chmod 640 (rw-r-----)

Answer

chmod 640 sets rw-r-----: the owner can read and write, members of the file's group can only read, and everyone else has no access. It shares a secret with exactly one group.

chmod 640 = rw-r-----: owner read and write, group read, others nothing.

	Read 4	Write 2	Execute 1	Digit
Owner (user)	Owner (user) rr	Owner (user) ww	Owner (user) x-	6
Group	Group rr	Group w-	Group x-	4
Others	Others r-	Others w-	Others x-	0
Special	setuidsetuid	setgidsetgid	stickysticky	0

6
Owner (user): 6 = 4 read + 2 write
4
Group: 4 = 4 read
0
Others: 0 = no permissions

On a file

Owner (user) read it and change it
Group read it
Others no access

On a directory

Owner (user) list the names inside; write without x does nothing useful (names only: without x the files cannot be opened or even stat'ed)
Group list the names inside (names only: without x the files cannot be opened or even stat'ed)
Others no access

chmod 640 filechmod u=rw,g=r,o= filels -l → -rw-r-----

What to know

A common pattern is a config file owned by root (so the service cannot rewrite it) with the service's group and mode 640, so the service can read it but no other local user can.

On Debian and Ubuntu, /etc/shadow is 640 with group shadow: only root can change password hashes, and only programs running with the shadow group can read them.

Where it fits

Config files containing database passwords: chown root:myapp config.ini; chmod 640 config.ini
TLS private keys read by a server through a group such as ssl-cert
Log files readable by an admin group such as adm

Gotchas

Not acceptable for SSH private keys: OpenSSH requires that group and others have no access at all, so use 600.
The group must be a narrow one. A file that is 640 with group users is readable by every ordinary user.
The reader also needs execute permission on every directory on the path, for example 750 on the containing directory.

Related explainers

← chmod calculator