← All tools

Linux Capability Decoder

Turn a hex or decimal capability mask into cap_ names, or build the mask from a capability list.

Paste CapEff from /proc, or the 0x value from capsh
A mask is 64 bits wide; hexadecimal is what the kernel prints
Comma- or space-separated; cap_ prefix optional, so NET_ADMIN works too
Toggle capabilities

Capabilities in this mask

A Linux capability mask is a 64-bit bitmap: bit n set means capability n is present in that set. The kernel assigns 0 to 40 — cap_chown through cap_checkpoint_restore — while cap_perfmon (38) and cap_bpf (39) arrived in Linux 5.8 and cap_checkpoint_restore (40) in 5.9, so an older kernel knows fewer. The four sets read from /proc/<pid>/status are CapInh, CapPrm, CapEff, CapBnd and CapAmb; only CapEff is enforced, permitted limits what may be raised, and bounding limits what a process may ever gain. capsh --decode=0x… prints the same name list, and getcap/setcap read and write the security.capability attribute on a file. Decoding here is arithmetic only: it makes no judgement about whether a mask is safe, executes nothing, and sends nothing off this page.