Linux & Shell
Enter a mask and the modes requested by the creating program. Compare file and directory permissions with bit-by-bit steps.
0644 · rw-r--r--
Actually removed: 0022 · ----w--w-
A result bit is set only if requested and not masked.
0666 & (~0022 & 0777) = 0644
0755 · rwxr-xr-x
Actually removed: 0022 · ----w--w-
A result bit is set only if requested and not masked.
0777 & (~0022 & 0777) = 0755
Calculated in your browser; inputs are not uploaded or saved.
Mask symbols describe allowed bits: u=rwx,g=rx,o=rx equals 022. All three classes are required.
Only the supplied requests are calculated. Default ACLs and later permission changes are not simulated.
Permissions calculated.
The umask calculator helps explain why a new file has different permissions from a new directory, even though the creating process uses the same mask. Start with the usual requests, then change them to match your application.
A mask removes permissions; it cannot supply a missing bit. The requested mode is an input to this calculation, not a universal limit imposed on every program.
The umask calculator keeps file and directory requests separate. With 111, a file requesting 666 stays at 666, while a directory requesting 777 loses its execute bits. The difference is visible without pretending that octal subtraction is the algorithm.
The umask calculator distinguishes the permissions allowed by the mask from the permissions actually requested. Changing a file request to 777 can retain execute bits; leaving it at 666 cannot. Compare the request, allowed bits and final intersection.
Choose 111 in the example selector, then preview and apply it. The file stays at 0666. The preview reports exactly how many fields change, and Undo restores the previous input and result.
The mask accepts a complete umask -S value such as u=rwx,g=rx,o=rx. Requested modes instead accept a nine-character string such as rw-rw-rw-. These two forms express different things.
Turn off automatic calculation to edit several fields together. Changes disable exports immediately; Calculate or Ctrl/Cmd+Enter refreshes the report. Expand the bit steps to check each operand before copying.
Compare default file permissions based on 0666 and directory permissions based on 0777, or replace either request. A program creating an executable may request 0777; a private file may request only 0600.
An octal umask identifies the bits to clear. A symbolic umask in full u=,g=,o= form identifies allowed permissions. Results show both four-digit octal and rwx, grouped by owner, group and others.
Each result includes requested bits, mask bits, the nine-bit complement, and the final intersection. Removed bits are shown separately, so a mask bit absent from the request is not mistaken for a change.
A mask bit matters only when the same bit is present in the request. For a 0666 request, 026 and 027 both give 0640 because the differing execute bit was already absent. The operation is AND with the complemented mask, not subtraction.
Common file-creation commands request 0666, which contains no execute bits. A mask cannot add them. A program can request 0777 when creating an executable; enter that request here to see the corresponding result.
0022 and 022 represent the same mask here. The leading zero does not add a fourth permission class. The calculator accepts only zero in that position and rejects special-bit values such as 1022.
The output names permissions allowed through the mask. u=rwx,g=rx,o=rx describes allowed mode 0755 and mask 0022. It does not promise that a file requested with 0666 will receive execute permission.
On Linux, a parent default ACL is inherited and the request further limits its permissions; that path replaces the ordinary umask calculation. This tool has no ACL input, so use its result only for the mode-masking case.
Unexpected permission result?
The umask calculator lets you compare a program’s requested mode with what its mask can preserve. Check the operands before treating the output as an explanation of a real file.