chmod 660 (rw-rw----)

When to use 660

Files a group reads and writes, with the world locked out. The collaborative mode for sensitive shared data: every member of the file's group can edit it, and no other account can even read it. Use it for team-editable files that must not leak — internal datasets, shared state, group-private config.
Sockets, lock files and runtime state shared by a service group. Where two or more processes running under the same group must both read and write a file (a Unix socket, a PID/lock file, a queue) while other users are kept entirely out. 660 is the standard mode for these IPC artifacts.
Shared credentials or secrets a small trusted group manages. A team that jointly maintains a sensitive file — rotating a shared token or editing a protected config — where everyone in the group needs write but outsiders get nothing. The world bits are zero precisely because the contents are sensitive.
Group-owned spool or upload data. A directory's files where group members deposit and revise content that must stay invisible to other accounts on the machine.

Common mistakes & gotchas

Every group member can overwrite the file. 660 grants write to the whole group, so trust is only as tight as the membership list. Check it with getent group before relying on 660 for anything sensitive — one stray member is one too many.
The group ownership has to be correct or 660 protects nothing useful. If the file's group is the owner's personal login group, no other account can read or write it and the sharing silently fails. Set the shared group with chgrp first — the permission bits depend on it.
660 has no execute bit and no directory access. A 660 file can't be run, and on a directory it would block entry entirely (directories need x). For the folders holding 660 files, use 770 (rwxrwx---) or 2770 with setgid.
Shared write means accidental clobbering. Unlike 640 (group reads only), 660 lets any member overwrite another's changes. For files where the group should read but only the owner should write, prefer 640 — reserve 660 for genuine multi-writer needs.

660 vs the alternatives

640 (rw-r-----) is 660 without group write — the group reads but only the owner edits. Drop from 660 to 640 when you want to prevent group members from overwriting each other, or when only the owner should ever change the file.
664 (rw-rw-r--) is 660 plus world read. The difference is the trailing bit: 664 lets the public read the shared file, 660 hides it completely. Use 660 the moment the shared data is sensitive.
600 (rw-------) is the single-owner version — no group access at all. Choose 600 when one person owns the secret; choose 660 when a trusted group must collaboratively read and write it.

Set it with chmod

Apply this permission to a single file:

chmod 660 filename

Or apply it recursively to a directory and everything inside it:

chmod -R 660 directory/

The same thing in symbolic form:

chmod u=rw,g=rw,o= filename

Frequently asked questions

What does chmod 660 mean?

chmod 660 sets permissions to rw-rw----: the owner and the group can both read and write, and others have no access at all. It is the standard mode for sensitive files that a trusted group edits together.

When should I use 660 instead of 664?

Use 660 when the shared file is sensitive and outsiders must not even read it. Use 664 when public read access is acceptable. The difference is whether 'others' get read or nothing.

Is 660 secure?

It hides the file from everyone outside the group, which is good — but every group member can read AND write it. It is only as secure as the group membership, so keep that group small and audited.

Why doesn't another user in my team get access with 660?

The file's group is probably wrong. 660 grants access to the file's group, so that must be your shared team group, not the owner's personal login group. Fix it with chgrp before relying on 660.

Other common permissions

Or build any permission with the interactive chmod calculator.

chmod 660 — what rw-rw---- means

Permission breakdown