chmod 600: Owner Only Read and Write for Keys and Secrets

600 is the secret file mode. An SSH private key, an API token file, a database password file, an environment file used by one account: all of them want the owner to read and write and nobody else to have any access. Combined with a 700 directory it produces a path no other unprivileged account can reach at any step.

Several tools enforce it rather than merely recommending it. The SSH client refuses to load a private key whose mode allows group or other access and prints an explicit warning about an unprotected key file. PostgreSQL ignores a .pgpass file that is group or world accessible. The curl configuration in .netrc is treated the same way by some tools. In each case the symptom is a login failure rather than a permissions error.

The distinction from 640 is one question: does another account have to read this. If a service running under a different user must read the file, use 640 and set the group correctly. If not, 600 is strictly better, because it removes an entire class of accounts from the picture rather than trusting group membership to stay correct.

On a directory, 600 is a trap. Without the execute bit even the owner cannot traverse into it, so the read bit lets you list the names while every attempt to stat or open an entry fails. A private directory is 700, and the missing digit is exactly the traverse permission.

Note what 600 does not do. It is not encryption: root reads the file regardless, a backup copies it in the clear, and anything running as your own user reads it freely, which includes any program you install. For a secret that must survive a stolen disk or a compromised account, encrypt it rather than relying on a mode.