# chmod 640 — What It Means & When to Use It

> Owner can read and write; group can read; others have no access. Symbolic: `rw-r-----` · Safe when used as intended.

640 is 644 with the outside world removed: the owner reads and writes, the group can read, and everyone else gets nothing.

It's the right mode for config files with credentials that a service needs to read. Debian and Ubuntu ship `/etc/shadow` as `640 root:shadow` for exactly this reason.

## Permission by permission

| Who | Permissions |
|---|---|
| owner | read and write |
| group | read only |
| others | no permissions |

Symbolic chmod argument: `u=rw,g=r,o=`

## Use it for

- Config files with secrets, readable by the service's group (`wp-config.php`, database configs).
- Logs that an admin group should read but other users shouldn't.

## Avoid it for

- When the reading service isn't in the group — it will get 'Permission denied'.
- When only the owner needs it at all: use `600`.

## FAQ

### 640 vs 644?

With 644 every user on the system can read the file; with 640 only the owner and the group can.

## Related modes

- [chmod 644](https://www.devkult.com/chmod/644.md): Owner can read and write; everyone else can read
- [chmod 600](https://www.devkult.com/chmod/600.md): Only the owner can read and write
- [chmod 660](https://www.devkult.com/chmod/660.md): Owner and group can read and write; others have no access
- [chmod 750](https://www.devkult.com/chmod/750.md): Owner can do everything; group can read and execute; others have no access

Open the interactive page: https://www.devkult.com/chmod/640