chmod 644: The Default File Mode and When to Change It

644 is the file mode you should reach for by default. HTML, CSS, images, JSON, Markdown, source files, most things under /etc: all of them want read and write for the owner and read for everyone else. It is what a 022 umask produces, which is why the overwhelming majority of regular files on a typical system already have it.

Its partner is 755 on directories. A web root of 755 directories and 644 files is the standard layout, and it is what most hardening guides prescribe for static content. Keeping the two apart matters: applying 644 to directories makes them unenterable, and applying 755 to files marks documents as programs.

The clear case for changing it is a secret. Every local account can read a 644 file, so an environment file, a private key, a token or a database dump wants 600 if only the owner needs it, or 640 if a service group must read it as well. This is the single most common real mistake, and it usually reaches production through a deploy that copies files without setting modes.

The other case is an executable. A script at 644 gives permission denied when you try to run it even though it is perfectly readable, because the execute bit is missing. That is what chmod +x fixes, taking the file to 755 under a normal umask, and it is why a freshly written script never runs on the first attempt.

The calculator lists 0644 as a preset next to 0755, which is the fastest way to see the pairing. Toggle the owner execute checkbox and watch the octal move from 644 to 744 and the ls -l rendering from -rw-r--r-- to -rwxr--r--, which is what chmod u+x does.