Connections, SSH and credentials

Saved connections

A connection has a name, an environment tag, a status color and a read-only preference. SQL file engines (SQLite, DuckDB) use a local path. Network engines use host, port, database and credentials. MongoDB exposes an authentication database; Redis uses a numeric database index.

• Connections can be created, edited, tested, saved, opened and deleted. Errors stay visible and actionable.
• Production connections start in No-Edit mode. The read-only preference cannot be bypassed from the UI.
• Choose a green, gray, blue, amber or red status color. The connection header displays that color and the connection name.
• Search appears automatically once you have more than five saved connections.

Credentials

Passwords are stored through the operating-system credential vault: macOS Keychain, Windows Credential Manager or Linux Secret Service. They are not returned to the interface, not stored in metadata and not kept in browser storage. Leaving the password blank when editing keeps the saved password.

TLS

Required encrypts the connection. Select Verify certificate & host for certificate verification. Custom CA and client certificates are not implemented yet.

SSH bastions

Network connections can go through a bastion server with host, port and username. Authentication supports password, encrypted private key with passphrase, or SSH agent. Aliases and IdentityFile entries are read from ~/.ssh/config.

• Host keys must match known_hosts or an explicitly verified fingerprint.
• Database TLS still checks the original server name through the tunnel.
• Tunnels and query sessions are closed when reconnecting or disconnecting.
• Local SQLite and DuckDB paths do not use SSH forwarding.

Encrypted archives (desktop only)

Connection management offers password-protected import and export with separate options for including database and SSH passwords, plus an import preview. Archives use the TablePlus RNCryptor v3 envelope and connection-record schema, with a QueryBench metadata extension for exact round trips. Encryption is PBKDF2-HMAC-SHA1 with 10,000 rounds, AES-256-CBC and HMAC-SHA256, so use a strong archive password.

Disconnect and reconnect

Disconnect returns to the Connections screen while staged edits and SQL drafts stay in memory. Reopening the connection resumes the workspace. Click a red disconnected header to retry.

Equivalent Ctrl bindings apply on Windows and Linux.