth 1) — which is exactly why rw-r--r-- is octal 644: 4+2, then 4, then 4.
The catch that trips people up is that the same letter means different things for a file and for a directory. On a file, read means “open it and see its contents”, write means “modify those contents”, and execute means “run it as a program or script”. On a directory, read means “list the names inside”, write means “create, delete or rename entries inside”, and execute means “enter it and reach files in it by name”. A directory you can list (r) but not enter (no x) is a dead end: you can see the names but cannot open any of them.
The mode also carries up to three special bits, shown in octal as a fourth leading digit and in
ls -l as lowercase or uppercase s and t in the execute slots:
setuid (4) makes a program run with the file owner’s identity, setgid (2) makes it run with the
file group’s identity — or, on a directory, makes new entries inherit the directory’s
group — and the sticky bit (1) restricts deletion in a shared directory to each entry’s owner,
which is what keeps strangers from deleting your files in /tmp.
New entries get their mode from the creating program minus the shell’s umask: files start at
666, directories at 777. That is why most files land on 644 and
directories on 755 under the default umask 022 — and why a file’s
mode rarely matches what you would pick by hand. To change an existing entry you use chmod;
to change who owns it (which decides which of the three columns applies to you) you use chown.
The nine characters, decoded
| Bit | On a file | On a directory |
|---|---|---|
| r — read (4) | Open the file and read its contents. Without it, cat, editors and browsers all refuse to open it. | List the names inside (ls). You can see what is there even if you cannot reach any of it. |
| w — write (2) | Modify the contents: add, delete or overwrite bytes. Opening for append also needs this. | Create new entries inside, and delete or rename existing ones (together with x). The file’s own w bit never controls its deletion. |
| x — execute (1) | Run the file as a program or script. Also needed to open some special files (FIFOs, sockets) for reading. | Enter the directory (cd) and access entries in it by name. A directory without x is unreachable even if you can list it. |
The type character
| Character | Entry type |
|---|---|
| - | Regular file — the ordinary kind, holding bytes. |
| d | Directory — holds names that point at other entries. |
| l | Symbolic link — points at another path. Its own permission bits are ignored by the kernel; access is checked against the target (except when you inspect the link itself, e.g. ls -l on it). |
| b / c | Block / character device — the entries under /dev. Permissions here decide who may use the hardware. |
| s / p | Socket / FIFO (named pipe) — inter-process communication endpoints. Opening them for reading needs x as well as r. |
Special bits: s, S, t and T
When a special bit is set, ls -l replaces the execute slot instead of adding a column.
Lowercase means the execute bit is also set; uppercase means it is not — which usually makes the
special bit inert and signals a misconfigured chmod.
| You see | Octal | Meaning |
|---|---|---|
| rws / rwS (owner slot) | 4xxx — e.g. 4755 | Setuid: the program runs with the file owner’s user identity, whatever user started it. /usr/bin/passwd is the classic example — it must write to /etc/shadow, which only root can do. |
| rws / rwS (group slot) | 2xxx — e.g. 2755 | Setgid on a file: runs with the file group’s identity. On a directory instead, new entries inherit the directory’s group — the standard setup for team folders. |
| rwt / rwT (other slot) | 1xxx — e.g. 1777 | Sticky bit on a directory: only an entry’s owner (or root, or a directory owner with CAP_FOWNER) can delete or rename it. This is what makes /tmp safe to leave world-writable. |
Changing modes by hand
# standard file: owner edits, everyone reads chmod 644 app.py # script or binary: everyone can run it chmod 755 deploy.sh # private directory: only the owner enters chmod 700 ~/secrets # setuid binary (only do this for programs that need it) chmod 4755 /usr/local/bin/tool # world-writable shared dir, but only owners delete chmod 1777 /srv/shared
Questions
What does -rw-r--r-- mean?
The first character says the entry is a regular file. The owner has read and write, the group has read, and everyone else has read — octal 644, the most common mode for ordinary files, created by default under umask 022.
Why can't I delete a file even though it is writable?
Deletion and renaming are controlled by the directory that contains the file, not by the file. You need write and execute permission on the parent directory to remove an entry from it. The file’s own w bit only controls whether its contents can be modified.
What is the difference between s and S in ls -l?
Both mark a special bit (setuid or setgid). Lowercase means execute is also set for that class; uppercase means the special bit is set without execute, which normally makes it useless — a sign someone ran chmod with the wrong octal.
Why do my directories need x at all? They hold no executable code.
Because on a directory, x is not about running anything — it is the permission to enter the directory and resolve names inside it. Without it you can list the names (r) but cannot open, stat or cd into any entry. That is why 755, not 644, is the normal directory mode.
Why do my new files have different permissions than I expected?
The umask. Files start at 666 and directories at 777, and your shell’s umask clears bits from those bases at creation time — hence 644/755 under the default 022. Run umask to see the value in effect, or work it out backwards with the Linux Umask Calculator.
Do symbolic links have their own permissions?
On Linux, no — the kernel ignores a symlink’s mode bits and checks permissions on the target instead (which is why ls -l shows lrwxrwxrwx for every link). The only thing that matters is that you can traverse the directory containing the link.
Before you rely on it
- The mode is only the first gate. Root bypasses these bits (except execute-on-a-file), and capabilities, ACLs (
getfacl) and the filesystem itself (noexec mounts) can override what the nine characters suggest. - Access to a file deep in a tree needs x on every directory from the root down to its parent — one locked directory blocks everything under it, no matter how open the file is.
- World-writable files and directories are the classic shared-machine vulnerability; the sticky bit protects a directory’s entries from each other but does nothing for a world-writable file.
- To change who owns an entry (and therefore which column applies to you) use the Linux Ownership Command Generator; to plan the exact chmod, use the Chmod Permission Calculator.
Related tools
Suggested
Luke Keam | techgeek.biz