Everything PgDeck does, and every key that does it.

One app for three engines. PostgreSQL is the stable, fully-featured target; MySQL and MongoDB ship in beta. The engine is fixed per saved connection and drives the default port (5432 / 3306 / 27017), the avatar badge and which tools the rest of the app shows.

The + button opens a searchable tile gallery instead of dropping you into a blank form. Each driver shows a coloured badge; double-clicking a tile jumps straight to the new-connection form.

Paste a postgres://, postgresql://, mysql://, mongodb:// or mongodb+srv:// URL and the form fills itself in — engine detected from the scheme, plus host, port, database, user, password, SSL and leftover query params, named database@host automatically.

As you paste, the dialog shows a green check with the parsed user@host:port/database (and · SSL), or a red "Not a recognised URL" message. Import stays disabled until the string actually parses.

A Test button validates the typed credentials without saving anything — a throwaway client that runs SELECT 1 on PostgreSQL/MySQL or an admin ping on MongoDB, opening and tearing down a temporary SSH tunnel first when one is configured.

Database passwords and every SSH secret are encrypted through Electron safeStorage — DPAPI on Windows, Keychain on macOS, libsecret on Linux. If OS encryption is unavailable the save is refused outright rather than writing a plaintext secret to disk.

The connection profile handed to the interface is rebuilt field by field with no password and only the non-secret half of the SSH config. Decryption happens in the main process at connect time and nowhere else.

SSL is switched on automatically for non-local PostgreSQL hosts, and a pasted URL's sslmode is honoured. If a server refuses SSL outright PgDeck reconnects without it instead of failing, and remembers that for the session.

Dev servers and self-signed managed instances connect without extra configuration or hand-written certificate flags.

Reach a database that only listens on a private network. SSH host, port, user, and either a password or an OpenSSH/PEM private key with an optional passphrase — PgDeck forwards an ephemeral local port and points the driver at it.

Paste a key into the textarea or load one from disk (.pem, .key, .txt, .cer, .crt, .openssh); picking a file also switches the auth type to key.

The SHA-256 fingerprint of the SSH server's host key is learned on first connect and stored with the connection. Later connects refuse to proceed if it changes — the signature of a machine-in-the-middle.

Tunnels send keepalives every 10s with 3 misses tolerated, so a tunnel dropped by sleep, VPN or a Wi-Fi change is detected in about 30 seconds instead of hanging. A dead tunnel and its pool are discarded so the next connect rebuilds them cleanly.

An extra Options field carries raw URI query params — authSource=admin&replicaSet=rs0 — that host, port and database cannot express, appended verbatim to the generated URI.

The database field is required for PostgreSQL but optional for MySQL and MongoDB, where you can connect to the server itself and browse every database from one connection.

File connections into named folders with an accent colour, an open/closed folder icon and a member count. Collapsed state is persisted to disk, so it survives restarts and auto-updates.

Renaming a group moves every connection in it. Duplicating one clones the folder and every connection inside it, secrets included. Deleting a group keeps its connections — they move back to the top level, and the confirm dialog says so.

The Group field is a combobox that suggests every known group, filters as you type, offers Ungrouped, and shows a Create "name" row for a group that does not exist yet.

Drag a connection onto a group block to file it there, or onto the root area to pull it out. The drop target rings, a collapsed group auto-expands, and stray text dragged in from elsewhere is rejected.

Pinned rows float to the top of their group while everything else keeps its saved order; pinned groups sort above unpinned ones. A small filled pin marks them.

Six status colours paint a stripe on the row edge, the engine avatar and the tag chip. A separate tag picker offers local / testing / staging / development / production as an uppercase chip — so production never looks like local.

Each connection shows a solid colour circle badged with its driver code (Pg / My / Mg) rather than a generic cylinder, so engines are told apart at a glance and the active one is ringed in the rail.

Filter by name, host, database or group name. Empty groups hide while searching, and the empty state distinguishes "no connections yet" from "nothing matches your search".

Saving a connection whose user@host:port/database already exists shows the existing one on a card and offers Open existing or Save anyway — so you do not quietly end up with two labels for the same database.

Clone a connection with its secrets as "X (copy)". The clone is made in the main process by copying the encrypted blobs verbatim, so it authenticates correctly even where OS encryption is unavailable, and a learned SSH host key carries over.

Editing pre-fills everything except secrets — the password placeholder reads "•••••• (unchanged)" and leaving it blank keeps the stored one. Saving an edit closes the open pool so the next connect picks up new credentials.

Deleting asks first, and closes the connection's open pool before removing it.

