# chmod 400 — What It Means & When to Use It

> Only the owner can read; nobody can write or execute. Symbolic: `r--------` · Safe when used as intended.

400 is the strictest useful mode: the owner can read the file, and nobody — the owner included — can write to it or execute it.

AWS's EC2 guides tell you to run `chmod 400 key.pem` before connecting, because ssh refuses private keys that others can read.

## Permission by permission

| Who | Permissions |
|---|---|
| owner | read only |
| group | no permissions |
| others | no permissions |

Symbolic chmod argument: `u=r,g=,o=`

## Use it for

- SSH and EC2 `.pem` private keys.
- Certificates' private keys and other secrets that never change.

## Avoid it for

- Files you update — you'll need to chmod them first. Use `600`.
- Files a service must read when running as another user.

## FAQ

### Why does AWS say to chmod 400 my .pem file?

ssh refuses to use private keys that other users can read. 400 makes the key readable only by you, and read-only so it can't be changed by accident.

## Related modes

- [chmod 600](https://www.devkult.com/chmod/600.md): Only the owner can read and write
- [chmod 444](https://www.devkult.com/chmod/444.md): Everyone can read; nobody can write or execute
- [chmod 700](https://www.devkult.com/chmod/700.md): Only the owner can read, write and execute

Open the interactive page: https://www.devkult.com/chmod/400