Connect to PostgreSQL
Add a connection, choose PostgreSQL, and fill in the fields below. If you already have a connection string, paste it first: postgresql:// URLs and host=… dbname=… strings both fill the form.
Fields
- Name
- What the sidebar shows. Two connections may share a name; hovering shows the full details, so use folders and environments to keep them apart.
- Folder
- An optional group in the sidebar.
- Environment
- Local, Development, Integration, Staging or Production. Sets the colour that follows the connection through tabs and the status bar.
- Host, Port
- The server. Port defaults to 5432.
- Database, User, Password
- The database to open and the role to open it as. The password goes to the Keychain on macOS and to Windows' per-user protected storage on Windows.
- SSL mode
disablenever encrypts.preferencrypts when the server offers it.requirerefuses an unencrypted connection.verify-fullalso checks the server's certificate against the root certificate you choose.- SSL root cert
- The CA file for verify-full. Optional otherwise.
- Read-only connection
- When on, writes are refused for this connection. Recommended for anything called production.
Through an SSH tunnel
Turn on the tunnel
Switch on Connect through an SSH tunnel and enter the SSH host, its port (22 by default) and the SSH user.
Choose how to authenticate
Pick a private key file, with a passphrase if it has one, or a password. On macOS, keys already loaded in your ssh-agent are used when the agent is available.
Point the database fields at the far side
Host and port in the database section are resolved from the SSH host, so a database that listens on
localhost:5432on the server is entered exactly that way.Trust the host key once
The first connection shows the SSH host key. Accept it and it is remembered.
If it does not connect
| What you see | Likely cause | What to do |
|---|---|---|
| Connection refused or a timeout | Wrong host or port, a firewall, or a server that only listens locally. | Check listen_addresses and the port on the server, or use an SSH tunnel. |
| Password authentication failed | Wrong password, or a role that is not allowed from your address in pg_hba.conf. | Check the role and the server's authentication rules. |
| The server does not support SSL | The selected endpoint does not offer the TLS required by your connection settings. | Confirm the endpoint and enable SSL on the server before sending credentials over an untrusted network. |
| Certificate verify failed | The certificate chain, hostname or validity period cannot be verified. | Check the exact hostname, current CA file and certificate dates. Read the SSL mode guide. |
For a Supabase project, use the Supabase guide instead: its hosts depend on the connection mode, and the app has a preset for them.