DevToolsmith

Chmod 400

chmod 400 sets the permissions to r--------: it lets only the owner read. Here is exactly what that allows on files and directories, when to use it, and the commands to apply it.

Runs 100% in your browser — nothing is uploaded

ClassreadwriteexecuteValue
owner4
group0
others0
Common:
$ chmod 400 file.sh
$ chmod u=r,g=,o= file.sh
  • • The owner can read.
  • • The group can do nothing.
  • • Everyone else can do nothing.

What chmod 400 means

WhoDigitLettersOn a fileOn a directory
owner 4 r-- Can read Can list files
group 0 --- No access No access
others 0 --- No access No access

Each digit is the sum of read (4), write (2) and execute (1). In ls -l output it looks like this: 

$ ls -l
-r--------  1 alice  staff  1834 Oct 21 10:30 example.txt
  • The owner can read.
  • The group can do nothing.
  • Everyone else can do nothing.

When to use 400

  • AWS .pem key pairs
  • SSH private keys
  • Secrets that never change

AWS tells you to run chmod 400 key.pem before using a downloaded key pair. Without it, SSH refuses the key because it is readable by others. 400 is slightly stricter than 600: it also protects the file from being overwritten by mistake.

Is chmod 400 safe?

Yes. Nobody outside the owner can access it at all (except root).

Commands

# One file
chmod 400 file

# Same thing in symbolic form
chmod u=r,g=,o= file

# Every file under a tree (leaves directories alone)
find /path/to/dir -type f -exec chmod 400 {} +

# Check the result
stat -c '%a %A %n' file    # Linux
stat -f '%Lp %Sp %N' file  # macOS

Avoid chmod -R 400 on a whole tree: it gives files and directories the same mode. The find form above changes only files.

Compare with similar modes

ModeSymbolicDifference
700 rwx------ Gives the owner full access and everyone else nothing
600 rw------- Lets only the owner read and write
500 r-x------ Lets only the owner read and execute
000 --------- Gives nobody any access

Other chmod values

777 · 775 · 770 · 755 · 751 · 750 · 744 · 711 · 700 · 666 · 664 · 660 · 644 · 640 · 600 · 555 · 500 · 444 · 000 · 1777 · 2775 · 4755

Need a different combination? Use the Chmod Calculator.

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does chmod 400 mean?

chmod 400 sets the permissions to r--------. The owner can read. The group can do nothing. Everyone else can do nothing.

Is chmod 400 safe?

Yes. Nobody outside the owner can access it at all (except root).