Unix Permissions
Quick answer: every file has three permission triplets — owner, group, others — and each triplet is read (r=4), write (w=2), execute (x=1). Add them up per triplet to get the octal digit: rwx = 7, r-x = 5, rw- = 6, r-- = 4. So 755 means rwxr-xr-x.
Reading the symbols
ls -l shows ten characters like drwxr-xr--. The first is the file type (d directory, - regular file, l symlink). The rest are three triplets: owner, group, others. On a file, x means "run as a program". On a directory, r means "list names", w means "create/delete entries", and x means "enter (cd into) it" — a directory with r but no x shows names but refuses access to the files.
The chmod calculator converts between octal and symbolic notation in both directions and builds the chmod command for you.
The modes you actually use
| 755 | rwxr-xr-x | Executable or directory everyone can enter, only the owner can change. Default for scripts and public directories. |
| 644 | rw-r--r-- | File everyone can read, only the owner can edit. Default for web content and source files. |
| 700 | rwx------ | Private directory or program: owner only. Standard for ~/.ssh. |
| 600 | rw------- | Private file: owner only. Required by SSH for private keys and by many tools for credential files. |
| 640 | rw-r----- | Owner edits, group reads. Common for config files shared with a service group. |
| 750 | rwxr-x--- | Owner full access, group can enter/run, others nothing. |
| 444 | r--r--r-- | Read-only for everyone, including the owner (until chmod or rm -f overrides). |
| 777 | rwxrwxrwx | Anyone can do anything. Almost always wrong — a sign something else (ownership) is misconfigured. |
Special bits and umask
A fourth octal digit in front carries the special bits: setuid (4) runs an executable with the file owner's identity, setgid (2) runs with the file's group, and on directories forces new files to inherit the group; sticky (1) on a directory like /tmp (1777) means only a file's owner can delete it.
umask decides which permissions are removed from new files: with the common umask 022, new files get 666-022 = 644 and new directories 777-022 = 755. A stricter umask 077 makes everything private by default.