--- title: "Permissions 0644 are too open"? Fix it with the Chmod Calculator description: SSH refuses your key with "UNPROTECTED PRIVATE KEY FILE! Permissions 0644 are too open". The fix is chmod 600: read and write for you, nothing for anyone else. Here's how to work out any chmod value with the free Chmod Calculator, what each digit means, which modes SSH accepts, and the commands to check and fix permissions. canonical: https://watchfor.io/blog/how-to-calculate-chmod-permissions --- # "Permissions 0644 are too open"? Fix it with the Chmod Calculator 2026-10-04 · WatchFor Team · Guides · guides, ssh, servers SSH refuses your key with "UNPROTECTED PRIVATE KEY FILE! Permissions 0644 are too open". The fix is chmod 600: read and write for you, nothing for anyone else. Here's how to work out any chmod value with the free Chmod Calculator, what each digit means, which modes SSH accepts, and the commands to check and fix permissions. To fix "Permissions 0644 are too open" for an SSH private key, run `chmod 600` on the key file. 600 means read and write for the owner and no access at all for the group or anyone else, which is what OpenSSH demands before it will use a private key. Any mode that gives the group or others even read access gets the key ignored. The free [Chmod Calculator](/chmod-calculator) turns permissions into the octal number, the `rwx` notation and a ready `chmod` command, in either direction: tick the boxes or type `755` and see what it grants. ## What this tool answers *What does this chmod number mean, and which number gives exactly the access I want?* Reach for it when a tool complains that permissions are too open or too strict, when a script says `Permission denied`, when a guide tells you to `chmod 2775` and you'd like to know what you're agreeing to, or when you're reading `-rw-r-----` in `ls -l` output and need the number. ## A real example ### Calculating the chmod permissions SSH wants for a private key The usual way into this problem: a key copied from another machine, a USB stick, a zip file or a repository arrives with the permissions of an ordinary file. We reproduced it with a fresh key on OpenSSH 10.2: ```bash ssh-keygen -q -t ed25519 -N '' -f id_ed25519 chmod 644 id_ed25519 ssh-keygen -y -f id_ed25519 ``` ```text @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Permissions 0644 for 'id_ed25519' are too open. It is required that your private key files are NOT accessible by others. This private key will be ignored. Load key "id_ed25519": bad permissions ``` `ssh` prints the same block when it tries the key during a login, then falls back to other keys or a password. In the [Chmod Calculator](/chmod-calculator), typing `644` shows what's wrong: owner `6` (read 4 + write 2), group `4` (read), others `4` (read), so `rw-r--r--`. Anyone with a shell on the machine can read the key. We typed `600` instead: ![The Chmod Calculator with 600 typed into the Octal field: only Owner Read and Write are ticked, the digits read 6, 0, 0, the result panel shows octal 600 and symbolic rw-------, and the copy button reads chmod 600 filename](/blog/how-to-calculate-chmod-permissions-600.webp) Only **Owner → Read** and **Owner → Write** are ticked, the digit column reads 6, 0, 0, and the result is **600 / `rw-------`** with the command `chmod 600 filename`. After `chmod 600 id_ed25519` the same `ssh-keygen -y` printed the public key and exited 0. **The answer:** `chmod 600 ~/.ssh/id_ed25519`. We also tried the neighbours: **640 and 604 were rejected** like 644, while **600, 400 and 700 were accepted**. The rule is simply "no bits for group or others"; the owner's digit doesn't matter to SSH as long as you can read the file. ## How to read the results | What you see | What it means | | --- | --- | | **Owner / Group / Others rows** | The three classes a Unix mode covers: the file's owner, members of the file's group, everyone else. | | **Read (4) / Write (2) / Execute (1)** | Each permission is worth a number. A class's digit is the sum of what it has: 7 = all three, 6 = read + write, 5 = read + execute, 4 = read only, 0 = nothing. | | **Digit column** | That row's sum. The three digits in order (owner, group, others) are the octal mode. | | **setuid / setgid / sticky** | Special bits that add a leading fourth digit: setuid 4, setgid 2, sticky 1. 