chmod 600 — Private Files: Configs, Secrets and Keys

This page opens the calculator preset to 600: the owner gets 6 (read + write) and both group and others get 0 — no access at all. The symbolic string is -rw-------: the file is fully private but still editable by its owner.

600 is the correct mode for anything containing secrets: .env files with database credentials, ~/.aws/credentials, mail files, TLS private keys that the owner needs to update, and SSH configuration like ~/.ssh/config or authorized_keys (OpenSSH also accepts 644 for authorized_keys, but 600 is the safe default). Many tools enforce it: for example, PostgreSQL refuses to read a .pgpass file unless it is 0600 or stricter.

The difference from 400 is the write bit: 600 lets you edit the file, 400 makes it read-only even for you. Toggle the owner-write checkbox on this page to flip between the two and copy the resulting chmod command directly into your terminal.