JustUtils
shield_lockLinux permissions 路 explained as you click

Chmod 600 Explained & Calculator

Learn why chmod 600 protects private keys and secret files, inspect every permission, and copy the correct command.

STEP 1

What are you changing?

Execute means different things for a file and a directory.

For a file: Read opens the contents, Write changes them, and Execute runs the file as a program.

STEP 2

Choose access

Owner permissions

Owner

digit 1 路 6

rw-

Usually you or the account that created it.

Group permissions

Group

digit 2 路 0

---

Accounts collected in the file's owning group.

Everyone else permissions

Everyone else

digit 3 路 0

---

Any other account on the same system.

YOUR RESULT

600rw-------

u=rw,g=,o=

Owner

Can read, edit

Group

Can no access

Everyone else

Can no access

THE PART MOST CALCULATORS SKIP

See what will actually change

Find the numeric mode with stat -c '%a' path on Linux, then review each permission being added or removed.

644arrow_forward600
removeGroup: readremoveEveryone else: read

TOP 5 EVERYDAY MODES

Start from the job, not the digits

Each common mode has its own explainer page and loads directly into this calculator. Pick the situation that sounds like yours, then check the access before copying.

folder_open755

Public directory or script

You control it; everyone else can open or run it.

description644

Regular file

You can edit it; everyone else can read it.

key600

Private or secret file

Only you can read or edit it.

lock700

Private directory or script

Only you can open, change, or run it.

group775

Team directory

You and your group can edit; everyone else can browse.

CHMOD IN ONE MINUTE

What is chmod?

Every Linux file carries a tiny access list. chmod is the command that rewrites that list. It does not move the file, change its contents, or choose its owner鈥攊t only changes what the owner, group, and everyone else are allowed to do.

Think of the three digits as three keycards. The first card belongs to the owner, the second to the group, and the third to everyone else. Each card gets points for Read (4), Write (2), and Execute (1). Add the allowed actions to get that card's digit.

The only math you need

4Read+2Write+1Execute=7all three
Why 777 is not a universal fix: it hands every keycard every permission. Fix ownership or choose the smallest access that solves the real need instead.

DIGIT 1 路 u

Owner

Usually you or the account that created it.

DIGIT 2 路 g

Group

Accounts collected in the file's owning group.

DIGIT 3 路 o

Everyone else

Any other account on the same system.

Chmod 600 in practice

How to decide whether 600 fits your file

Mode 600 allows only the owner to read and write the file. The group and everyone else receive no permissions. This narrow access is appropriate for secrets that a single local account must use or update.

Owner
6 = read + write
The owning account can read and replace the secret but cannot execute it as a program.
Group
0 = no access
Owning-group membership alone does not allow the file to be opened.
Everyone else
0 = no access
Other local accounts receive no read, write, or execute permission.

A practical example

An SSH private key in the owner's home directory

SSH clients expect a private key to be protected from other local users. Setting the file to 600 lets its owner use and update the key while removing group and public access. Ownership still matters: the correct login account must own the file.

Before saving the change

  • Confirm the path points to the private key, not the matching .pub public key.
  • Use ls -l to verify that the account running SSH owns the file.
  • Protect the parent .ssh directory as well, commonly with mode 700.

Common mistake to avoid

Changing the mode cannot undo a secret that was already copied, logged, committed, or exposed. Rotate compromised credentials even after repairing their file permissions.

When to choose something else

Choose 400 for an immutable secret that the owner should not edit in place. Use a dedicated secret manager when multiple services, audit requirements, or automatic rotation are involved.