chmod 400 (r--------)

Q: How do I update a file that is set to 400?

Restore write first with chmod u+w file (or chmod 600 file ), make your change, then set it back with chmod 400 file . The owner can always change the mode even though write is off.

The owner can read only; nobody can write or execute, and group and others get nothing.

When to use 400

SSH private keys and other owner-only secrets. 400 (r--------) gives the owner read and no one else anything. OpenSSH refuses to use a private key that group or others can read, so ~/.ssh/id_ed25519 at 400 (or 600) is the canonical setting. Same logic for GPG keys and any credential a single user must read but never share.
Read-only secrets the owning process must not rewrite. A credential or token file an application reads at startup but should never overwrite — 400 lets the process read it while a stray write (a bug, a bad deploy) fails immediately instead of corrupting the secret.
Locked-down certificates and key material. TLS private keys and cloud service-account JSON files set to 400 keep the secret readable only by the owning service user and frozen against modification, satisfying tools that audit for over-permissive key files.
Per-user private config that should be tamper-resistant. A personal .netrc, API-token file, or licence key where you want exactly one reader and no writers, including yourself, until you deliberately unlock it.

Common mistakes & gotchas

400 removes write for the owner too. To rotate or edit the secret you must first chmod u+w (or 600), update it, then restore 400. Many "permission denied" surprises when updating a key come from forgetting it is currently read-only even to you.
The file's group and owner are what make 400 meaningful. 400 grants the read to the owner — if the file is owned by the wrong user (e.g. root instead of the service account that needs it), the intended reader gets nothing. Check ls -l ownership, not just the mode.
root and the directory still bypass it. 400 stops other unprivileged users from reading the secret, but root reads anything, and anyone with write on the parent directory can delete or replace the file. 400 protects confidentiality of the contents from peers, not from a privileged actor or directory-level tampering.
An executable can't run at 400. There is no execute bit, so a script or binary set to 400 is readable but not runnable. If the owner needs to both read the contents and execute it privately, use 500 instead.

400 vs the alternatives

600 (rw-------) is 400 plus owner write — the more common default for private files you still edit, like ~/.ssh/config or a password store. Use 400 specifically when you also want to freeze the secret against accidental owner writes; use 600 for secrets you actively maintain.
440 (r--r-----) extends the read to the file's group while keeping others locked out. Choose 440 when a secret must be read by a service group (several daemons, a deploy team) rather than a single user; keep 400 when exactly one account should ever see it.
500 (r-x------) is 400 plus owner execute — for a private script or binary only the owner may both read and run. Use 500 for executables, 400 for plain secret data that should never be executed.

Set it with chmod

Apply this permission to a single file:

chmod 400 filename

Or apply it recursively to a directory and everything inside it:

chmod -R 400 directory/

The same thing in symbolic form:

chmod u=r,g=,o= filename

Frequently asked questions

What does chmod 400 mean?

chmod 400 sets permissions to r--------: only the owner can read the file, and no one can write or execute it. Group and others get no access at all. It is the standard for private, read-only secrets like SSH keys.

Why does SSH require my private key to be 400 or 600?

SSH refuses keys that are readable by group or others to prevent credential theft on shared systems. 400 (owner read-only) or 600 (owner read-write) limits access to you alone, satisfying SSH's permission check.

How do I update a file that is set to 400?

Restore write first with chmod u+w file (or chmod 600 file), make your change, then set it back with chmod 400 file. The owner can always change the mode even though write is off.

What is the difference between 400 and 600?

Both restrict access to the owner alone. 600 lets the owner read and write; 400 removes write, making the secret read-only even to its owner — useful when you want to prevent accidental modification of a key or credential.

Other common permissions

Or build any permission with the interactive chmod calculator.

chmod 400 — what r-------- means

Permission breakdown