Umask calculator
With umask 022, new files get 644 (rw-r--r--) and new folders get 755 (rwxr-xr-x): enter any umask to see the default permissions it produces, in octal and rwx form, before you change a shell profile or a container image. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Umask
- 022
- Umask octal
- 022
- Umask numeric
- 18
- Umask symbolic
- ----w--w-
- File base octal
- 666
Every Unix-like process carries a umask that silently shapes the permissions of every new file and directory it creates. The kernel starts from a base mode—usually 0666 for ordinary files and 0777 for directories—then clears every bit that is set in the umask, so the mask subtracts permission bits rather than adding them. Developers, SREs, and students often need to answer a simple question before they edit shell profiles or container images: if my umask is 022, 002, or 077, what modes will brand-new files and folders actually receive? This umask-to-permissions calculator accepts that mask as one to four octal digits, applies the classic formula mode equals base bitwise-AND NOT umask, and returns octal, symbolic rwx, and numeric forms for both the file path and the directory path.
How umask subtracts bits from base creation modes
When a program creates a regular file, the operating system proposes the base mode 0666, which is read and write for owner, group, and other, with no execute bits. When it creates a directory, the base is 0777 so that the directory can be entered and listed by default. Before those bits stick, the kernel computes base bitwise-AND the bitwise complement of the process umask.
Every bit that is one in the umask is forced off in the result; bits that are zero in the umask are left exactly as they appear in the base. That is why a umask of 022 turns file base 0666 into 0644 and directory base 0777 into 0755: the write bits for group and other are cleared, while owner keep full rights and execute bits on directories remain for everyone. A stricter umask of 077 clears group and other entirely, yielding 0600 files and 0700 directories.
A relaxed umask of 002 only clears other-write, producing 0664 files and 0775 directories that suit multi-user shared project trees. Understanding this subtractive model prevents the common mistake of treating umask as a target mode you set directly; umask never grants extra bits beyond the base, and it never invents execute bits on ordinary files because those bits were never present in 0666. This calculator freezes that rule into a deterministic contract you can call from scripts, docs, and browser widgets without shelling out to a real umask builtin.
Where a umask permissions calculator earns its keep
Container and image authors pin a umask in Dockerfiles or entrypoint scripts and need a second opinion that the resulting default modes match security review notes before shipping. Shared Linux workstations and CI agents document a house umask so that artifacts land as 644/755 rather than world-writable; this tool turns that policy digit into explicit modes for runbooks and onboarding pages.
Classroom labs teaching POSIX permissions pair a umask lesson with live conversion so students see why 022 is the usual interactive default and why 077 is preferred for private home trees. Security checklists that ban group-writable secrets can compute the strictest mask that still allows intended collaboration without hand-counting rwx columns.
What you can do with it
Container and image hardening notes
Convert a Dockerfile umask into the exact default file and directory modes reviewers expect before merge.
Shared workstation and CI policy
Document house umask 022 or 002 as concrete 644/755 or 664/775 defaults for new artifacts.
POSIX classroom and exam prep
Let students enter a umask and verify file versus directory results against the base AND NOT mask rule.
FAQ
How do I convert a umask into default permissions?
Send umask as octal digits such as 022.
Why are new files not 777 when umask is 000?
Regular files start from base 0666, not 0777, so even a zero umask yields 666 for files and 777 for directories. Execute bits are never invented for ordinary files.
What umask formats are accepted?
A string of one to four octal digits (0–7), optionally with a 0o prefix.
What permissions does a umask of 077 give?
Private ones. It clears every bit for group and others, so new files come out as 0600 and new directories as 0700, and only the owner can read, write or enter them.
Which umask suits a shared project folder?
A umask of 002 only removes write permission for others, so files land as 0664 and directories as 0775. Members of the group can edit each other's work while everyone else can only read it.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/dev/umask-calculator \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"umask":"022"}'const res = await fetch("https://api.kit.forhosting.com/dev/umask-calculator", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"umask": "022"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/dev/umask-calculator",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"umask": "022"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev/umask-calculator", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"umask":"022"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"umask":"022"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev/umask-calculator", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"umask": "022"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "dev.umask_calculator",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Input contract, response fields, and validation rules
The nine permission bits are the scope of this capability: special-bit masks above 0777 are rejected rather than silently truncated. A formula string restates mode equals base AND NOT umask with the two bases named so clients can display the identity next to the numbers. Example: umask 022 yields file mode 644 (rw-r--r--) and directory mode 755 (rwxr-xr-x). Send a JSON body with one required field, umask, as a string of one to four octal digits such as 022, 0022, 77, or 0. On success the response echoes the normalized three-digit umask_octal, the decimal umask_numeric bit value, and umask_symbolic as a nine-character rwx string that shows which bits the mask itself carries. Parallel fields describe the file path—file_base_octal fixed at 666, file_mode_octal, file_mode_symbolic, and file_mode_numeric—and the directory path with dir_base_octal fixed at 777 plus matching mode fields. The endpoint never calls chmod, never reads process state, and never invents ACL or sticky-bit semantics; it is pure arithmetic on a short mask so every successful call is reproducible across Node, the free browser path, and edge workers.
Where a umask permissions calculator earns its keep
Keep the request to a short octal string, pin the octal and symbolic fields in tests, and you get a stable oracle for docs, LMS plugins, and infrastructure-as-code generators without standing up a full permission-management suite.
Technical questions
Does this change the umask of my shell or server?
No. It only computes the resulting modes. It never calls umask(2), chmod, or any filesystem API.
What does the umask calculator cost?
The browser tool is free. API requests use prepaid KIT balance at $0.002 per successful call; invalid input is not billed.