chmod `700` — what does it mean?

700 is the private-directory mode. Other users cannot list it, cannot enter it and cannot open anything inside it, even files that are themselves 644, because they cannot traverse the directory. That property is why tools that store credentials insist on it: OpenSSH expects ~/.ssh to be private and GnuPG warns about 'unsafe permissions on homedir' if ~/.gnupg is not 700.

In plain English

700

rwx------

The owner can read, write and execute or enter it; the group and other users have no access at all.

Symbolic equivalent: chmod u=rwx,g=,o= ~/.ssh

Open 700 in the chmod calculator

What each digit in 700 means

Each octal digit is the sum of read (4), write (2) and execute (1) for one class of users. The digits are, in order, the file's owner, the file's group, and everyone else.

Class	Digit	Sum	r w x	ls -l
Owner (u)	7	4 + 2 + 1	rwx	rwx
Group (g)	0	0 + 0 + 0	---	---
Others (o)	0	0 + 0 + 0	---	---

Owner: can list the names of entries, create, rename and delete entries and enter the directory and open files by name.
Group: no access at all.
Others: no access at all.

When to use chmod 700

~/.ssh and ~/.gnupg, and other per-user credential directories such as ~/.aws or ~/.kube if you want them locked down.
Home directories on multi-user servers where users should not see each other's files (useradd with HOME_MODE 0700, or chmod 700 /home/alice).
Scripts only you should be able to read and run, such as a backup script that contains a passphrase.
Private working directories for a service account, e.g. /var/lib/myapp owned by myapp.

Security risks and gotchas

Too strict for anything a service must read

If nginx, PHP-FPM or a cron job running as another user needs files below a 700 directory, it gets 'Permission denied' no matter how open the files are. Either run the service as the owner, or use 750 with a shared group.

Do not chmod -R 700 ~/.ssh

It works, but it makes every key and config file executable, which is meaningless and confuses audits. Set the directory to 700 and the files to 600 (public keys can stay 644).

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_* ~/.ssh/config ~/.ssh/authorized_keys
chmod 644 ~/.ssh/*.pub

Commands

Lock a directory to its owner

chmod 700 ~/.ssh

Equivalent to chmod u=rwx,go= ~/.ssh. The empty go= removes every bit for group and others.

Remove all group/other access, keep owner bits

chmod go-rwx ~/private

Useful when you do not know or care whether the owner bits are rwx or rw-.

Private tree: dirs 700, files 600

find ~/secrets -type d -exec chmod 700 {} +
find ~/secrets -type f -exec chmod 600 {} +

Or in one pass: chmod -R u=rwX,go= ~/secrets.

How to check for 700

# Symbolic view
ls -ld ~/.ssh
drwx------  2 alice alice  4096 Oct 16 09:12 ~/.ssh

# Octal view (Linux / GNU coreutils)
stat -c '%a %A %n' ~/.ssh
700 drwx------ ~/.ssh

# Octal view (macOS / BSD)
stat -f '%Lp %Sp %N' ~/.ssh

The first character of the ls -l output is the file type (- regular file, d directory), followed by the nine permission characters. stat -c %a prints the octal mode directly; it only shows a fourth leading digit when setuid, setgid or the sticky bit is set.

Related chmod modes

600rw-------

Owner read and write only

750rwxr-x---

Owner full access, group read and execute, others none

755rwxr-xr-x

Owner full access, everyone else read and execute

400r--------

Owner read-only

Try variations of 700 in the chmod calculator, browse all chmod modes, or read Linux file permissions explained for chown, umask and ACLs.

Frequently Asked Questions

Why does ~/.ssh need to be 700?▾

sshd's StrictModes refuses key-based login if ~/.ssh, your home directory or authorized_keys is writable by group or others, because another user could then add their own key. 700 is the recommended mode; it also stops other users from listing your key files.

What is the difference between chmod 700 and chmod 600?▾

700 includes execute for the owner and 600 does not. Use 700 for directories (which need execute to be entered) and for scripts you run. Use 600 for regular files like private keys and .env files.

Can root still read a 700 directory?▾

Yes. Root bypasses read and write permission checks. File permissions protect users from each other, not from the administrator.

chmod 700 — what does it mean?