chmod Binary Representation

The 9-Bit Permission Layout

Before we dive into specific chmod values, I need to explain the underlying binary layout. Linux file permissions occupy exactly 9 bits. These 9 bits are divided into three groups of 3 bits each, with each group corresponding to a user class: owner, group, and others. Within each group, the bits represent read (high), write (middle), and execute (low).

In my years of Linux systems administration, I have found that visualizing the full 9-bit structure is the fastest way to truly understand chmod. Here is the complete bit position map:

When I started managing multiple Linux servers, I kept a cheat sheet of octal permission values on my desk. These days I can read 2775 as setgid plus rwxrwxr-x without thinking twice.

The relationship between octal and binary is direct: each octal digit (0-7) unpacks into exactly 3 bits. This is why chmod accepts octal numbers — not because octal is inherently special, but because 3-bit groups map perfectly to the rwx triple. Decimal would not work because decimal digits do not align with 3-bit boundaries.

chmod 755 Binary: 111101101

chmod 755 is the go-to permission for directories and executable files. In my experience, something like 70% of the permission values I set on production servers are 755 for directories and 644 for files. Let's break 755 down bit by bit.

Each bit position tells you exactly which permission is granted or denied. Let me walk through the bit analysis of 755:

• Bit 8 (value 256, owner-read): 1 — Owner can read the file. This is almost always needed.
• Bit 7 (value 128, owner-write): 1 — Owner can modify or delete the file. Essential for the file owner.
• Bit 6 (value 64, owner-execute): 1 — Owner can execute the file or traverse a directory. Crucial for scripts and directories.
• Bit 5 (value 32, group-read): 1 — Group members can read the file. Standard for shared access.
• Bit 4 (value 16, group-write): 0 — Group members cannot modify. This preserves file integrity.
• Bit 3 (value 8, group-execute): 1 — Group members can execute. Necessary for shared scripts.
• Bit 2 (value 4, others-read): 1 — Others can read. Standard for public content.
• Bit 1 (value 2, others-write): 0 — Others cannot modify. Security through restriction.
• Bit 0 (value 1, others-execute): 1 — Others can execute. Needed for public directories.

The decimal value of 755 is 493 (256 + 128 + 64 + 32 + 0 + 8 + 4 + 0 + 1 = 493). But as I mentioned earlier, the decimal form is much less useful than the octal because it obscures the triple structure. When I audit server permissions, I always think in octal and binary, never decimal.

chmod 644 Binary: 110100100

chmod 644 is the standard file permission for non-executable files. Every HTML file, every CSS stylesheet, every text configuration file you see on a typical Linux server is probably 644. The binary representation is 110100100.

Here is the key insight about 644: bit 6 (owner-execute) is 0. This means you cannot ./script.sh on a 644 file. I have seen many beginners confused about why their script returns Permission denied even though they own it. The answer is always bit 6. Add execute with chmod +x (which sets bit 6) or change the mode to 755.

The decimal value of 644 is 420 (256 + 128 + 0 + 32 + 0 + 0 + 4 + 0 + 0 = 420). I find it interesting that 420 is also a common default umask calculation, but let's stay focused on the binary analysis.

One practical tip I have learned: if you are setting up a web server, ensure your static assets are 644 and your directories are 755. This is the minimum permission set that allows your web server (running as a specific user or group) to read and serve files while preventing unauthorized modifications.

chmod 777 Binary: 111111111

chmod 777 has every single one of the 9 bits set to 1. The binary is 111111111 and the rwx notation is rwxrwxrwx. Every user class — owner, group, and others — has read, write, and execute access.

In my professional opinion, 777 is almost never the right answer. I have seen it used as a shortcut — "just chmod 777 it" — by developers who cannot figure out why their application cannot write to a directory. The binary analysis reveals why this is dangerous: bits 1, 0, and 4 are all 1, meaning anyone on the system can modify your files and traverse your directories.

If a PHP application needs write access to a cache directory, the correct approach is to set the directory owner to the web server user and use 755 or 775, not 777. The binary difference between 755 and 777 is just bits 4 and 1 (group-write and others-write). Those two bits are the difference between a secure server and a compromised one.

Other Common Permission Binary Representations

Beyond the big three (755, 644, 777), there are several other permission values I use regularly:

chmod 600 — Private Files: 110000000

Binary 110000000. Only the owner can read and write. Group and others get nothing. This is what I use for SSH keys (~/.ssh/id_rsa), database credentials, and API tokens. If any bit in the group or others triple is 1, a private key file will be rejected by SSH with Permissions 0644 for 'id_rsa' are too open.

chmod 700 — Private Executables: 111000000

Binary 111000000. The owner has full control; everyone else has no access at all. I use this for personal scripts and directories containing sensitive operations. It is like 755 but with group and others locked out entirely.

chmod 400 — Read-Only Owner: 100000000

Binary 100000000. Only bit 8 is set. The owner can only read — not write, not execute. I use this for certificate files (.pem, .crt) that need to be readable by services but should never be modified accidentally.

chmod 555 — Read and Execute Only: 101101101

Binary 101101101. Everyone can read and execute, but nobody can write. This is useful for system binaries that should not be modified by any user, including root. It is essentially 755 with the write bits cleared from all triples.

Setuid, Setgid, and Sticky Bit Binary

Beyond the standard 9 permission bits, there are 3 special permission bits that precede the owner triple: setuid (bit 11, octal 4000), setgid (bit 10, octal 2000), and the sticky bit (bit 9, octal 1000). When you see a 4-digit octal like 4755, the first digit is one of these special bits.

The setuid bit (bit 11) makes an executable run with the owner's effective user ID rather than the user who launched it. When setuid is active, the owner-execute position shows s instead of x. The binary representation of 4755 is 12 bits long: 100111101101.

In my experience, setuid binaries like passwd and ping are the most common examples. They need elevated privileges to function but are carefully audited for security. I recommend never setting the setuid bit on your own scripts unless you fully understand the security implications.