Three or four octal digits. Try 022, 027, 077, 002.
Resulting permissions
Set it persistently
umask 022
umask Calculator
umask subtracts from a base, which is why 022 gives 644 for files and 755 for directories. Set a value and see exactly what new files will look like.
Why files never come out executable
Files start from 666 and directories from 777, not both from 777. The kernel deliberately never grants the execute bit to a newly created file, because a program that writes a file should not be able to make it runnable by accident. Directories need execute to be traversable at all, so they start higher. That asymmetry is the whole reason umask 022 produces 644 and 755 rather than one number. Note also that umask masks bits off, it cannot add them: no umask will make new files executable.
Calculate umask values and default permissions
This umask calculator shows what a given mask produces for new files and directories in both octal and rwx notation, and explains the subtraction from the 666 and 777 base values. It covers the common values, 022 for general use, 027 and 077 for servers, 002 for shared group directories, and gives the right place to set each one: a shell profile, /etc/login.defs, or UMask in a systemd unit.
umask FAQ
Why does my umask not apply to a systemd service?
systemd services do not run a login shell and never read .bashrc or /etc/profile. Set UMask= in the [Service] section of the unit instead. This catches people out constantly when files written by a service have the wrong permissions.
What is the fourth digit for?
The leading digit covers setuid, setgid, and the sticky bit. umask almost always deals with the last three, and a four-digit umask like 0022 is the same as 022. You cannot usefully mask setgid off a directory with umask; use chmod g-s.
Should I use 077 on a server?
It is a reasonable default for a single-admin machine, since new files are readable only by their owner. It breaks anything that expects group collaboration, and it will confuse web servers reading files created by another account, so 027 is often the better balance.
How do I change permissions on files that already exist?
umask only affects files created after it is set. Existing files need chmod, and the chmod and chown builder generates those commands, including the capital-X trick that sets execute on directories without making every file executable.