umask 077

Answer

With umask 077, new files are created 600 (rw-------) and new directories 700 (rwx------). Nothing you create is readable by your group or by other users unless you change it explicitly.

What umask 077 gives

New files: 600 rw-------
New directories: 700 rwx------
umask -S: u=rwx,g=,o=

What to know

077 is a sensible umask for scripts that write secrets, backups or key material: set umask 077 at the top of the script so every file it creates starts private, with no window where it is briefly readable.

Some hardening guides recommend 027 instead (files 640, directories 750), which keeps the group able to read.

Gotchas

Files that other users or services must read (web content, shared configs) end up unreadable, which shows up later as 403 errors or "Permission denied" in a different program.
With umask 077, chmod +x file gives only the owner execute (644 becomes 744), because chmod with no who-letter is filtered by the umask.
Installing software under umask 077 as root can leave files in /usr/local or /opt unreadable for normal users.

Related explainers

← chmod calculator