chmod `600` — what does it mean?

600 is the standard mode for a file that holds a secret. Several tools enforce it: the OpenSSH client refuses a private key that group or others can read, and PostgreSQL ignores ~/.pgpass unless it is 600 or stricter. If the owner needs the file to be writable (to rotate a token, append to known_hosts, edit a config), 600 is the right choice over 400.

In plain English

600

rw-------

The owner can read and write the file; the group and everyone else have no access.

Symbolic equivalent: chmod u=rw,g=,o= ~/.ssh/id_rsa

Open 600 in the chmod calculator

What each digit in 600 means

Each octal digit is the sum of read (4), write (2) and execute (1) for one class of users. The digits are, in order, the file's owner, the file's group, and everyone else.

Class	Digit	Sum	r w x	ls -l
Owner (u)	6	4 + 2 + 0	rw-	rw-
Group (g)	0	0 + 0 + 0	---	---
Others (o)	0	0 + 0 + 0	---	---

Owner: can read the contents and modify the contents; no execute.
Group: no access at all.
Others: no access at all.

When to use chmod 600

SSH private keys: ~/.ssh/id_rsa, ~/.ssh/id_ed25519, and ~/.ssh/config if it contains anything sensitive. ssh-keygen creates private keys as 600.
Credential files that tools check: ~/.pgpass, ~/.netrc, ~/.my.cnf, ~/.kube/config (Helm warns when it is group- or world-readable).
.env files, wp-config.php or application secrets read only by the process owner.
TLS private keys such as /etc/ssl/private/server.key when only root reads them (640 with a ssl-cert group is the Debian alternative).

Security risks and gotchas

Wrong owner means 600 locks the service out

A 600 file is readable only by its owner. If you create .env as root and the app runs as www-data, the app cannot read it. Fix the owner instead of opening the mode.

sudo chown www-data:www-data /srv/app/.env
chmod 600 /srv/app/.env

Copying keys resets permissions

Keys copied from Windows, a USB stick, a Git checkout or an email attachment often arrive as 644 or 755. SSH then fails with 'Permissions 0644 for ... are too open' and 'bad permissions'. Re-apply 600 after every copy.

Directory access still matters

600 on the file does not hide its name: if the directory is 755, others can see that id_rsa exists. Put secrets in a 700 directory.

Commands

Fix an SSH private key

chmod 600 ~/.ssh/id_rsa

Equivalent to chmod u=rw,go= ~/.ssh/id_rsa. 400 also satisfies SSH.

All private keys in ~/.ssh

chmod 600 ~/.ssh/id_*
chmod 644 ~/.ssh/*.pub

The glob also matches .pub files, so put the public keys back to 644 afterwards.

Create a file as 600 from the start

(umask 077 && touch .env)
install -m 600 /dev/null .env

Avoids the window where a new secret file exists with 644 before you chmod it.

How to check for 600

# Symbolic view
ls -l ~/.ssh/id_rsa
-rw-------  1 alice alice  2602 Oct 16 09:12 ~/.ssh/id_rsa

# Octal view (Linux / GNU coreutils)
stat -c '%a %A %n' ~/.ssh/id_rsa
600 -rw------- ~/.ssh/id_rsa

# Octal view (macOS / BSD)
stat -f '%Lp %Sp %N' ~/.ssh/id_rsa

The first character of the ls -l output is the file type (- regular file, d directory), followed by the nine permission characters. stat -c %a prints the octal mode directly; it only shows a fourth leading digit when setuid, setgid or the sticky bit is set.

Related chmod modes

400r--------

Owner read-only

700rwx------

Owner full access, nobody else

640rw-r-----

Owner read and write, group read, others none

644rw-r--r--

Owner read and write, everyone else read-only

Try variations of 600 in the chmod calculator, browse all chmod modes, or read Linux file permissions explained for chown, umask and ACLs.

Frequently Asked Questions

Why must ~/.ssh/id_rsa be 600?▾

The OpenSSH client checks that the private key file has no permission bits for group or others. If any are set it prints 'UNPROTECTED PRIVATE KEY FILE' and ignores the key. 600 and 400 both pass the check.

Should I use 600 or 400 for a private key?▾

Either works for SSH. 400 also stops you from accidentally overwriting the key, which is why AWS tells you to chmod 400 downloaded .pem files. 600 is what ssh-keygen creates and lets tools rewrite the file, for example when you change the passphrase with ssh-keygen -p.

Is 600 enough to protect a secret?▾

It protects it from other non-root users on the same machine. Root, backups, and anything running as the owner can still read it. For secrets in Git, a 600 mode does nothing: it is not stored in the repository.

chmod 600 — what does it mean?