chmod 600 (rw-------)

Answer

chmod 600 sets rw-------: the owner can read and write the file, and no one else (other than root) can open it at all. It is the standard mode for files that contain secrets.

chmod 600 = rw-------: owner read and write, everyone else nothing.

	Read 4	Write 2	Execute 1	Digit
Owner (user)	Owner (user) rr	Owner (user) ww	Owner (user) x-	6
Group	Group r-	Group w-	Group x-	0
Others	Others r-	Others w-	Others x-	0
Special	setuidsetuid	setgidsetgid	stickysticky	0

6
Owner (user): 6 = 4 read + 2 write
0
Group: 0 = no permissions
0
Others: 0 = no permissions

On a file

Owner (user) read it and change it
Group no access
Others no access

On a directory

Owner (user) list the names inside; write without x does nothing useful (names only: without x the files cannot be opened or even stat'ed)
Group no access
Others no access

chmod 600 filechmod u=rw,go= filels -l → -rw-------

What to know

6 for the owner is read + write; the two zeros remove every permission for the group and for others. Several programs check for exactly this and refuse to use a secrets file that is more open.

OpenSSH rejects a private key if any group or other bit is set, so 600 and 400 both work, while 640 and 644 do not. PostgreSQL's client ignores a ~/.pgpass file that is group- or world-accessible, and prints a warning asking for 0600.

Where it fits

SSH private keys (~/.ssh/id_ed25519, id_rsa) and ~/.ssh/config
~/.ssh/authorized_keys (644 is also accepted)
.env files, ~/.pgpass, ~/.netrc and other credential files
TLS private keys used by a server that reads them as their owner (often root)

Gotchas

600 has no execute bit, so it is wrong for a directory: use 700 for ~/.ssh itself.
If a service runs as a different user than the file's owner, 600 locks it out. Either change the owner or use 640 with the service's group.
Copying a key with cp creates the new file using your umask (often 644). Check the mode after copying, or use install -m 600.

Related explainers

← chmod calculator