chmod 400-r--------
chmod 400 makes a file read-only for its owner and completely inaccessible to everyone else — not even the owner can write to it without changing the mode first.
Owner
You, the file's creator
Group
Everyone in the file's group
Public
Everyone else on the system
Special permissions(advanced, rarely needed)
Common presets
On a file, 400 lets the owner view its contents but not modify or delete it directly, and gives no access whatsoever to anyone else. It's the tightest permission you can set without involving root or ACLs.
400 on a directory blocks entry outright, since there's no execute bit for anyone, including the owner. If you want a directory that's locked down but still enterable by its owner, use 500 (owner read + execute only) instead.
When to use chmod 400
Use 400 on files you want to protect from accidental overwrites by their own owner — an archived private key you're keeping only for reference, a backup credential file, or an audit log you never want a script to open for writing by mistake.
Security notes
This mode guards against accidental modification (a stray shell redirect, an editor autosave, a script that assumes it can write) more than it does against a deliberate change — the owner can always chmod the file back to add write access. It doesn't replace correct ownership or encryption for genuinely sensitive material.