chmod 644
chmod 644 sets rw-r--r--: the owner can read and modify the file, the group and everyone else can only read it, and nobody can execute it.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | Yes | Yes | No | 6 |
| Group (g) | Yes | No | No | 4 |
| Others (o) | Yes | No | No | 4 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | Read and modify | List names only; write does nothing without execute |
| Group (g) | Read the contents | List names only; cannot enter or open entries |
| Others (o) | Read the contents | List names only; cannot enter or open entries |
Facts
| Octal | 644 (0644) |
|---|---|
| Symbolic | rw-r--r-- |
| ls -l, file | -rw-r--r-- |
| ls -l, directory | drw-r--r-- |
| Equivalent symbolic command | chmod u=rw,go=r |
| Default umask that creates it | umask 022 for new files |
| How Git records a file with it | 100644 (not executable) |
| Special bits | None |
When to use it
- Web content and ordinary files: the WordPress guide says all files should be 644 or 640, and .htaccess is normally 644.
- System files that must be world-readable but not writable, such as /etc/passwd and /etc/hosts.
- Public keys (id_ed25519.pub). It is also what new files get under the common umask 022.
When not to use it
- SSH private keys. ssh refuses them with WARNING: UNPROTECTED PRIVATE KEY FILE! and Permissions 0644 for ... are too open, then ignores the key. Use 600 or 400.
- Files with passwords or API keys on shared servers, such as wp-config.php or .env. WordPress recommends 440 or 400 for wp-config.php; 640 or 600 work for .env.
- Scripts and binaries you need to run: they need the execute bit, so use 755.
Commands
chmod 644 index.html
chmod u=rw,go=r index.html # same resultstat -c '%a %A %n' index.html # Linux (GNU stat): 644 -rw-r--r--
stat -f '%Lp %Sp %N' index.html # macOS and BSDApplying it to a whole tree
chmod -R would put the same mode on files and directories alike. Set directories to 755 and files to 644 separately:
find . -type d -exec chmod 755 {} +
find . -type f -exec chmod 644 {} +Or in one pass with a capital X, which adds execute only to directories and to files that already had it: chmod -R u=rwX,go=rX ..
Git and the execute bit
Git stores only one permission fact per file: 100755 if the owner execute bit is set, 100644 otherwise. A file with this mode is committed as 100644; the group and others bits never reach the repository. On Windows, or where core.fileMode is false, set the bit with git update-index --chmod=+x.
Frequently asked questions
- What does chmod 644 mean?
- Owner 6 (read 4 + write 2), group 4 (read), others 4 (read). In ls -l it appears as -rw-r--r--.
- Is 644 safe for a website?
- Yes for normal content: the web server can read it and no other account can change it. Files holding credentials should be tighter (640, 600, 440 or 400).
- Why does SSH say permissions 0644 are too open?
- OpenSSH ignores a private key that other accounts can read. Run chmod 600 on the key file (not the .pub) and try again.
- Why can I not cd into a directory after chmod -R 644?
- Directories need the execute bit to be entered. 644 removes it, so reset directories with find . -type d -exec chmod 755 {} +.
Last reviewed by Arielton Oberek.