Linux Umask Calculator
Type a umask and see exactly what it does. Enter it as octal (022, 027) or as a
symbolic expression (u=rwx,g=rx,o=), paste a line from /etc/profile or your
.bashrc, or upload the file itself — it is read in your browser and never sent anywhere.
The calculator shows the permissions new files and directories will get (files start at 666,
directories at 777, and the umask clears bits from them), breaks the result down bit by bit,
flags the settings that leave files world-writable, and works backwards too: give it the permissions you
want and it tells you which umask produces them.
100% private — nothing is uploaded or stored. The values you type or paste are used only by the JavaScript in this tab to do the arithmetic. No umask, file content or result is sent to this website or anywhere else, and an uploaded file is read with the browser’s FileReader and never leaves your device.
Quick starts
1. What is the umask?
Paste or load it instead
Paste anything that contains a umask — umask 027, umask = 0022, a bare
022, or several lines from /etc/profile and .bashrc at once. Later
assignments win, the way they would in a shell.
A loaded file is read with the browser’s FileReader and never leaves your device — handy for a copy of /etc/profile, ~/.bashrc or systemd.conf.
2. What permissions does it produce?
New files
New directories
Checks on this umask
Bit by bit
| Permission | Umask does | New file | New directory |
|---|
3. Reverse: which umask gives me these permissions?
Enter the file and directory modes you want new entries to have — octal (644) or
symbolic (rw-r--r--) — and the calculator works out the umask that produces them from
the standard bases of 666 for files and 777 for directories.
How it works
A umask is a per-process mask of permission bits, stored as an octal number with one digit per class:
owner, group and other. When a process creates a file, the kernel takes the mode the program asked for
— 666 (rw-rw-rw-) for regular files, 777 (rwxrwxrwx) for directories —
and clears every bit that is set in the umask. In other words the umask is a deny list: it can
only remove permissions, never add them. That is why umask 022 turns 666 into
644 and 777 into 755: the two group/other write bits are masked out.
Files start at 666 rather than 777 because a newly created regular file should
not be executable by default — executables get their +x from the program that creates
them or from a later chmod. So the execute digits of a umask can only ever matter for
directories, where x is what lets a user enter and list the contents.
Worked example: umask 027. Owner digit 0 clears nothing, so the owner keeps
everything (file 6, directory 7). Group digit 2 clears write: file
group bits 6 & ~2 = 4 (read only), directory group bits 7 & ~2 = 5
(read + enter). Other digit 7 clears everything: file other bits 6 & ~7 = 0,
directory other bits 7 & ~7 = 0. The result is files 640 and directories
750 — the standard “private home on a shared machine” setting.
The umask is inherited: every child process starts with its parent’s mask, which is why one line in
your shell startup file covers everything you launch from that shell — and why a daemon started by
systemd never sees it. Check the value a process actually uses with umask in a terminal or
cat /proc/<pid>/status | grep Umask for a running one.
Common umasks
| Umask | Files | Directories | Typical use |
|---|---|---|---|
| 022 | 644 — rw-r--r-- | 755 — rwxr-xr-x | The default on most Linux distributions. Everyone can read; only the owner writes. Fine for personal work and web content. |
| 027 | 640 — rw-r----- | 750 — rwxr-x--- | Private home directories on shared machines: the group can look, other users cannot even see the files. |
| 002 | 664 — rw-rw-r-- | 775 — rwxrwxr-x | Team folders where every member of the group creates and edits files. Pair the directory with the setgid bit (chmod g+s) so new entries inherit the group. |
| 007 | 660 — rw-rw---- | 770 — rwxrwx--- | Group-only access: other users get nothing at all, the group reads and writes. |
| 077 | 600 — rw------- | 700 — rwx------ | Maximum privacy: SSH keys, credential files, anything that must not be readable by any other account. |
| 000 | 666 — rw-rw-rw- | 777 — rwxrwxrwx | Nothing is masked. Deliberately used for shared scratch areas; a dangerous default because world-writable directories let anyone delete or rename your files. |
Where the umask is set
| Location | Applies to |
|---|---|
| /etc/profile, /etc/login.defs (UMASK) | System-wide default for login shells. Ubuntu ships umask 022 here. |
| ~/.profile, ~/.bash_profile | Per-user override for login shells (the ones that run when you log in at a console or over SSH). |
| ~/.bashrc | Interactive non-login bash sessions — the file that actually applies on desktops and most terminal windows. A line here only affects shells that read it: cron jobs, systemd units and scripts started with bash script.sh do not. |
| systemd: DefaultUMask= in /etc/systemd/system.conf, UserUMask= in a unit file | Services and everything they spawn. The default is 0022; this is the only place to change what a daemon sees. |
| Docker entrypoint / RUN scripts | Containers. There is no ENV for it — put umask 077 (or whatever you need) in the entrypoint script before the main process starts. |
| NFS server-side | Files created on an NFS export take the umask of the server’s creating process, not the client’s — a common source of “why are my files 640?” |
Making a change permanent
# interactive shells (add to ~/.bashrc) umask 027 # system-wide for login shells (edit /etc/profile) umask 027 # a single systemd service (its unit file, [Service] section) UserUMask=0027
Questions
What does umask 027 mean?
It clears the group-write bit and every other-user bit. Files come out 640: the owner reads and writes, the group only reads, others get nothing. Directories come out 750: the group can enter and list them but cannot create files inside. It is the usual choice for a home directory on a machine where other local accounts exist.
Why are my new files 644 instead of 664?
Your umask is almost certainly 022, which masks the group-write bit out of the 666 base. To get group-writable files (664) set umask 002. Run umask in the same terminal where you create the file to see which value is actually in effect — it can differ between a login shell and a script.
How do I change my umask permanently?
Add umask 027 to ~/.bashrc for interactive shells, or to /etc/profile (or the UMASK line in /etc/login.defs) for a system-wide default. For services, set UserUMask= in the unit file — your shell’s umask never reaches daemons, cron jobs or scripts that do not source your bashrc.
Can a umask give the execute bit to new files?
No. The mask can only clear bits, and regular files start at 666 with no execute bit anywhere to keep. The x digits of a umask therefore only ever affect directories. To make a file executable you need the creating program to request it (as compilers do for their output) or a chmod +x afterwards.
Is umask 077 safer than chmod 600 after creating the file?
Slightly. With the umask, the restrictive mode is applied at the instant of creation, so there is no window in which the file exists with looser permissions that another local user could read or race. With create-then-chmod the file briefly sits at whatever your umask allows (often world-readable) before it is tightened.
Does the umask apply to directories as well?
Yes — from a 777 base instead of 666, so directories keep their execute bits unless the mask clears them. That is why the same 022 gives files 644 but directories 755. A directory without its owner x bit is unusable, which is one reason to distrust umasks that clear owner execute.
Before you rely on it
- A umask only affects files created after the change. Existing files keep their current mode — use
chmodto fix those. - It is per-process. Changing it in one terminal does not affect other terminals, your running services or anything started by systemd.
- Programs can override it: some applications call
fchmod/fstatlogic or set their own umask (systemd services useUserUMask=). If a file’s mode disagrees with the arithmetic here, the creator is choosing its own mode. - For one-off fixes prefer an explicit
chmod 640 /path; use the umask when you want a standing policy for everything a shell or service creates. The Chmod Permission Calculator handles the one-off side.
Related tools
Suggested
Luke Keam | techgeek.biz