chmod 640: owner writes, group reads, others see nothing

What chmod 640 means

In 640 the first digit is the owner, the second the group and the third everyone else: the owner gets read and write, the group gets read only, and others get no access at all.

ls -l shows -rw-r-----. Compared with 644 the final digit drops to 0, so the file stops being world-readable while the group keeps read access.

Where 640 is used

On Debian and Ubuntu, /etc/shadow is 640 owned by root:shadow: only root can change the password hashes, and only programs in the shadow group can read them. Many log files under /var/log follow the same pattern with the adm group, so administrators can read logs without root.

For applications, 640 is the standard way to give a service a secret without making it world-readable: the deploy user owns the file, the service's group reads it, for example chown deploy:www-data .env && chmod 640 .env.

Pitfalls

The group must be specific. A file at 640 in a broad group like users is readable by most of the machine. Also remember that the directory path must be traversable by the group — a 640 file inside a 700 directory is unreachable for the service no matter what its own mode says. 750 is the usual parent.

Some programs check modes themselves and reject group-readable secrets; SSH private keys and PostgreSQL's ~/.pgpass both want 600. Use 640 only where the consuming program accepts it.

Related values

640 is the middle of a three-step ladder for secrets: 644 is readable by every account, 640 by the owner and one group, 600 by the owner alone. Pick the narrowest the consuming program accepts. The directory mode that pairs with 640 files is 750; 700 would block the group, 755 would let others list file names even though they cannot read the files themselves.