Connecting to a second database keeps the first open. A rail of engine avatars appears once two or more are live, and each connection's schemas, tabs and pins are cached so switching back is instant.

PostgreSQL: 10s connect, 30s idle, 4 pooled clients. MySQL: 10s connect, 4-connection pool. MongoDB: 10s server selection and connect. SSH: 15s ready timeout — tuned so a dead host fails fast instead of hanging the UI.

The sidebar lists every non-system schema (MySQL and MongoDB databases surface at the same level) and fetches a schema's relations once, on expand, then caches them. Views get an eye icon, tables a grid icon.

Filter tables by name across every schema — it force-loads unexpanded schemas so nothing hides — ranking exact matches above prefix matches above mid-string ones and hiding schemas with no hits.

Any table can be pinned into a sticky section that stays visible while the tree scrolls. Pins are saved per connection and reappear as quick-open chips on the empty workspace screen.

Right-click a table for Open, Open Structure, Copy Name, Pin/Unpin, Import, Export, Truncate and Delete — clamped so the menu never opens off the edge of the window.

Cells are syntax-coloured by inferred type: strings, numbers, booleans, dates, JSON and NULLs each get their own colour, with numeric-looking strings coloured as numbers.

NULLs render as a dimmed italic NULL token, visually distinct from a blank cell, so a missing value is never confused with an empty one.

Objects and arrays render as compact, colour-coded JSON in the grid, with the full value one right-click away in a monospace editor.

Byte-array columns render as a [N bytes] summary instead of dumping unreadable binary into the grid.

Clicking a column header cycles ascending, descending, then back to no sort, refetching from the first page. An arrow shows the current direction.

The header right-click menu offers Sort Ascending, Sort Descending and — when that column is the active sort — Remove sort.

With no user sort, rows are ordered by primary key (or by ctid on PK-less tables) so pagination stays consistent and rows do not jump around after an update.

Only the operators that make sense for the column type are offered — booleans get =/≠/is null with a true/false picker, numbers and dates get comparisons, text gets contains / not contains / starts with / ends with.

Stack as many conditions as you need; they combine with AND in the generated WHERE clause. Free is limited to a single condition.

Right-click a cell to filter that column by its own value in one click: =, <>, <, >, <=, >=, Contains, Not contains, Has prefix, Has suffix, IS NULL and IS NOT NULL.

Right-click a column header and choose Filter with column to append a pre-seeded contains condition and open the filter bar.

The footer Filter button lights up with the number of active conditions, so a filtered view is never mistaken for the whole table.

The top-bar search box runs a free-text search across every column of the open table — each column cast to text and matched case-insensitively — combining with any active filters.

Every case-insensitive occurrence of the term is wrapped in an amber highlight inside the grid, so you can see exactly why each row matched.

Search draft text is re-synced per table tab, so a half-typed term never bleeds across tabs.

Drag the divider on a header to resize a column, with a 60px floor, a blue guide on hover, and no accidental sort click.

Drop a noisy column out of the grid from the header menu, then bring them all back with a single Show all columns entry.

Pinned columns move to the front and stick to the left edge while the rest scroll horizontally, with sticky offsets computed from their measured widths.

One menu item clears every manual width, pin and hidden column. The layout also resets automatically when you switch tables.

The header menu copies the column's name to the clipboard — the fastest path from grid to query.

Choose 50, 100, 250, 500 or 1000 rows per page from the footer; changing it resets to page one. The backend clamps to 1000 rows regardless.

Footer arrows page through records with LIMIT/OFFSET. Previous is disabled on page one, Next is disabled once a short page proves you have reached the end, and both disable while a fetch is in flight.

The footer shows the current row range plus a total — an exact COUNT(*) when filters or a search are active, and the fast planner estimate when browsing unfiltered, so opening a huge table stays instant.

Footer chevrons step to the previous or next table in the current schema without going back to the sidebar.

Right-click a cell in a single-column foreign key and choose "Go to <table> →" to open the referenced table filtered to the matching row.

First load shows a shimmering header-plus-cells skeleton sized to the real column count with varied cell widths, so it reads like data. Refetches keep the previous page visible instead of blanking the grid.

Cell menus are clamped so they never spill off the right or bottom edge, and flyout submenus flip to the left when there is no room on the right.

Every cell edit, new row and delete is staged locally rather than sent to the database. Edited cells turn green, deleted rows turn red edge to edge, and new rows render green at the bottom of the grid.

Commit sends every staged delete, update and insert inside a single BEGIN/COMMIT. Any failure rolls the whole batch back, so a half-applied change is impossible.

