chmod 600 vs 400
| Property | chmod 600 | chmod 400 |
|---|---|---|
| Octal | 600 |
400 |
| Symbolic | rw------- |
r-------- |
| Owner | read/write | read |
| Group | no access | no access |
| Others | no access | no access |
| Risk Level | Restrictive | Restrictive |
| Typical Use | SSH private keys (e.g., ~/.ssh/id_ed25519, ~/.ssh/id_rsa) | AWS EC2 SSH private key pairs (.pem files) |
Key Difference
- Owner: chmod 600 grants read/write (6), while chmod 400 grants read (4).
Which Should You Use?
Both chmod 600 and chmod 400 represent highly restrictive file permissions that completely isolate a file from group and world access. The sole distinction lies in whether the file owner retains write access. Mode 600 gives the owner read and write capabilities (rw-------), making it the standard recommendation for OpenSSH private keys (~/.ssh/id_ed25519), SSH authorized_keys files, and application .env files that may need periodic editing. In contrast, mode 400 makes the file read-only even for the owner (r--------). Mode 400 is strictly mandated by Amazon Web Services for EC2 private key pairs (.pem files) to guard against unintended edits, accidental file truncations, and key corruption. If you need to modify a 400 file, you must first grant write permission via "chmod u+w", make your changes, and return it to 400.
Frequently Asked Questions
Is 400 more secure than 600?
Both provide identical protection against other users on the system. Mode 400 provides additional protection against the owner accidentally deleting or modifying the file contents during routine terminal operations.
Can I convert 600 to 400?
Yes. You can remove owner write permission with "chmod u-w filename" or "chmod 400 filename". To make it editable again, run "chmod 600 filename".
Which is better for web servers?
Neither is suitable for public web assets, as web servers running under separate accounts cannot read them. However, for backend environment secrets and database password credentials owned by the web user, 600 is standard.
Related Permissions & Comparisons
Read in-depth breakdowns for chmod 600 (rw-------) and chmod 400 (r--------), or browse other permission comparisons: