chmod 644: the default mode for regular files

What chmod 644 means

In 644 the first digit is the owner, the second the group and the third everyone else: the owner gets read and write, the group gets read only, and others get read only.

ls -l shows -rw-r--r--. The 6 is read plus write and each 4 is read alone. New files come out as 644 under the common 022 umask, so it is the mode you will see on most documents, source files, images and configuration.

Typical 644 files

/etc/passwd, /etc/hosts and most of /etc are 644, owned by root: every program can read them, only root can change them. Static web content — HTML, CSS, JavaScript, images, and PHP source — is conventionally 644, paired with 755 directories, so the server can read but not rewrite the site.

Public SSH keys (id_ed25519.pub) can be 644; only the private half needs to be locked down.

Pitfalls

644 is world-readable. An .env file, a database password in config.php, or a private key at 644 can be read by every account on the host, and ssh refuses a private key with this mode outright. Use 600 for those, or 640 if a service group must read them.

A script at 644 cannot be run as ./script; add execute with chmod +x or set 755. And never use chmod -R 644 on a directory tree: directories lose execute and nobody, including the owner, can enter them. Use find dir -type f -exec chmod 644 {} + instead.

Related values

644 has close relatives for each audience. 640 hides the file from everyone outside the group, 600 from everyone but the owner. 664 lets the group edit as well as read. 444 removes the owner's write and makes the file read-only for all. For directories and executables the parallel mode is 755: the same shape, with execute added so the directory can be entered or the program run.