A bar appears above the footer the moment anything is staged, showing the change count with View, Discard and Commit.

View groups every staged change into New rows, Edited rows and Deleted rows. Edits show old value → new value per column, deletes preview the doomed row, and empty new rows are labelled "empty row (column defaults)".

Each staged item has its own Discard (or Keep, for deletes) button, so one change can be dropped without throwing away the batch. The modal closes itself once nothing is left staged.

Discard all — from the bar, the modal, or Ctrl/Cmd+Z — throws away every staged edit, insert and delete and confirms with a toast.

Double-click any cell in an editable base table to edit it in place, pre-filled with its current value and honouring any edit already staged on that cell.

Click a cell to focus it, then press Enter or F2 to open the editor without reaching for the mouse.

The editor adapts to the column: boolean columns get a true/false dropdown, enum columns get a picker of the type's real labels read from the catalog in sort order, everything else gets a text input.

Change a cell and change it back, and the staged edit is dropped automatically — if it was the row's last edit, the row leaves the pending list entirely. No phantom no-op UPDATEs.

Typing NULL in any casing stores an actual SQL NULL rather than the literal four-character string, so timestamp and numeric columns do not fail to cast.

Stage an empty string, a real NULL, or the column's DEFAULT straight from the cell menu without opening an editor. Works on existing rows and drafts alike.

A cell set to DEFAULT commits as col = DEFAULT on an UPDATE, and is simply omitted from an INSERT so the database applies its own default, sequence or identity value. A draft row with no values at all commits as INSERT ... DEFAULT VALUES.

Open a full-height monospace editor holding the entire value — the practical way to read or edit long text and JSON that will never fit in a grid cell. Ctrl/Cmd+Enter saves, and a one-click Set NULL button is right there.

Add a blank row from the footer button, the cell menu, or Ctrl/Cmd+I. The grid auto-scrolls to the new row so you actually see it, and each draft carries an inline × to drop it again.

Duplicate Row (or Ctrl/Cmd+D) creates a draft pre-filled with every non-key column of the source row, so the primary key or identity value is regenerated by the database instead of colliding.

Delete stages the selected rows — or the focused row — and renders them red until commit. Pressing Delete again toggles it off, and staging a delete drops any pending edits on that row.

Delete with dependents… walks the foreign-key graph and previews every table and row count that would be removed transitively, shows the total, then deletes the row and all dependents in one transaction.

The dependency walk stops at 5,000 rows. If it hit that cap the dialog says so outright — the real cascade is larger than the number shown — and surfaces any plan warnings as amber callouts before the destructive confirm.

If a staged delete fails because the row is referenced by a foreign key, PgDeck discards the staged delete and opens the delete-with-dependents preview rather than leaving you at a dead-end error.

Click to select, Ctrl/Cmd-click to toggle rows in and out, Shift-click for a contiguous range from the anchor. Ctrl/Cmd+A takes every loaded row; Esc clears the selection.

Editable tables fetch a hidden ctid alongside the row so PK-less tables can still be targeted for UPDATE and DELETE. The review modal identifies such rows by ctid, and the helper column never shows in the grid.

The clicked cell gets a bright outline, edited-but-uncommitted cells fill solid green, deleted rows fill red and draft rows fill green edge to edge — the state of every change readable at a glance.

Editing affordances appear only on base tables — never on a view — and only in the shape each engine actually supports: per-cell staged editing on PostgreSQL and MySQL, whole-document editing on MongoDB. No surface sprouts buttons that cannot work.

For document stores a row's menu offers View document…, Edit document… and Delete document, editing the whole document as JSON rather than per cell so BSON types round-trip intact.

Independent query tabs, each with its own text, results and error state. Switch by clicking, close with the ×, add with +. Closing the active tab falls through to its neighbour.

SQL is coloured as you type — comments, single-quoted strings, double-quoted identifiers, numbers and 120+ keywords, types and functions each get their own colour.

Ctrl/Cmd+Enter runs the tab. Highlight some text first and it runs only that selection — the difference between testing one CTE and running the whole script.

Several semicolon-separated statements run in one go. PostgreSQL uses the simple query protocol so the whole batch runs, and the grid shows the last statement's result set.

The Explain button prefixes the tab (or the selection) with EXPLAIN and runs it. Deliberately plain EXPLAIN with no ANALYZE, so it only plans and never executes — safe on a write.

A red Stop button appears while a query is in flight. PgDeck captures the backend PID and issues pg_cancel_backend() from a separate pooled connection, so a runaway query is actually cancelled server-side, not just abandoned.

