chmod 600

rw-------Safe when used as intended

Only the owner can read and write.

600 is the private-file mode: the owner can read and write, and no other user can do anything. It's what secrets should have.

SSH enforces it. If a private key is readable by others, ssh refuses to use it with 'Permissions 0644 for … are too open' and 'UNPROTECTED PRIVATE KEY FILE'.

Permission by permission

Who	Read	Write	Execute	Digit	Means
owner	✓	✓	—	6	read and write
group	—	—	—	0	no permissions
others	—	—	—	0	no permissions

In ls -l: -rw------- for a file, drw------- for a directory.
Symbolic form: u=rw,g=,o=
New files get this mode when the umask is 066.

Use it for

SSH private keys (~/.ssh/id_ed25519) and ~/.ssh/authorized_keys.
.env files, API credentials, .pgpass, .netrc.
Anything containing personal data.

Avoid it for

Files a service running as another user must read — use 640 with a shared group.
Directories: they need execute to be entered; use 700.

Commands

chmod 600 path

set this mode on a file or directory

chmod u=rw,g=,o= path

the same, written symbolically

find path -type f -exec chmod 600 {} +

apply it to every file in a tree, leaving the directories alone

stat -c '%a %A %n' path

check the current mode on Linux (macOS: stat -f '%Lp %Sp %N' path)

Try variations

Mode — octal or ls -l form

600

-rw-------

Who	read	write	execute	Digit
owner				6
group				0
others				0

setuid— run as the file's ownersetgid— run as / inherit the groupsticky— only owners delete entries

The owner can read and write; the group can do nothing; everyone else can do nothing.

chmod 600 file

chmod u=rw,g=,o= file

Read the full guide to chmod 600 →

Frequently asked questions

How do I fix 'Permissions 0644 for id_rsa are too open'?

Run chmod 600 ~/.ssh/id_rsa (or whichever key it names). Also check the ~/.ssh directory is 700.

600 vs 400 for SSH keys?

Both work. 400 makes the key read-only even for you, which guards against accidental edits; 600 lets you overwrite it. ssh accepts either.