What permissions should an SSH private key have?

Use chmod 600 for an SSH private key. This lets only the file owner read and write the key and removes access for group members and other users.

Why does SSH say permissions 0644 for id_rsa are too open?

Mode 0644 allows other local users to read the private key. OpenSSH treats that as a possible key disclosure and refuses to use the file.

Can an SSH public key use chmod 644?

Yes. A .pub file contains the public half of the key pair and is intended to be shared, so chmod 644 is normally appropriate.

What permissions should the ~/.ssh directory have?

Use chmod 700 ~/.ssh so only the owner can list, change, or enter the directory. Files inside it still need their own correct modes.

chmod calculator

Fix: SSH Key Permissions Are Too Open

Seeing ssh key permissions too open or a “WARNING: UNPROTECTED PRIVATE KEY FILE” message? Choose the file below, copy the command, and retry SSH.

The error you are fixing

“0644 for id_rsa are too open”

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '~/.ssh/id_rsa' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "~/.ssh/id_rsa": bad permissions

Choose the file that failed

Get the correct SSH permission command

File or directory type

Recommended mode600

chmod 600 ~/.ssh/id_rsa

Use the actual private-key filename if it is not id_rsa. Never apply this command to the matching .pub file.

Owner: read, write.
Group: no permissions.
Others: no permissions.

Why SSH refuses a private key with open permissions

A private key proves your identity to a remote server. If any other local account can read it, that account can copy the key and potentially authenticate as you.

OpenSSH checks the file before authentication and ignores keys that are readable by group members or everyone else. Changing the private key to 600 gives read and write access only to its owner.

This check protects the private key, not the public `.pub` file. Public keys can normally use 644 because sharing them does not reveal the secret half of the pair.

OpenSSH for Windows: use icacls instead

Windows OpenSSH usually stores keys in %USERPROFILE%\.ssh. NTFS access rules replace Unix chmod bits, so remove inherited access and grant your account read permission.

icacls "$env:USERPROFILE\.ssh\id_rsa" /inheritance:r
icacls "$env:USERPROFILE\.ssh\id_rsa" /grant:r "$env:USERNAME:(R)"

Run these commands in PowerShell and replace id_rsa when your private key has another name.

Still seeing the error?

Check the directory, owner, and loaded key

Lock down the parent directory

OpenSSH can reject a key when its .ssh directory is writable by other users.

chmod 700 ~/.ssh

Restore the file owner

A correctly restricted file can still fail when it belongs to the wrong account.

chown "$USER":"$(id -gn)" ~/.ssh/id_rsa

Run SSH in verbose mode

Verbose output shows which key file SSH loads and the exact check that fails.

ssh -v user@example.com

Quick answers

SSH key permissions FAQ

What permissions should an SSH private key have?: Use chmod 600 for an SSH private key. This lets only the file owner read and write the key and removes access for group members and other users.
Why does SSH say permissions 0644 for id_rsa are too open?: Mode 0644 allows other local users to read the private key. OpenSSH treats that as a possible key disclosure and refuses to use the file.
Can an SSH public key use chmod 644?: Yes. A .pub file contains the public half of the key pair and is intended to be shared, so chmod 644 is normally appropriate.
What permissions should the ~/.ssh directory have?: Use chmod 700 ~/.ssh so only the owner can list, change, or enter the directory. Files inside it still need their own correct modes.

Need to compare another mode? Use the chmod calculator to convert any octal or symbolic permission. Using a key downloaded from AWS? Follow the PEM file permissions guide for EC2-specific steps.