The status line shows Running…, then the SQL command tag, the row count with correct singular/plural, and the wall-clock duration measured around the real driver call.

Results render with real column names and the same type colouring as the data grid — NULLs, booleans, numbers, ISO dates, byte arrays as [n bytes], objects as JSON — each cell carrying its full text as a tooltip.

Only the first 2,000 rows are painted to the DOM so a huge SELECT cannot freeze the app, with a footer line saying so. The complete result stays in memory, and export still writes every row.

A statement that returns no columns reports itself in the results pane — "UPDATE — 3 rows affected · 12 ms" — instead of showing an empty grid.

A failed query shows the driver's message compactly in the status line and in full, with line breaks preserved, where the grid would be. The error clears on the next run.

Every statement is classified in the main process before it runs. INSERT, UPDATE, DELETE, MERGE, TRUNCATE, COPY, CALL and REFRESH count as data writes; CREATE, ALTER, DROP, GRANT, REVOKE, REINDEX and friends count as DDL — each checked against your plan before a single byte is sent.

Line comments, block comments, quoted strings, quoted identifiers and $tag$ dollar-quoted blocks are stripped to inert placeholders before keywords are scanned — so SELECT 'DELETE FROM t' is correctly read as a read.

The classifier checks every statement in a batch, scans a leading WITH for INSERT/UPDATE/DELETE inside the CTE, and treats EXPLAIN ANALYZE (which really does execute) as what it is — while plain EXPLAIN of a write stays read-only.

When the console runs anything that is not a SELECT, SHOW or EXPLAIN, open table tabs, row counts and structure views refresh themselves instead of showing stale data.

A History panel lists recent queries newest first with a green or red dot, the SQL on one line and either the row count or "error". Click one to load it back into the tab. Free sees the last 25 entries; Pro sees them all.

Every execution is recorded — successes with their row count, failures with their error message — so the query that just blew up is still recoverable. The last 1,000 entries are kept on disk regardless of plan, so upgrading reveals history already recorded.

Name a query and it lands in the Saved panel with a bookmark icon, a one-line preview and a hover delete. Click to load it back into the current tab.

The results toolbar offers Copy as JSON, Export CSV and Export JSON. Unlike table exports, SQL result exports are not row-capped — every row of the result is written.

Drag the divider between the editor and the results grid to grow either side, clamped so neither can collapse to nothing.

Opening a table leaves the SQL editor but keeps every tab and its results, and each connection gets its own set of tabs — so switching back returns you to exactly the queries you left.

When a statement is blocked by the plan, the reason is shown as a clean message on the tab and the upgrade dialog opens — no internal sentinel leaks into the UI.

Per table, the Structure tab lists columns with ordinal, type, nullability and default; indexes with access method, unique flag and ordered columns; and constraints with a colour-coded PK / FK / UNIQUE / CHECK badge and the server's full definition text.

Columns render as varchar(255) and numeric(18,2), not a bare type name — the detail you actually need when deciding whether a value will fit.

Table name, schema picker, and a grid of column rows with name, type, nullable, default and a key button that marks a column PRIMARY KEY. It opens pre-seeded with an id serial primary key plus a blank row.

Double-click a column's Name cell, type, press Enter. An unchanged value fires no DDL at all.

Double-click the Default cell: typing a value runs SET DEFAULT, clearing it runs DROP DEFAULT.

The Nullable column is a live YES/NO dropdown in every row; switching it runs SET NOT NULL or DROP NOT NULL immediately.

Picking a new type raises a confirm that spells out exactly what an assignment cast does to existing rows — numeric→integer rounds, varchar(n) truncates — and that it cannot be undone. Cancel and the cell snaps back to the real type.

For casts PostgreSQL will not do implicitly, a dialog pairs a type combo with a free-text USING expression and a live SQL preview.

+ Column opens an inline draft in the Columns grid with name, type combo, nullable and default. Enter runs the ADD COLUMN, Escape discards it, and switching tables clears any half-typed draft.

Drop Column… asks for confirmation naming the column and warning that the data loss cannot be undone before running the ALTER.

+ Index opens a draft row with an optional name, an access-method dropdown, unique flag and a column list. Methods are engine-aware — btree, hash, gin, gist, brin and spgist on PostgreSQL; btree, hash, fulltext and spatial on MySQL. Hovering an index reveals a drop button.

