chmod 640 (rw-r-----)

When to use 640

Semi-sensitive config the group may read but the world may not. A file with internal connection strings, non-critical tokens or app settings owned by you, readable by a service group (e.g. www-data or app), and invisible to every other user. 640 is the classic "owner edits, group reads, others see nothing" mode.
System and service config files. Many daemons ship config at 640 with group ownership set to the service — e.g. mail, database and web configs that the running process must read but ordinary users must not. It exposes the file to exactly one group and no further.
Log files a group needs to inspect. An app writes the log (owner), an ops or audit group reads it, and other accounts on the box are kept out. 640 grants read to the trusted group without making the log world-readable.
Shared read-only reference data. A lookup table or credential-adjacent file the owner maintains and a specific group consumes, where leaking it to all users would be a problem. Others get zero access by design.

Common mistakes & gotchas

The group bit only helps if the right group owns the file. 640 grants read to the file's group — if that group is the owner's personal login group, no one else can read it and the service breaks. Run chgrp www-data file (or the correct group) first; the mode is meaningless without matching group ownership.
640 is not fully private — the group can read. If a file must be owner-only (an SSH private key, a master credential), use 600 (rw-------). 640 deliberately opens read to one group, so don't reach for it when "trusted group" still means "too many people."
Others get nothing — including no traversal help. Even reading a 640 file requires the user to reach it through directories they can traverse. If outsiders shouldn't even know it exists, also lock down the containing directory (e.g. 750), not just the file.
Don't confuse 640 with 604. 640 gives the group read and others nothing; 604 (rw----r--) skips the group and gives others read — almost always a mistake. The middle digit is the group; the last is everyone else.

640 vs the alternatives

600 (rw-------) is the owner-only version — no one but the owner can even read. Step down from 640 to 600 for true secrets (private keys, master passwords) where the group should not see the contents either.
644 (rw-r--r--) is 640 plus world read. The jump from 640 to 644 is exactly the moment a file becomes safe for everyone to read; keep it at 640 while only a chosen group should see it.
660 (rw-rw----) adds write for the group on top of 640's read. Choose 660 when the group must edit the file too; stay at 640 when the group should read but only the owner should change it.

Set it with chmod

Apply this permission to a single file:

chmod 640 filename

Or apply it recursively to a directory and everything inside it:

chmod -R 640 directory/

The same thing in symbolic form:

chmod u=rw,g=r,o= filename

Frequently asked questions

What does chmod 640 mean?

chmod 640 sets permissions to rw-r-----: the owner can read and write, the group can read only, and others have no access at all. It is common for service config and logs that a trusted group must read but the world must not.

When should I use 640 instead of 644?

Use 640 when the file is semi-sensitive — a chosen group may read it but other users must not. Use 644 only when the file is safe for everyone to read. 640 removes all access for 'others.'

Is 640 secure enough for a private key?

No. 640 lets the whole group read the file. A private SSH key or master credential should be 600 (owner-only), so no other account — group member or not — can read it.

Why can the service still not read my 640 config?

Check the group ownership. 640 grants read to the file's group, so that group must be the service's group (e.g. www-data). If it's still your personal login group, run chgrp to fix it.

Other common permissions

Or build any permission with the interactive chmod calculator.

chmod 640 — what rw-r----- means

Permission breakdown