Chmod 777 vs 755 vs 644 Explained: Linux Permissions & Security Guide

When encountering permission denied errors (403 Forbidden on Nginx or EACCES: permission denied on Node.js), developers are often tempted to run chmod -R 777 /var/www.

While 777 makes the error vanish immediately, it also allows any local process, compromised daemon, or unauthorized user to overwrite scripts, inject webshells, or read database credentials.

This guide explains Linux file permissions, octal calculations using the 4-2-1 rule, and standard permission configurations for production servers.

The 4-2-1 Octal Calculation Rule

Every Linux file and folder has three security tiers:

1. User (Owner): The account that owns the file.
2. Group: Other accounts belonging to the owner's team/group.
3. Others (World): Every other process and account on the system.

Each tier has three basic access rights represented by octal powers of two:

• Read (r) = 4
• Write (w) = 2
• Execute (x) = 1
• None (-) = 0

To determine the octal number, simply sum the numbers for each tier:

• Read + Write + Execute = $4 + 2 + 1 = \mathbf{7}$
• Read + Execute = $4 + 0 + 1 = \mathbf{5}$
• Read + Write = $4 + 2 + 0 = \mathbf{6}$
• Read Only = $4 + 0 + 0 = \mathbf{4}$

Standard Linux Permission Matrix

Files vs. Directories: Why Directories Need Execute (x)

A common point of confusion is why directories require the Execute (x) bit:

• On a file, execute permits the operating system to run it as a binary or shell script.
• On a directory, execute allows an account to enter (traverse) the directory via cd and read metadata of files inside.

If you set a web root directory to 644, Nginx or Apache will throw a 403 Forbidden error because the web worker (www-data or nginx) cannot traverse through the parent directory.

The Safe Production Bulk Command

To restore broken permissions across an entire project safely:

# Set all directories to 755
find /var/www/html -type d -exec chmod 755 {} +

# Set all files to 644
find /var/www/html -type f -exec chmod 644 {} +

# Lock down sensitive environment files
chmod 600 /var/www/html/.env

Interactive Chmod Calculator

Need to visually toggle Read, Write, and Execute bits with instant symbolic and octal conversion? Use our client-side utility:

• Chmod Permissions Calculator — Visual checkbox matrix with one-click Linux terminal commands.
• Nginx Reverse Proxy Generator — Generate secure upstream and SSL Nginx server blocks.