# chmod 600 — What It Means & When to Use It

> Only the owner can read and write. Symbolic: `rw-------` · Safe when used as intended.

600 is the private-file mode: the owner can read and write, and no other user can do anything. It's what secrets should have.

SSH enforces it. If a private key is readable by others, ssh refuses to use it with 'Permissions 0644 for … are too open' and 'UNPROTECTED PRIVATE KEY FILE'.

## Permission by permission

| Who | Permissions |
|---|---|
| owner | read and write |
| group | no permissions |
| others | no permissions |

Symbolic chmod argument: `u=rw,g=,o=`

## Use it for

- SSH private keys (`~/.ssh/id_ed25519`) and `~/.ssh/authorized_keys`.
- `.env` files, API credentials, `.pgpass`, `.netrc`.
- Anything containing personal data.

## Avoid it for

- Files a service running as another user must read — use `640` with a shared group.
- Directories: they need execute to be entered; use `700`.

## FAQ

### How do I fix 'Permissions 0644 for id_rsa are too open'?

Run chmod 600 ~/.ssh/id_rsa (or whichever key it names). Also check the ~/.ssh directory is 700.

### 600 vs 400 for SSH keys?

Both work. 400 makes the key read-only even for you, which guards against accidental edits; 600 lets you overwrite it. ssh accepts either.

## Related modes

- [chmod 400](https://www.devkult.com/chmod/400.md): Only the owner can read; nobody can write or execute
- [chmod 700](https://www.devkult.com/chmod/700.md): Only the owner can read, write and execute
- [chmod 640](https://www.devkult.com/chmod/640.md): Owner can read and write; group can read; others have no access
- [chmod 644](https://www.devkult.com/chmod/644.md): Owner can read and write; everyone else can read

Open the interactive page: https://www.devkult.com/chmod/600