TechCompare LogoTechCompare
Showing centimeters. Press to switch to inches.Showing inches. Press to switch to centimeters.

What does chmod 400 mean? Read-only permissions for keys and files

By TechCompare · Updated · How we check

chmod 400 sets permissions to r--------: the owner can read the file, and group and others get nothing. Use it for SSH private keys and for files you only ever read.

Mode 400 lets the owner read the file and nothing else. Writing to it needs a chmod first, so it guards against accidental edits, the owner included. In ls -l it shows as -r--------. A script run by the owner can't write to the file either, until someone changes the mode.

Octal
400
chmod 400
Symbolic
r--------
Owner / Group / Others
Category
Secure Permissions
Restricted access
chmod 400 set on the configurator, pre-loaded. Flip individual permission bits or try a sibling mode.
Edit in the full tool

How this is calculated

In octal, the owner's digit is 4, which is read only, and the group and others digits, 0 and 0, add up to nothing. There's no write or execute bit anywhere in the mode.

Read-only isn't a lock. The owner can run chmod to add write back. Deleting a file depends on the folder's write permission, not the file's own bits, so a 400 file in a folder you can write to can still be removed. An editor may warn that the file is read only.

The ssh(1) manual says a private key 'should be readable by the user but not accessible by others', and that ssh 'will simply ignore a private key file if it is accessible by others'. So 400 and 600 both work for a key. 400 is the stricter choice because it also takes away the owner's write bit.

Verdict

Reach for 400 when a key or file should stay unchanged. A downloaded key file that others can read, such as one at mode 644, is ignored by ssh, and chmod 400 key.pem is the quick fix.

Don't use 400 for a file a program has to write, like a log, a database or a config the app rewrites. A program that writes to the file in place, running as the owner, gets a permission error. Use 600 for those.

More CHMOD scenarios

chmod 755
chmod 755 sets permissions to rwxr-xr-x: the owner can read, write, and execute, while the group and everyone else can read and execute but not modify.
View details
chmod 644
chmod 644 sets permissions to rw-r--r--: the owner can read and write, and the group and everyone else can only read.
View details
chmod 777
chmod 777 sets permissions to rwxrwxrwx: every user on the system can read, write, and execute the file or directory.
View details

Related guides

chmod 600: SSH key permissions
The write-capable option, for a key or file the owner has to change.
View guide
chmod 700: private folder permissions
The owner-only mode for a folder, with execute so you can enter it.
View guide
chmod 644: standard file permissions
Readable by others and writable by the owner, for files that aren't secret.
View guide

Frequently asked questions

chmod 400 or 600 for an SSH key?
Either one works. The ssh(1) manual says ssh ignores a private key that others can access, and both modes keep others out. 400 is the stricter pick, since the owner can't write to the key. Choose 600 only if you need to edit or replace the key in place.
What does chmod 400 mean?
It's the owner's read bit alone. In letters that's r--------, so the owner can open the file but has to run chmod before changing it. Group and others have no bits set.
Can the owner still delete or change a 400 file?
Yes to both. The owner can run chmod to restore write access and then change the file. Deleting doesn't depend on the file's own bits. It depends on write and search permission on the folder that holds the file, so a 400 file in a folder you can write to can be removed.
Why won't ssh use my private key file?
The ssh(1) manual says ssh ignores a private key file that others can access. Run ls -l on the file to see its mode. If others can access it, run chmod 400 or chmod 600 on it. Both keep the file away from others while the owner keeps read access.

Related tools

Subnet Calculator

Calculate network address, broadcast address, and usable IP ranges for IPv4/IPv6.

Use tool

JSON Formatter

Validate, format, and minify JSON. Browse it as a tree, run JSONPath queries, compare two documents, or validate against a JSON Schema.

Use tool

Unix Timestamp

Convert between Unix timestamps and human-readable dates.

Use tool