chmod 400 — Read-Only for the Owner: SSH Keys and PEM Files
Convert Linux file permissions between rwx checkboxes, octal numbers and symbolic notation with a ready chmod command.
Processed entirely in your browser — nothing you enter here is ever uploaded.
Result
About this tool
This page opens the calculator preset to 400: a single ticked checkbox — owner read. The octal digits are 4-0-0 and the symbolic notation is -r--------: the strictest practical mode a usable file can have.
400 is best known from SSH: if your private key is readable by anyone else, ssh aborts with 'WARNING: UNPROTECTED PRIVATE KEY FILE!' and refuses to use it. That is why AWS documentation tells you to run chmod 400 key-pair.pem before the first ssh -i connection, and why id_rsa/id_ed25519 must be 400 or 600. The read-only bit also protects the key from accidental overwrites by you or your scripts.
Choose 400 over 600 when the file should never change: downloaded .pem key pairs, certificate bundles, archived credentials. If you later need to edit or delete-protect semantics differ, add the write bit back with the owner-write checkbox and the command updates to chmod 600 instantly.
Example. Octal 755 checks into rwxr-xr-x and the command chmod 755.
Limit. Only a three-digit octal from 000 to 777 is accepted, so setuid, setgid and the sticky bit are not represented.