chmod `640` — what does it mean?

640 is the mode for a file that one account maintains and one group of services reads, with the rest of the system kept out. It is how Debian and Ubuntu protect /etc/shadow (root:shadow, 640) and many log files under /var/log (owned by syslog, group adm). It is also the cleanest way to let a web server or app read a config file containing credentials without making it world-readable.

In plain English

640

rw-r-----

The owner can read and write; group members can only read; all other users have no access.

Symbolic equivalent: chmod u=rw,g=r,o= .env

Open 640 in the chmod calculator

What each digit in 640 means

Each octal digit is the sum of read (4), write (2) and execute (1) for one class of users. The digits are, in order, the file's owner, the file's group, and everyone else.

Class	Digit	Sum	r w x	ls -l
Owner (u)	6	4 + 2 + 0	rw-	rw-
Group (g)	4	4 + 0 + 0	r--	r--
Others (o)	0	0 + 0 + 0	---	---

Owner: can read the contents and modify the contents; no execute.
Group: can read the contents; no write or execute.
Others: no access at all.

When to use chmod 640

Application secrets such as .env, wp-config.php or database.yml owned by a deploy user with the app's runtime group.
TLS private keys readable by a group, e.g. Debian's ssl-cert group for /etc/ssl/private/*.key.
Log files readable by an admin group (adm on Debian/Ubuntu) for log shippers and monitoring.
/etc/shadow on Debian and Ubuntu, so that tools in the shadow group can verify passwords.

Security risks and gotchas

Check the group, not just the mode

640 is only as private as its group. A .env with group users or staff is readable by every human account. ls -l shows the group in the fourth column.

SSH rejects it for private keys

The OpenSSH client requires private keys to have no group or other bits at all, so 640 fails with 'Permissions 0640 ... are too open'. Keys need 600 or 400.

Commands

Set 640 on a config file

chmod 640 .env

Equivalent to chmod u=rw,g=r,o= .env.

Give the app's group read access

sudo chown deploy:www-data /srv/myapp/.env
chmod 640 /srv/myapp/.env

deploy can edit, the web server (in www-data) can read, other users cannot.

All files in a tree to 640

find /srv/myapp -type f -exec chmod 640 {} +

Pair with 750 for directories. chmod -R 640 would remove execute from directories and lock everyone out.

How to check for 640

# Symbolic view
ls -l .env
-rw-r-----  1 deploy www-data   318 Oct 16 09:12 .env

# Octal view (Linux / GNU coreutils)
stat -c '%a %A %n' .env
640 -rw-r----- .env

# Octal view (macOS / BSD)
stat -f '%Lp %Sp %N' .env

The first character of the ls -l output is the file type (- regular file, d directory), followed by the nine permission characters. stat -c %a prints the octal mode directly; it only shows a fourth leading digit when setuid, setgid or the sticky bit is set.

Related chmod modes

600rw-------

Owner read and write only

750rwxr-x---

Owner full access, group read and execute, others none

644rw-r--r--

Owner read and write, everyone else read-only

400r--------

Owner read-only

Try variations of 640 in the chmod calculator, browse all chmod modes, or read Linux file permissions explained for chown, umask and ACLs.

Frequently Asked Questions

What does chmod 640 mean?▾

6 (read + write) for the owner, 4 (read) for the group and 0 for others: rw-r-----. The owner edits the file, the group can read it, nobody else can open it.

Is 640 or 600 better for a .env file?▾

Use 600 when the app runs as the file's owner. Use 640 when the file is owned by a deploy user and the app runs as a different user in the file's group. Both keep other users out.

Why is /etc/shadow 640?▾

On Debian and Ubuntu it is owned by root with group shadow and mode 640, so that a few helper programs in the shadow group (such as unix_chkpwd) can check passwords without being root. RHEL and Fedora use mode 000 and rely on root bypassing permission checks.

chmod 640 — what does it mean?