diff --git a/pwd.sh b/pwd.sh
index cbdeae8..9d85103 100755
--- a/pwd.sh
+++ b/pwd.sh
@@ -7,6 +7,8 @@
 set -o pipefail
 set -o nounset
 
+umask 077
+
 safe=pwd.sh.safe
 public=pwd.sh.pub
 secret=pwd.sh.sec