chmod 640

rw-r-----Safe when used as intended

Owner can read and write; group can read; others have no access.

640 is 644 with the outside world removed: the owner reads and writes, the group can read, and everyone else gets nothing.

It's the right mode for config files with credentials that a service needs to read. Debian and Ubuntu ship /etc/shadow as 640 root:shadow for exactly this reason.

Permission by permission

Who	Read	Write	Execute	Digit	Means
owner	✓	✓	—	6	read and write
group	✓	—	—	4	read only
others	—	—	—	0	no permissions

In ls -l: -rw-r----- for a file, drw-r----- for a directory.
Symbolic form: u=rw,g=r,o=
New files get this mode when the umask is 026.

Use it for

Config files with secrets, readable by the service's group (wp-config.php, database configs).
Logs that an admin group should read but other users shouldn't.

Avoid it for

When the reading service isn't in the group — it will get 'Permission denied'.
When only the owner needs it at all: use 600.

Commands

chmod 640 path

set this mode on a file or directory

chmod u=rw,g=r,o= path

the same, written symbolically

find path -type f -exec chmod 640 {} +

apply it to every file in a tree, leaving the directories alone

stat -c '%a %A %n' path

check the current mode on Linux (macOS: stat -f '%Lp %Sp %N' path)

Try variations

Mode — octal or ls -l form

640

-rw-r-----

Who	read	write	execute	Digit
owner				6
group				4
others				0

setuid— run as the file's ownersetgid— run as / inherit the groupsticky— only owners delete entries

The owner can read and write; the group can read only; everyone else can do nothing.

chmod 640 file

chmod u=rw,g=r,o= file

Read the full guide to chmod 640 →

Frequently asked questions

640 vs 644?

With 644 every user on the system can read the file; with 640 only the owner and the group can.