4

When we are creating a new connection with pgAdmin, we are presented with an option to save the password into our computer, so we won't have to retype it every time we want to connect with the database.

I can't find in any document how this password is stored. Is it encrypted? Saved under Windows protection? Plain text?

Does anyone knows the security implications of saving a database password in pgAdmin?

Improve this question

2 Answers 2

Reset to default
7

In pgAdmin 4.x the password file location can be specified in GUI whereas pgAdmin III has a fixed path. Both documentations refers to the PostgreSQL libpq (C Library) documentation for The Password File:

The file .pgpass in a user's home directory can contain passwords to be used if the connection requires a password (and no password has been specified otherwise). On Microsoft Windows the file is named %APPDATA%\postgresql\pgpass.conf. Alternatively, a password file can be specified using the connection parameter passfile or the environment variable PGPASSFILE.

This file should contain lines of the following format:

hostname:port:database:username:password

TL;DR: It's unencrypted in a file.

Improve this answer
3
  • 1
    In general, if a program can read it, then anything with the same privileges can read it, even if it's encrypted. For example AACS was based on false assumption that an encryption key could stay secret while it has to be used on every device.
    – Esa Jokinen
    Commented Apr 15, 2019 at 4:48
  • 1
    Well, I am no expert on it, but I think windows and other OS have mechanisms to store secrets for programs. So only that program (and admin accounts) will have access to those secrets. So I was kinda counting on it
    – mFeinstein
    Commented Apr 15, 2019 at 4:58
  • 3
    I think it's in a DB for PgAdmin 4: dba.stackexchange.com/a/193093/16892
    – rogerdpack
    Commented Aug 22, 2019 at 19:53
4

The pgAdmin maintainers adopted a suggestion of mine and now the stored passwords have a master password to encrypt them.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .