chmod 644 (rw-r--r--)

The owner can read and write; the group and others can only read. Nobody can execute it.

When to use 644

Plain files in a web document root. HTML, CSS, JS, images and PDFs that the web server user (often www-data) must read and serve but never modify. 644 files paired with 755 directories is the canonical web layout — the default for almost every static asset you publish.
Config and data files that aren't secret. A .conf, .json or .yml the owner edits and any process reads — as long as it holds no passwords or keys. 644 says "world-readable, owner-writable," which is exactly right for non-sensitive config.
Documents, logs and source files in a shared box. Anything you want teammates and tools to read without the risk of them overwriting it. Owner keeps the pen; everyone else gets read-only.
The default for newly created files on most systems (umask 022). If you never touch a file's mode, 644 is usually what it already is — which is why it's the baseline every other plain-file mode is measured against.

Common mistakes & gotchas

644 has no execute bit, so a script won't run. ./deploy.sh at 644 gives "Permission denied" even though you can read it. Scripts and binaries need an x — use 755 (or 700 if private). 644 is for files that are read, not run.
Never apply 644 to a directory. A directory without the execute (x) bit can't be entered or traversed — cd fails and the files inside become unreachable. Directories need 755; only plain files take 644.
644 lets everyone on the system read the file. Fine for public assets, dangerous for secrets. A .env, private key or DB password at 644 is readable by every local user and often by other web apps on shared hosting. Those belong at 600 or 640.
chmod -R 644 on a tree breaks every directory in it. The recursive flag hits directories too, stripping their x bit and locking you out of the subtree. Use find . -type f -exec chmod 644 {} + to touch files only, or chmod -R a+rX,u+w (capital X spares directories).

644 vs the alternatives

755 (rwxr-xr-x) adds the execute bit for everyone — use it for directories and for files that must run (scripts, binaries). The rule of thumb: directories and programs get 755, plain readable files get 644. The execute bit is the only difference.
664 (rw-rw-r--) adds group write — pick it when a team (sharing a group) needs to edit the same file, not just the single owner. Stay at 644 when only the owner should ever write.
640 (rw-r-----) removes read for others — use it when the group may read the file but outsiders must not. Choose 640 over 644 the moment the file stops being safe for the whole world to read (semi-sensitive config, group-internal data).

Set it with chmod

Apply this permission to a single file:

chmod 644 filename

Or apply it recursively to a directory and everything inside it:

chmod -R 644 directory/

The same thing in symbolic form:

chmod u=rw,g=r,o=r filename

Frequently asked questions

What does chmod 644 mean?

chmod 644 sets permissions to rw-r--r--: the owner can read and write; the group and others can read only. No one but the owner can modify the file, and no one can execute it.

Why won't my script run at 644?

644 has no execute (x) bit, so the shell refuses to run it. Add execute with chmod 755 (or chmod +x) so it becomes rwxr-xr-x. 644 is for files you read, not files you run.

Should I use 644 or 755?

Use 644 for plain files that only need to be read (HTML, images, configs). Use 755 for directories and for files that must execute (scripts, binaries). The difference is the execute bit.

Is 644 safe for a config file with passwords?

No. 644 is world-readable, so every user on the machine can read it. Secrets belong at 600 (owner-only) or 640 (owner plus a trusted group). Reserve 644 for non-sensitive files.

Other common permissions

Or build any permission with the interactive chmod calculator.

chmod 644 — what rw-r--r-- means

Permission breakdown