What does chmod 600 mean? Private key permissions, SSH, and secure file practices
600 is a common owner-only default for files containing credentials, keys, or secrets. Use 400 when owner write access is unnecessary. Make it a habit: whenever you create a SSH key, a .env file with passwords, or a database config, chmod 600 immediately.
chmod 600 sets permissions to rw-------: only the owner can read and write the file. The group and everyone else get no access at all. This is a common default for SSH private keys. Mode 400 is also valid when the owner only needs read access. OpenSSH rejects user-owned private keys accessible by group or others.
By TechCompare · Updated
How this is calculated
In octal, 6 = 4+2+0 (read+write) for the owner, and the zeroes for group and others mean no permissions whatsoever. 600 is the standard for anything containing secrets: SSH keys, GPG private keys, database credential files, API token files. The principle is least privilege: if only one user needs access, only that user should have access. Many applications will warn or refuse to run if their config files are world-readable and contain passwords.
Verdict
The octal 600 sets the owner bits to 6 (4+2, read+write) and zeroes out group and others. That is a common owner-only setting for a single-user secret file. Mode 400 is stricter when the owner only needs to read it. SSH enforces restrictive permissions on private keys because a key readable by group or others could be copied by another account. The same principle applies to other credential stores: .env files with API tokens, AWS credentials under ~/.aws/, kubeconfig under ~/.kube/, and GPG secret keys. Choose the narrowest mode that still lets the application work.