2775 is 775 plus setgid. | | **Octal field** | Type 3 or 4 digits (0–7) to set everything at once; the boxes follow. | | **Symbolic** | The same mode as `ls -l` prints it, without the leading file-type character. An `s` or `t` in an execute slot means a special bit with execute; a capital `S` or `T` means the special bit without execute. | | **chmod command** | Click to copy. Replace `filename` with your path. | | **Amber "World-writable" warning** | Others have write permission: any account on the machine can change the file. | | **Preset chips** | Common modes: 755, 644, 700, 600, 750, 640, and 777 outlined in amber. | ## More ways to use it - **A script says `Permission denied`.** It needs execute: 755 (everyone may run it) or 750 (owner and group). `chmod u+x script.sh` adds it for you alone without touching the rest. - **Web root after a deploy.** Directories 755, files 644 is the usual combination; the web server reads, only the owner writes. - **A shared project folder.** 2775 on a directory: the group can create files, and setgid makes new files inherit the directory's group instead of each user's own. - **A drop folder like `/tmp`.** 1777: everyone can write, but the sticky bit stops people deleting each other's files. - **Decoding someone else's instruction.** Before running `chmod 4755`, type it in: setuid means the program runs with its owner's privileges. ## Tips and gotchas - **The rest of `~/.ssh` matters too.** OpenSSH's manual recommends `~/.ssh` be accessible only by you (700), `authorized_keys` read/write for you only (600), and `~/.ssh/config` not writable by others. On the server, sshd's `StrictModes` (on by default) refuses key logins when the home directory or `~/.ssh` is writable by others. - **Execute means something else on directories.** Read lists names, execute lets you enter and open files inside, write lets you create and delete entries. A directory at 644 can't be entered, which is why directories get 755 or 700. - **`chmod -R 644` breaks directories.** It strips execute from every directory. Use `chmod -R u=rwX,go=rX dir`: the capital `X` adds execute only to directories and to files that already had it. - **777 is never the fix.** It makes the file writable by every account and process on the box. "Permission denied" almost always means the wrong owner or group: check with `ls -l` and `id`, then `chown` or add the user to the group. - **Some filesystems ignore chmod.** FAT and exFAT USB sticks and Windows drives mounted in WSL (`/mnt/c`, unless mounted with the `metadata` option) don't store Unix modes, so the change doesn't stick. Keep keys in your Linux home directory. - **New files start from your umask.** With umask `022` a new file is 644 and a directory 755; on Ubuntu desktops the default `0002` gives 664 and 775. `ssh-keygen` writes private keys as 600 on its own, so a 644 key was almost always copied, not generated. ## Check it from the command line too `stat` prints the octal and symbolic forms side by side, the same pair the calculator shows: ```bash stat -c '%a %A %n' .ssh/id_ed25519 chmod 600 .ssh/id_ed25519 stat -c '%a %A %n' .ssh/id_ed25519 ``` ```text 644 -rw-r--r-- .ssh/id_ed25519 600 -rw------- .ssh/id_ed25519 ``` On macOS the equivalent is `stat -f '%Lp %Sp %N' file`. The symbolic form sets the same thing without arithmetic, and is safer when you only want to change one class: ```bash chmod u=rw,go= .ssh/id_ed25519 # same as 600 chmod 700 .ssh stat -c '%a %A %n' .ssh ``` ```text 700 drwx------ .ssh ``` `namei -l ~/.ssh/id_ed25519` lists the mode and owner of every directory on the way to the file, which is the quickest way to find the one group-writable home directory that makes sshd's `StrictModes` refuse a login. For everything else about keys and agents, [SSH explained](/blog/ssh-explained) covers the handshake, and [advanced SSH tunnels and jump hosts](/blog/advanced-ssh-tunnels-jump-hosts) picks up from there. ## FAQ **What does chmod 600 mean?** The owner can read and write the file; the group and everyone else get nothing. It's the standard mode for private keys, password files and anything holding credentials. **What's the difference between chmod 644 and 755?** Both let the owner write and everyone read. 755 adds execute for all three classes, so use it for scripts, programs and directories, and 644 for ordinary files such as HTML, images and configs. **Why does SSH say my private key permissions are too open?** Because the key file grants some access to the group or to others. OpenSSH ignores such keys on purpose. Run `chmod 600` on the key (and `chmod 700` on `~/.ssh`) and try again. --- Canonical page: https://watchfor.io/blog/how-to-calculate-chmod-permissions · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt