DevTools Hub

Search tools

Search for a developer tool

Linux Security

umask Calculator

Convert a umask to the default permissions new files and directories get, and back.

Part of the Linux Security Toolkit
umask → resulting permissions
New files default to

644 (rw-r--r--)

New directories default to

755 (rwxr-xr-x)

Desired permissions → umask
Required umask

027

What this does

Converts a umask value into the default permissions new files and directories actually get when created, and works the reverse direction too — enter the permissions you want by default, and get the umask that produces them. This is a different question from what Linux Permissions Calculator answers: that tool converts an existing file's permissions between notations; umask sets the default applied automatically the moment a new file or directory is created, before anyone runs chmod on it at all.

Why the math looks the way it does

Every new file starts from a maximum of 666 (read/write for everyone, never executable at creation regardless of umask) and every new directory starts from 777. umask is subtracted from that maximum, bit by bit — it can only remove permissions the maximum already offers, never add ones that aren't there. That's the entire calculation: result = max & ~umask, applied to each of the three permission digits independently.

Why reversing it needs both a file and a directory value

Files never carry an execute bit no matter what umask says, which means a desired file permission alone doesn't reveal what the umask's execute-bit component actually was — and that component still fully determines directory permissions. Giving both values lets this tool solve for the one umask consistent with both, and say clearly if the two values you entered can't come from the same umask at all.

FAQ

Why do files max out at 666 and directories at 777?

A newly created file is never executable by default, regardless of umask — the OS starts it at 666 (rw-rw-rw-) and umask can only remove bits from there. Directories start at 777 because a directory needs its execute bit (the ability to be entered/traversed) to be useful at all, so the full range is available for umask to restrict.

Why does the reverse calculator ask for both a file and a directory permission?

A desired file permission alone can't uniquely determine a umask, because files never carry an execute bit — the umask's execute-bit component is invisible to a file-only result but still shapes directory permissions. Providing both and cross-checking them is the only way to get back a single, unambiguous umask.

Is umask the same thing as chmod?

No — chmod changes the permissions of a file or directory that already exists. umask sets a default mask applied automatically whenever a new file or directory is created, before anyone runs chmod on it at all. They interact (umask decides the starting point, chmod can always change it afterward) but control different moments.

Where do I actually set a umask permanently?

In a shell startup file (~/.bashrc, ~/.profile, or /etc/profile for a system-wide default) with a line like umask 022. Running umask alone at a prompt only affects the current shell session and anything it spawns, not future logins.

What's a reasonable umask for a shared team server?

022 is the common default — files land at 644 and directories at 755, letting the group and others read but not write. 002 (664/775) is common specifically on servers where a shared group should be able to write to each other's files, at the cost of being more permissive by default.

Try it yourself

For how umask fits into securing a whole server, see umask Explained or the complete picture in Linux Security.

Related tools