umask explained

Create a new file on Linux and it usually lands as 644, while a new directory lands as 755. You never chose those numbers. They come from the umask, a per-process setting that decides which permission bits are withheld from anything you create. Once you see how it works, the values stop looking arbitrary.

Start from the defaults, then subtract

The system does not grant new files the full 777. It starts from a base of 666 for files and 777 for directories. Files begin without execute because a freshly written file is not meant to be run.

The umask is then removed from that base. The clearest way to think about it is a bitwise mask: any bit set in the umask is cleared from the result. For the common 022 mask:

files:        666 - 022 = 644   (rw-r--r--)
directories:  777 - 022 = 755   (rwxr-xr-x)

So 022 withholds write permission from group and other, which is why your files are readable by everyone but writable only by you.

Reading 022 versus 077

The umask is itself an octal number, read in the same owner, group, other order:

022 clears the write bit for group and other. Standard on most systems. Others can read your files.
077 clears all three bits for group and other. Nothing you create is visible to anyone else. Good for a server holding per-user data or secrets.
002 clears only other's write bit and is common on systems with per-user groups, letting group members collaborate.

A useful habit: the more restrictive the environment, the higher the middle and last digits. 077 is the privacy-conscious default.

Where to set it

The umask is inherited by child processes, so you set it once in a shell startup file and every program you launch respects it:

# in ~/.bashrc or ~/.profile
umask 077

Run umask with no argument to print the current value. For system-wide defaults, look at /etc/profile or /etc/login.defs, and for services managed by systemd, the UMask= directive in the unit file. Note that umask can only remove bits, never add them, so it cannot make a file more permissive than the 666 or 777 base.

Compute the result quickly

Rather than doing octal subtraction in your head, the chmod calculator lets you enter a base and a mask and shows the resulting permissions in both numeric and symbolic form, all in the browser with nothing sent to a server. If the underlying permission model is still new to you, read understanding chmod and Unix permissions first, and if you work with special bits, setuid, setgid, and the sticky bit covers the fourth digit.

The practical takeaway: pick 022 for normal shared systems and 077 when files should stay private by default, set it in your shell profile, and remember that umask only ever takes permissions away.