600 vs 644
Use 600 when a file contains anything secret (keys, passwords, tokens) and 644 when it is fine for every user on the machine to read it. Both let only the owner write.
Side by side
chmod 600
chmod 600 = rw-------: owner read and write, everyone else nothing.
| Read 4 | Write 2 | Execute 1 | Digit | |
|---|---|---|---|---|
| Owner (user) | 6 | |||
| Group | 0 | |||
| Others | 0 | |||
| Special | 0 |
6Owner (user): 6 = 4 read + 2 write0Group: 0 = no permissions0Others: 0 = no permissions
On a file
- Owner (user) read it and change it
- Group no access
- Others no access
On a directory
- Owner (user) list the names inside; write without x does nothing useful (names only: without x the files cannot be opened or even stat'ed)
- Group no access
- Others no access
chmod 600 filechmod u=rw,go= filels -l → -rw-------
chmod 644
chmod 644 = rw-r--r--: owner read and write, everyone else read.
| Read 4 | Write 2 | Execute 1 | Digit | |
|---|---|---|---|---|
| Owner (user) | 6 | |||
| Group | 4 | |||
| Others | 4 | |||
| Special | 0 |
6Owner (user): 6 = 4 read + 2 write4Group: 4 = 4 read4Others: 4 = 4 read
On a file
- Owner (user) read it and change it
- Group read it
- Others read it
On a directory
- Owner (user) list the names inside; write without x does nothing useful (names only: without x the files cannot be opened or even stat'ed)
- Group list the names inside (names only: without x the files cannot be opened or even stat'ed)
- Others list the names inside (names only: without x the files cannot be opened or even stat'ed)
chmod 644 filechmod u=rw,go=r filels -l → -rw-r--r--
What to know
The difference is read access for group and others: 644 grants it, 600 removes it. On a single-user laptop that may seem academic, but on servers every service account (web server, database, CI runner) counts as "others".
Some programs enforce the difference. ssh refuses to use a private key that is 644, and ssh -i key.pem fails with "UNPROTECTED PRIVATE KEY FILE" until you run chmod 600 (or 400). Public keys and authorized_keys may be 644.
Gotchas
- Making a config file 600 can break the service that reads it if the service runs as another user. Use 640 with the service's group.
- Files created by
cp,touchor an editor get your umask's default (often 644). Secrets need an explicitchmod 600orinstall -m 600.
Related explainers
- chmod 600 (rw-------)chmod 600 makes a file readable and writable by its owner only. The right mode for SSH private keys, .env...
- chmod 644 (rw-r--r--)chmod 644 lets the owner read and write a file while everyone else can only read it. The default for...
- chmod 400 (r--------)chmod 400 makes a file readable by its owner only, with no write access. Why AWS tells you to chmod 400...
- chmod 640 (rw-r-----)chmod 640 lets the owner read and write, the group read, and others nothing. The usual mode for secret...