chmod `400` — what does it mean?

400 is the strictest useful mode: one reader, no writers. It is what AWS tells you to run on a newly downloaded EC2 key pair (chmod 400 key.pem) and what many hardening guides suggest for certificates and config that should never change at runtime. It protects against accidents and other users, but not against the owner deliberately changing it: the owner can always chmod the file back.

In plain English

400

r--------

The owner can only read the file; nobody else has any access, and even the owner cannot modify it without changing the mode first.

Symbolic equivalent: chmod u=r,g=,o= key.pem

Open 400 in the chmod calculator

What each digit in 400 means

Each octal digit is the sum of read (4), write (2) and execute (1) for one class of users. The digits are, in order, the file's owner, the file's group, and everyone else.

Class	Digit	Sum	r w x	ls -l
Owner (u)	4	4 + 0 + 0	r--	r--
Group (g)	0	0 + 0 + 0	---	---
Others (o)	0	0 + 0 + 0	---	---

Owner: can read the contents; no write or execute.
Group: no access at all.
Others: no access at all.

When to use chmod 400

SSH private keys and cloud key pairs such as AWS .pem files. SSH accepts 400 as well as 600.
Secrets read by a single service account that should never rewrite them, e.g. wp-config.php (WordPress hardening suggests 400 or 440) or a database password file.
Backups, license files or certificates you want to protect from accidental edits.

Security risks and gotchas

Read-only for the owner is not immutability

The owner can still chmod u+w the file, and if the directory is writable the owner can delete or replace it. Root ignores the bits entirely. For real immutability on Linux use chattr +i (root only).

Tools that rewrite the file will fail

ssh-keygen -p (change passphrase), certbot renewals, or apps that update their own config get 'Permission denied' on a 400 file. Use 600 when the owner process needs to write.

A service running as another user cannot read it

Like 600, 400 only works when the reading process runs as the file's owner. For a service account in a group, use 440.

Commands

Lock a key file

chmod 400 key.pem

Equivalent to chmod u=r,go= key.pem.

Use it with SSH

ssh -i key.pem ec2-user@203.0.113.10

If the key is 644 SSH prints 'bad permissions' and refuses to use it.

Temporarily allow editing

chmod 600 key.pem   # edit
chmod 400 key.pem   # lock again

Read-only is a guard against accidents, so expect to toggle it.

How to check for 400

# Symbolic view
ls -l key.pem
-r--------  1 alice alice  1674 Oct 16 09:12 key.pem

# Octal view (Linux / GNU coreutils)
stat -c '%a %A %n' key.pem
400 -r-------- key.pem

# Octal view (macOS / BSD)
stat -f '%Lp %Sp %N' key.pem

The first character of the ls -l output is the file type (- regular file, d directory), followed by the nine permission characters. stat -c %a prints the octal mode directly; it only shows a fourth leading digit when setuid, setgid or the sticky bit is set.

Related chmod modes

600rw-------

Owner read and write only

444r--r--r--

Read-only for everyone

700rwx------

Owner full access, nobody else

640rw-r-----

Owner read and write, group read, others none

Try variations of 400 in the chmod calculator, browse all chmod modes, or read Linux file permissions explained for chown, umask and ACLs.

Frequently Asked Questions

What does chmod 400 do?▾

It sets the file to r--------: the owner can read it, and nobody else can read, write or execute it. The owner cannot write to it either unless they change the mode first.

Why does AWS say to chmod 400 my .pem file?▾

The SSH client refuses private keys that group or others can read, and a downloaded file is usually 644. 400 satisfies SSH and also protects the key from being overwritten by accident. 600 would work too.

Can I delete a file with chmod 400?▾

Yes, if you have write permission on the directory that contains it. Deleting a file is an operation on the directory, not the file. rm will ask for confirmation because the file is write-protected.

chmod 400 — what does it mean?