umask Calculator
See exactly what permissions new files and directories get from a umask.
System verdict
RESULTumask 022 → files 644, directories 755
The execute bit is stripped from new files no matter the umask, so a script you create still needs an explicit chmod +x. Directories keep execute, which is what makes them traversable.
- umask
- 022
- New filesFrom the 666 default — files never receive execute from creation
- 644 (rw-r--r--)
- New directoriesFrom the 777 default
- 755 (rwxr-xr-x)
What this cannot tell you
- Pure arithmetic on the umask and the standard defaults. It reflects how umask works, not any local override your shell or system may apply.
- Special bits (setuid, setgid, sticky) are shown only as far as the umask affects them; it does not model default ACLs.
How this calculation works
A umask does not set permissions — it removes them. New files start from 666 and new directories from 777, and the umask masks off bits from those defaults. This tool applies the mask and shows the result both ways, and flags the masks whose consequences catch people out.
What the results mean
- New files
- The mode a freshly created file gets. Execute is never granted at creation regardless of umask, which is why a new script still needs chmod +x.
- New directories
- The mode a new directory gets. Directories keep execute, because execute on a directory is what allows traversal into it.
- World-writable warning
- A umask that leaves new directories writable by anyone is almost never intended and is flagged.
Common problems and fixes
- My new script is not executable
- That is expected — umask cannot grant execute to a new file. Run chmod +x on it after creating it, or the umask is not the tool for the job.
- The result does not match what I see on my system
- Something is overriding the umask — a pam_umask setting, an ACL, or a systemd service with its own UMask directive. This tool shows the pure umask arithmetic.
Frequently asked questions
What is a safe default umask?
022 is the common default, giving 644 files and 755 directories — owner writes, everyone reads. 027 is more private, hiding new files from other users entirely. Avoid anything that leaves the world-write bit set.
Why 666 and 777 as the starting points?
By convention, files are created without execute (666 = rw for all) and directories with it (777 = rwx for all), and the umask subtracts from there. The system never adds execute to a file at creation, so the file default tops out at 666.