chmod `644` — what does it mean?

644 is what a new file gets when your umask is 022: the 666 that programs request when creating a file, minus write for group and others. It is the right mode for ordinary content that anyone may read but only you may change, such as web pages, images, documentation and non-secret config. Because the 'others' digit includes read, it is the wrong choice for keys, tokens and .env files.

In plain English

644

rw-r--r--

The owner can read and write; the group and all other users can only read. Nobody can execute it.

Symbolic equivalent: chmod u=rw,g=r,o=r index.html

Open 644 in the chmod calculator

What each digit in 644 means

Each octal digit is the sum of read (4), write (2) and execute (1) for one class of users. The digits are, in order, the file's owner, the file's group, and everyone else.

Class	Digit	Sum	r w x	ls -l
Owner (u)	6	4 + 2 + 0	rw-	rw-
Group (g)	4	4 + 0 + 0	r--	r--
Others (o)	4	4 + 0 + 0	r--	r--

Owner: can read the contents and modify the contents; no execute.
Group: can read the contents; no write or execute.
Others: can read the contents; no write or execute.

When to use chmod 644

Static web assets and PHP/HTML files served by nginx or Apache, which run as a different user (www-data, nginx) and only need read.
Public config such as /etc/hosts, /etc/passwd (it holds no password hashes), /etc/nginx/nginx.conf and most files in /etc.
Source code, README files and documentation in a project or a shared server.
~/.ssh/authorized_keys and ~/.ssh/known_hosts, and SSH public keys (id_ed25519.pub). sshd only rejects authorized_keys if it is writable by group or others; 600 is stricter and also fine.

Security risks and gotchas

Not for private keys

OpenSSH refuses to use a private key that is readable by anyone other than you: 'WARNING: UNPROTECTED PRIVATE KEY FILE! Permissions 0644 for id_ed25519 are too open.' Private keys must be 600 or 400.

chmod 600 ~/.ssh/id_ed25519

World-readable secrets

A .env, wp-config.php or database.yml at 644 can be read by every local account and every process, including a compromised web app running as a different user. Use 640 with a shared group, or 600 if only the owner process reads it.

Directories at 644 are broken

A directory with 644 can be listed by name but not entered: without execute, nobody except root can open files inside it. This is the classic result of chmod -R 644 on a folder, and it shows up as 403 Forbidden on web servers.

find /var/www/html -type d -exec chmod 755 {} +

Commands

Set 644 on a file

chmod 644 index.html

Equivalent to chmod u=rw,go=r index.html.

Remove execute that should not be there

chmod a-x index.html

Turns an accidental 755 file back into 644 without touching read/write.

All files in a tree to 644 (not directories)

find /var/www/html -type f -exec chmod 644 {} +

Never chmod -R 644 a directory: it removes execute from the directories too and makes them unenterable.

How to check for 644

# Symbolic view
ls -l index.html
-rw-r--r--  1 deploy deploy  5321 Oct 16 09:12 index.html

# Octal view (Linux / GNU coreutils)
stat -c '%a %A %n' index.html
644 -rw-r--r-- index.html

# Octal view (macOS / BSD)
stat -f '%Lp %Sp %N' index.html

The first character of the ls -l output is the file type (- regular file, d directory), followed by the nine permission characters. stat -c %a prints the octal mode directly; it only shows a fourth leading digit when setuid, setgid or the sticky bit is set.

Related chmod modes

755rwxr-xr-x

Owner full access, everyone else read and execute

664rw-rw-r--

Owner and group read and write, others read-only

640rw-r-----

Owner read and write, group read, others none

600rw-------

Owner read and write only

444r--r--r--

Read-only for everyone

Try variations of 644 in the chmod calculator, browse all chmod modes, or read Linux file permissions explained for chown, umask and ACLs.

Frequently Asked Questions

What does chmod 644 mean?▾

6 for the owner is read + write (4+2), 4 for the group is read, and 4 for others is read. Symbolically it is rw-r--r--. The owner can edit the file; everyone else can only read it.

Is 644 secure for config files?▾

Only for config that holds no secrets. Any user on the system can read a 644 file. For files with passwords or API keys, use 640 (readable by a service group) or 600 (owner only).

Why do my new files get 644 automatically?▾

Programs create files with mode 666 and the kernel removes the bits in your umask. With the common umask 022, 666 minus write for group and others is 644. Run umask to see yours.

chmod 644 — what does it mean?