chmod 600 (rw-------)

When to use 600

SSH private keys. Files like ~/.ssh/id_rsa, id_ed25519, and id_ecdsa must be readable and writable only by the owner. OpenSSH actively refuses to use a private key with looser permissions, so 600 (rw-------) is the canonical mode for every private key on disk.
Config files holding secrets. Anything embedding a password, API token, or database DSN — ~/.netrc, ~/.pgpass, .env files, ~/.aws/credentials — belongs at 600 so no other account on the box can read the credential.
Per-user private state. Shell history (~/.bash_history), browser/session token caches, and password-manager databases hold sensitive data; 600 keeps them owner-only on shared or multi-user systems.
Files written by a daemon that must stay private. A service that writes a token cache or socket-auth file (e.g. an MQTT or VPN credential) sets 600 so only the service account can read it back.

Common mistakes & gotchas

600 has no execute bit, so it cannot apply to directories you need to enter. A directory at 600 (rw-------) cannot be cd'd into even by its owner because traversal needs x. Private directories want 700, not 600.
Root can still read it. 600 protects against other unprivileged users, not against root or anyone who can sudo. On a shared host with admins you don't control, treat 600 as defense-in-depth, not encryption.
Ownership matters as much as the mode. 600 is only meaningful if the file is owned by the right user. A secret at 600 owned by the wrong account (e.g. left as root after a careless cp) locks out the service that needs it or exposes it to the wrong owner.
SSH silently ignores keys that are too open. If you ever see "Permissions 0644 for 'id_rsa' are too open", the fix is chmod 600 id_rsa — SSH demands 600 (or 400) and refuses the key otherwise.

600 vs the alternatives

400 (r--------) drops the owner's write bit too — read-only and private. Use 400 for a key or secret you want to protect from accidental modification; use 600 when the owner still needs to edit or rotate the file in place.
700 (rwx------) adds execute for the owner. Use 700 for a private directory (like ~/.ssh) or a private script you run; 600 is for private data files that are never executed or traversed.
640 (rw-r-----) lets a trusted group read the file. Use 640 when a service group (e.g. www-data) must read a config; keep 600 when not even the group should see the secret.

Set it with chmod

Apply this permission to a single file:

chmod 600 filename

Or apply it recursively to a directory and everything inside it:

chmod -R 600 directory/

The same thing in symbolic form:

chmod u=rw,g=,o= filename

Frequently asked questions

What does chmod 600 mean?

chmod 600 sets rw------- : the owner can read and write the file, and group and others get nothing — no read, no write, no execute. It is the standard mode for private files like SSH keys and credential configs.

Why does SSH require 600 on my private key?

OpenSSH treats a private key readable by anyone but you as compromised and refuses to use it, printing "Permissions are too open." Running chmod 600 on the key file restores owner-only access and lets SSH load it.

Should I use 600 or 400 for a secret?

Use 600 if you still need to edit or rotate the file in place; use 400 (read-only) if the file should never change, which also guards against accidental overwrites. Both keep group and others fully locked out.

Can I chmod 600 a directory?

You can, but you shouldn't — a directory needs the execute bit to be entered or listed by name, and 600 has none. For a private directory like ~/.ssh use 700 (rwx------) instead.

Other common permissions

Or build any permission with the interactive chmod calculator.

chmod 600 — what rw------- means

Permission breakdown