chmodcalculator
755Quick Calc

chmod 400 Explained

r--------

chmod 400 sets a file to read-only exclusively for the file owner. Even the owner cannot write to, edit, or append to the file without deliberately updating permissions first. All other users and groups have zero access.

Interactive chmod 400 Calculator

Customize target AWS key pair or certificate
Ready-to-run Linux command
chmod 755 filename

Permission Checkbox Matrix

Click any permission to recalculate instantly
User / Owner (u)
File creator / owner
Total:7
Group (g)
Assigned user group
Total:5
Others / Public (o)
All other system users
Total:5
4thAdvanced / Special Permissions (SUID, SGID, Sticky Bit)
Dynamic Permission Translation
Owner:Read, Write, Execute (Full access)
Group:Read, Execute
Others:Read, Execute
File vs Directory Semantics

For Files: x allows binary or script execution.
For Directories: x is the search/traverse bit, required to cd into the directory and access inner files. Without directory execute, users cannot open subdirectories even with read rights!

Quick Permission PresetsClick to apply
Copied to clipboard

Bit Breakdown for 400

Owner (4)
4 + 0 + 0 = 4
r-- (Read Only)
Group (0)
0 + 0 + 0 = 0
--- (No Access)
Others (0)
0 + 0 + 0 = 0
--- (No Access)

Why AWS EC2 Requires chmod 400 on .pem Files

When you download a private key pair (.pem) from the AWS Management Console, official Amazon documentation instructs you to execute:

chmod 400 /path/to/my-key-pair.pem

AWS specifies 400 rather than 600 because private cryptographic keys are immutable once issued. You should never edit or append data to a private key. Setting it to read-only protects you from accidentally modifying or corrupting the key with an editor or redirection operator.

chmod 400 vs chmod 600

ModeSymbolicOwner Write Allowed?Best For
chmod 400r--------No (Read only)Immutable AWS .pem keys, SSL certificates
chmod 600rw-------Yes (Read & Write)Standard SSH keys (~/.ssh/id_rsa), .env configs
← chmod 600 for SSH keyschmod 644 for web assets →