umask Explained: Why Your New Files Are 644 and How to Change That
By Mohak Mangal · Published October 26, 2026 · 6 min read
You create a file and it comes out as -rw-r--r--. You make a directory and it's drwxr-xr-x. Nobody told the system to do that. A setting called umask decides it, and once you understand it, a whole category of "why can't my teammate edit this?" problems makes sense.
The idea in one sentence
A umask is a list of permission bits to remove from the defaults. New files start from 666 (read and write for everyone) and new directories start from 777. The umask knocks bits off.
New files don't start at 777 because the system doesn't make files executable by default. That choice is a safety measure: a freshly downloaded or created file can't run as a program until you deliberately allow it.
The four values you'll meet
| umask | New files | New directories | What it means |
|---|---|---|---|
| 022 | 644 | 755 | Others can read; only you can write. Common default. |
| 002 | 664 | 775 | Your group can write too. Common for shared project folders. |
| 027 | 640 | 750 | Group reads; others get nothing. |
| 077 | 600 | 700 | Only you. Good for sensitive material. |
The results come from masking: 666 & ~022 = 644 and 777 & ~022 = 755. For ordinary values, subtracting digit by digit gives the same answer, which is why people describe it as "subtract the umask".
Reading a umask digit by digit
Just like chmod, the three digits are owner, group and others. In 022, the first 0 removes nothing from the owner, the first 2 removes write from the group, and the second 2 removes write from others. Remember: with umask, a bigger number means more restriction, the opposite of how permissions feel in chmod.
Checking and changing it
- Type
umaskto see the current value for your shell. - Type
umask -Sfor a symbolic version, likeu=rwx,g=rx,o=rx. - Run
umask 027to change it for the current session only. - To make it permanent for your user, put the command in
~/.profileor~/.bashrc. System-wide defaults live in files like/etc/login.defsor/etc/profile, depending on the distribution.
Where umask causes real trouble
Shared project folders. Two developers share a directory. Each creates files with umask 022, so files come out as 644: the owner can write, the colleague can only read. Nothing's broken; the defaults are just wrong for collaboration. Setting umask to 002 and giving the directory the setgid bit (chmod g+s) means new files inherit the group and stay group-writable.
Web server uploads. If an application writes files that the web server later has to read, check both the umask of the writing process and the ownership. A restrictive 077 on a background worker is a classic cause of images that upload fine but return 403 errors.
Cron jobs and services. These don't read your personal shell profile, so they may run with a different umask than you expect. If permissions on generated files look random, that's often why.
It's a default, not a lock
Programs can ask for specific permissions when they create a file, and umask still removes bits from that request. And anyone with the right to do so can change permissions afterward with chmod. Umask only shapes what happens at creation time.
If you want to try values without a terminal, the umask calculator shows the resulting file and directory permissions instantly, and our chmod calculator covers the after-the-fact changes.