01
Keep one field at a time
Paste a bare value or one labeled line such as CapEff: 0000000000000003. Digit-only input is still hexadecimal: 10 means decimal 16. Other sets require a separate conversion.
Linux & Shell
Linux capability decoderfrom bits to names
Paste one hexadecimal mask or one /proc Cap field. Inspect its set bits or build a new combination with checkboxes.
Linux capability decoder
Build a mask from named bits
Decode a valid value first. Each checkbox opens a one-bit replacement preview; unnamed bits remain intact.
Decoded capabilities
This browser processes the pasted value locally, without reading your system or sending it to a server.
Interpretation and export
Fixed UAPI name snapshots; this does not detect your kernel or simulate its permission checks.
The result is out of date. Decode before editing bits or exporting.
A Linux capability decoder is useful when a process report gives you a long hex value rather than readable capability names. Keep the field label: CapEff and CapBnd can contain the same number while describing different sets.
The example has 14 named bits. It demonstrates the notation, not your browser’s permissions or a promise about every container runtime. Compare the source field and the selected name table before interpreting the result.
Why use this Linux capability decoder?
Keep the numerical value and its interpretation separate.
See which bits contribute to the value
The Linux capability decoder connects each set bit to its CAP_* name and a short explanation. Reverse selection previews the exact bit being changed, so a replacement remains visible before you apply it.
Read older tables without losing newer bits
A bit may be unnamed in the 3.16 snapshot and named in 5.9. Switching snapshots changes that classification while preserving the full mask, including all high bits through position 63.
Check the field, snapshot and replacement
02
Choose the table deliberately
The snapshots end at bits 37, 39 and 40 for Linux 3.16, 5.8 and 5.9. They are name dictionaries; a distribution may backport changes, and this page does not probe its running kernel.
03
Review before changing bits
Checkboxes are enabled only for a current valid result. Applying a preview updates the source and report together; Undo restores the previous source exactly. Manual decoding also supports Ctrl/Cmd + Enter.
Exact masks with useful context
A 64-bit capability bitmask
The Linux capabilities calculator keeps every unsigned bit, including bit 63. Hex is normalized to 16 lowercase digits and binary to 64 digits. Decimal and mask fields are strings in JSON, so large values retain their exact meaning.
Named entries and unnamed positions
The selected list includes the number and a brief purpose for every recognized capability. CAP_NET_BROADCAST remains identified as unused. An older table reports newer bits separately instead of inventing names or clearing them.
Reports that preserve the source set
Text and JSON exports retain the chosen table and optional CapEff or other field label. They include all set bits, even those without names. The text report is data for inspection, not syntax to pass directly to setcap.
Input limits and interpretation boundaries
- One unsigned hexadecimal value
- Accept 1–16 ASCII hex digits, with optional 0x/0X and surrounding whitespace. No decimal guessing, signs, separators or truncation. The input limit is 256 UTF-16 code units; exceeding either limit blocks export.
- Only five recognized field labels
- CapInh, CapPrm, CapEff, CapBnd and CapAmb are supported with a colon. A full status file, multiple nonempty lines, capability-name lists and +ep expressions are rejected. There is no PID, file or URL import.
- No model of permission transitions
- The name snapshot does not simulate execve, namespaces, securebits, seccomp or an LSM. It cannot infer required permissions or certify that a container is privileged or safe. Descriptions are summaries, not a complete kernel policy reference.
- Unknown bits survive edits
- Only named bits have checkboxes. All other set positions remain in the mask and reports. Selecting an older table never drops them. There is no bulk all-capabilities preset, unknown-bit deletion or privilege-granting command generator.
- Current results and reversible replacement
- An input or snapshot edit immediately disables exports. Automatic decoding waits 350 ms; turning it off cancels queued work. Example, clear and checkbox actions use a preview before applying, with one undo for the previous input and result.
Linux capability decoder questions
How can I inspect a process’s capabilities?
On the target Linux host, inspect the Cap fields in /proc/PID/status or use getpcaps where available. Paste one field here to read its bits. capsh --decode converts a hexadecimal mask on the host; neither method by itself reveals the minimum set the program needs.
How do I find the capabilities a program actually requires?
A snapshot shows capabilities held, not every operation a program will attempt. Review the program and its documented requirements, then observe representative workloads in a controlled environment. This decoder does not trace calls or recommend a minimal grant set.
Why are permitted capabilities not always effective?
The permitted set limits which capabilities a thread may place in its effective set. The effective set is the set used for capability checks; a thread can retain permitted capabilities while disabling them effectively. Decoding one field does not simulate how execution will transform the sets.
What does “ep” mean in a capability expression?
In libcap notation, p refers to permitted capabilities and e to effective state. File capabilities have an effective flag that participates in execution rules. An expression such as cap_net_raw+ep is not a hexadecimal mask and is rejected here; the letters are not extra bit numbers.
Why does capsh output differ from a process’s capability flags?
capsh --print reports the context in which capsh runs. To inspect another process, read that process’s status or use a suitable process-aware tool. Also distinguish file capabilities from thread capability sets and check whether the installed libcap knows newer names.
Still have a question?
Inspect another mask
Use the Linux capability decoder with the source field intact, compare its known and unnamed bits, then export the report you have checked.
A decoded number is not a security configuration guarantee.