What is the default PostgreSQL port?

5432. Managed services and local installations can use another port.

Does sslmode=require verify the server hostname?

No. Use verify-full with the required trust configuration when hostname verification is needed.

Can I connect without a password in the URL?

Yes. With password authentication, psql can prompt for it or libpq can read a protected password file. Other server authentication methods may not require a password.

PostgreSQL

Before you paste that PostgreSQL connection string

The quickest route to a database should not leave its password in your shell history.

Published October 20264 min read

Jump to the psql connection command

An African elephant standing in tall grass, facing the camera

Photo: African elephant (Loxodonta africana) 2, Charles J. Sharp, CC BY-SA 4.0, via Wikimedia Commons.

A colleague sends you a PostgreSQL URL. It has a host, a database name and, sometimes, a password tucked between punctuation. Copy, paste, connect. Later that same URL turns up in a shell history file or a support message.

You can make the connection without putting a password in the command. Start with the host, port, database and role supplied by the administrator. For a remote server, get its TLS instructions and certificate information too.

Connect to PostgreSQL with psql

Shell: replace the example connection details

psql "host=db.example.com port=5432 dbname=shop user=analyst sslmode=verify-full sslrootcert=/path/to/provider-ca.pem" -W

This example asks for the password interactively. verify-full checks the certificate chain and server hostname. Replace the CA path with the certificate file your provider supplies. If validation fails, check the hostname and trust configuration before changing the security settings.

For a local development server you control, a typical command is psql -h localhost -p 5432 -U analyst -d shop -W. The default port is 5432, but use the one your server actually listens on.

Check where you landed

Inside psql

\conninfo
SELECT current_database(), current_user;

Do this before making changes. A working connection only tells you that a server accepted you. It does not tell you that you selected the intended environment.

Where the password belongs

For repeated connections, libpq can read a password file. On Unix-like systems the default is ~/.pgpass, with entries in the form hostname:port:database:username:password. Restrict its permissions with chmod 600 ~/.pgpass. Windows uses %APPDATA%\postgresql\pgpass.conf. The file still contains a secret and needs protection.

PostgreSQL explicitly discourages PGPASSWORD because process environments may be visible to other users on some systems. For automated jobs, use your approved secret delivery mechanism or a protected password file. Keep real credentials out of repositories, shared screenshots and notebook output.

Encryption and identity are separate checks

sslmode=require requires encryption, but it is not a general replacement for verify-full hostname validation. Follow the provider's documented certificate setup. Do not fix a certificate error by disabling verification and then describe the connection as equally protected.

Read the connection error before changing settings

Message	First thing to check
Connection refused	Host, port, server listener and network path. A firewall can also reject a connection.
Connection timed out	Network reachability, firewall rules and whether the endpoint is available.
Database does not exist	The database name for this environment.
Password authentication failed	The supplied credentials and server authentication configuration. The message does not prove that the role exists.
No pg_hba.conf entry	Whether this source, role, database and connection type are allowed. Ask the administrator for the intended access path.
Certificate verification failed	The CA file, certificate validity and hostname.

If the password is already in a commit

Rotate or revoke it first. Removing the text from the latest file does not invalidate copies in history or elsewhere. Then review where the credential was used and remove it from the repository according to your team's process.

PostgreSQL connection questions

What is the default PostgreSQL port?: 5432. Managed services and local installations can use another port.
Does sslmode=require verify the server hostname?: No. Use verify-full with the required trust configuration when hostname verification is needed.
Can I connect without a password in the URL?: Yes. With password authentication, psql can prompt for it or libpq can read a protected password file. Other server authentication methods may not require a password.