chmod `755` — what does it mean?

755 is the default-looking permission of the Unix world: it is what a directory gets under the common umask 022, and it is the mode of almost every program in /usr/bin. Only the owner can change the file or the directory's contents, while anyone can run the program or list and enter the directory. That makes it right for things that are meant to be public but not shared-writable, and wrong for anything that contains secrets.

In plain English

755

rwxr-xr-x

The owner can read, write and execute; the group and all other users can read and execute, but not modify.

Symbolic equivalent: chmod u=rwx,g=rx,o=rx deploy.sh

Open 755 in the chmod calculator

What each digit in 755 means

Each octal digit is the sum of read (4), write (2) and execute (1) for one class of users. The digits are, in order, the file's owner, the file's group, and everyone else.

Class	Digit	Sum	r w x	ls -l
Owner (u)	7	4 + 2 + 1	rwx	rwx
Group (g)	5	4 + 0 + 1	r-x	r-x
Others (o)	5	4 + 0 + 1	r-x	r-x

Owner: can read the contents, modify the contents and run it as a program.
Group: can read the contents and run it as a program; no write.
Others: can read the contents and run it as a program; no write.

When to use chmod 755

Directories that other users or services need to enter: web roots like /var/www/html, project folders, ~/public_html. Every directory in the path to a file needs execute, not just the last one.
Shell scripts and binaries other users should be able to run: /usr/local/bin/*, CI helper scripts, cron scripts run by a different user.
The standard 'directories 755, files 644' layout for WordPress, static sites and most deployed web apps.
Executables you install with install -m 755, which is what make install and most package builds use.

Security risks and gotchas

Everyone can read it

The 5 in the 'others' slot includes read. A 755 script that contains an API key or database password is readable by every account on the machine, including the web server user and any compromised service. Move the secret to a 600 file or use 750/700.

chmod -R 755 makes every file executable

Running chmod -R 755 on a web root turns every .html, .css and .php file into an 'executable'. That is not a direct vulnerability, but it hides real executables, triggers security scanners and can let a misconfigured server run uploaded files as CGI. Set directories and files separately.

find /var/www/html -type d -exec chmod 755 {} +
find /var/www/html -type f -exec chmod 644 {} +

Read is required to run a script

For a compiled binary, execute is enough. For a shell or Python script, the interpreter has to read the file, so a script needs both r and x for whoever runs it. That is why 755 works for scripts where 711 does not.

Commands

Set 755 on one file or directory

chmod 755 deploy.sh

Replaces all nine permission bits. Equivalent to chmod u=rwx,go=rx deploy.sh.

Only add execute (keep the rest)

chmod +x deploy.sh

With umask 022, +x on a 644 file gives 755. Use u+x if only you should be able to run it.

Directories 755, files untouched

find /srv/app -type d -exec chmod 755 {} +

The safe way to fix 'Permission denied' when traversing a tree. The + batches many paths into one chmod call.

Recursive with capital X

chmod -R u=rwX,go=rX /srv/app

X adds execute only to directories and to files that already have execute for someone, so directories end up 755 and plain files 644.

How to check for 755

# Symbolic view
ls -l deploy.sh
-rwxr-xr-x  1 deploy deploy  2140 Oct 16 09:12 deploy.sh

# Octal view (Linux / GNU coreutils)
stat -c '%a %A %n' deploy.sh
755 -rwxr-xr-x deploy.sh

# Octal view (macOS / BSD)
stat -f '%Lp %Sp %N' deploy.sh

The first character of the ls -l output is the file type (- regular file, d directory), followed by the nine permission characters. stat -c %a prints the octal mode directly; it only shows a fourth leading digit when setuid, setgid or the sticky bit is set.

Related chmod modes

644rw-r--r--

Owner read and write, everyone else read-only

775rwxrwxr-x

Owner and group full access, others read and execute

750rwxr-x---

Owner full access, group read and execute, others none

700rwx------

Owner full access, nobody else

711rwx--x--x

Owner full access, others execute or traverse only

Try variations of 755 in the chmod calculator, browse all chmod modes, or read Linux file permissions explained for chown, umask and ACLs.

Frequently Asked Questions

Is chmod 755 safe?▾

For directories and programs that are meant to be public, yes. Nobody but the owner (and root) can modify the file or add and delete entries in the directory. It is not safe for files containing secrets, because every user on the system can read them.

What is the difference between chmod 755 and chmod 775?▾

Only the group's write bit. 755 is rwxr-xr-x, so group members can read and execute. 775 is rwxrwxr-x, so group members can also modify the file or create and delete files in the directory. Use 775 for directories a team shares through a common group.

Should files be 755 or 644?▾

Regular files that are not programs should be 644. Use 755 only for scripts and binaries that need to be executed. Directories are the exception: they need execute to be entered, so they are normally 755.

chmod 755 — what does it mean?