10 Essential Chmod Permission Sets

The Permission Sets You'll Actually Use

You could memorize every chmod value from 000 to 777, but in practice, about ten permission sets cover nearly every real-world scenario. Understanding why each exists — not just what it does — helps you choose correctly instead of guessing.

Quick Reference

Detailed Breakdown

644 — The Default File

Owner:  rw-  (read + write)
Group:  r--  (read only)
Other:  r--  (read only)

This is the most common file permission on Linux systems. The owner can edit; everyone else can read. Web servers use 644 for CSS, JavaScript, images, and HTML files because the server process only needs to read them.

chmod 644 index.html style.css app.js

755 — The Default Directory

Owner:  rwx  (full access)
Group:  r-x  (read + traverse)
Other:  r-x  (read + traverse)

Directories need execute permission to be traversed — without x, you can't cd into them or access files inside, even with read permission. 755 is the standard for directories and executable scripts.

chmod 755 /var/www/html
chmod 755 deploy.sh migrate.py

600 — Private Files

Owner:  rw-  (read + write)
Group:  ---  (no access)
Other:  ---  (no access)

Use 600 for any file that should be invisible to everyone except the owner. The most critical use case is SSH private keys — if your key is readable by anyone else, SSH will refuse to use it.

chmod 600 ~/.ssh/id_rsa
chmod 600 ~/.env
chmod 600 ~/.my.cnf

700 — Private Directories

Owner:  rwx  (full access)
Group:  ---  (no access)
Other:  ---  (no access)

The directory equivalent of 600. Use this for home directories and any directory containing private files.

chmod 700 ~/.ssh
chmod 700 ~/private-projects

640 — Group-Readable Configs

Owner:  rw-  (read + write)
Group:  r--  (read only)
Other:  ---  (no access)

When a service needs to read a config file but the world shouldn't see it. The web server user (e.g., www-data) is in a group that can read the file, while other users on the system are locked out.

chmod 640 /etc/nginx/ssl/ssl-cert.pem
chmod 640 /var/www/.env

750 — Group-Shared Directories

Owner:  rwx  (full access)
Group:  r-x  (read + traverse)
Other:  ---  (no access)

For directories that a specific group needs to access but shouldn't be world-readable. Common in multi-user server environments where departments share resources.

664 and 775 — Collaborative Work

664: rw-rw-r--  (files)
775: rwxrwxr-x (directories)

When a team collaborates on files, both the owner and group need write access. The "other" group gets read-only or read+execute (for directories). Often paired with SGID on directories so new files inherit the group.

chmod 2775 /var/www/shared
find /var/www/shared -type f -exec chmod 664 {} +

400 — Read-Only Sensitive

Owner:  r--  (read only)
Group:  ---  (no access)
Other:  ---  (no access)

Even more restrictive than 600 — the owner can read but not modify. Useful for backed-up credentials that shouldn't be accidentally changed.

chmod 400 ~/.ssh/id_rsa.pub
chmod 400 /backup/credentials.gpg

444 — Immutable Public

Owner:  r--  (read only)
Group:  r--  (read only)
Other:  r--  (read only)

Everyone can read, nobody can write. Use for published logs or documentation that must not be altered after creation. Combine with chattr +i for true immutability.

Server Scenario Quick Reference

Related Guides

• Chmod Guide
• Linux File Permissions
• Setting Recursive Chmod Permissions

Try It Yourself

See what each permission set allows at a glance. Toggle read, write, and execute for owner, group, and others — our tool converts between numeric, symbolic, and binary forms instantly.

👉 Free Chmod Calculator