Pick local columns as toggle chips, choose the referenced table, type the referenced columns, and pick ON DELETE / ON UPDATE from NO ACTION, RESTRICT, CASCADE, SET NULL and SET DEFAULT — with an optional constraint name and a live SQL preview.

A form for a CHECK expression with an optional constraint name and a preview of the exact statement before it runs.

Hovering a constraint row reveals a drop button, gated behind a confirmation. Primary-key constraints are deliberately not droppable from that row.

Create table, add column, change type, set default, add index, add FK, add check and create trigger all render the exact syntax-highlighted statement they will run — and the Run button stays disabled until the form produces valid SQL.

All generated DDL quotes identifiers and escapes embedded quotes, per engine — double quotes for PostgreSQL, backticks for MySQL — so names with spaces, mixed case or quotes are handled correctly.

Drops and type changes route through a confirm dialog that names the object, appends "This cannot be undone" and uses a red action button. Non-destructive edits apply straight from the grid.

A free-text field with a dropdown of serial, integer, bigint, numeric, real, double precision, boolean, text, varchar, char, citext, uuid, json, jsonb, date, time, timestamptz, interval, bytea, inet, cidr, macaddr, xml, tsvector and array types — and any unlisted value, like a custom enum, is kept exactly as typed.

Lists each user trigger's name, timing, events, level and function, badges disabled triggers, and shows the full definition as a tooltip. Internal foreign-key enforcement triggers are hidden.

Build a trigger from a form: name, BEFORE / AFTER / INSTEAD OF, any combination of INSERT / UPDATE / DELETE / TRUNCATE, row or statement level, and a function autocompleted from those that return trigger. Level is forced to STATEMENT when TRUNCATE is selected, because PostgreSQL rejects FOR EACH ROW there.

Truncate confirms with an explicit "delete all rows" warning. Drop confirms with "permanently drop and all its data", then issues DROP deliberately without CASCADE so a dependent object makes it fail loudly rather than quietly taking more with it.

An Info panel rebuilds the table's CREATE TABLE — columns with NOT NULL and DEFAULT, constraints as CONSTRAINT clauses, plus an -- Indices section — syntax-highlighted with a Copy button, rebuilt from already-loaded structure so it needs no round trip.

A full-screen diagram of every base table across all schemas, with foreign keys drawn as curved crow's-foot to bar connectors anchored on the real referencing and referenced column rows, and primary keys highlighted in gold.

Zoom buttons with a live percentage from 20% to 250%, pinch or Ctrl-wheel zoom anchored at the cursor, drag to pan, drag a table header to move it, and a Reset view that re-runs the auto-layout and recentres.

Each box shows its first 10 columns with a "+N more — show all" link that expands it into a scrollable list painted above its neighbours.

Export the whole diagram as a standalone SVG with a fresh full-height layout showing every column of every table — not just what is on screen — the FK connectors, and a PgDeck footer.

Double-click a table's header in the ERD to close the diagram and open that table in the workspace.

For a collection, Structure becomes Schema: an inferred picture from a 50-document sample showing each top-level field, every BSON type seen (joined when a field is polymorphic) and how often it is present, with _id always listed first.

The collection's real indexes with name, unique flag and key list, badging Mongo's default _id_ index.

Applying any structure change clears sorts and filters that might reference a dropped or renamed column, then re-fetches both rows and structure — so the grid never shows columns that no longer exist.

Editing controls appear only for base tables. On Free the full structure is visible, but every edit control routes to the upgrade prompt with a (Pro) tooltip rather than silently disappearing.

MongoDB has no SQL editor; an Aggregate button opens a full-height console scoped to the selected collection. Type Extended JSON — an object runs as a find filter, an array runs as an aggregation pipeline.

The console parses relaxed Extended JSON, so plain JSON and $oid, $date, $numberDecimal tags all work in filters and stages, and 24-hex _id strings are rebuilt into ObjectIds.

Pipelines are scanned stage by stage and any $out or $merge is rejected before anything runs — a console for exploring, not for silently rewriting a collection.

Returned documents render in a read-only grid whose columns are the union of all keys across the result, with _id forced first and nested values shown as Extended JSON.

The console caps results at 200 documents and says so on the count line, rather than quietly truncating.

One panel reads and writes: view mode is a syntax-coloured render of pretty Extended JSON, and Edit flips it in place to a coloured editable canvas.

While editing, the buffer is parsed on every keystroke and the parser's own message appears in a red strip. Save stays disabled until the JSON is valid.

On save the _id is stripped from the body and taken from the target document, so a stray edit to _id cannot error out or silently retarget a different document.

The same panel opens in insert mode with a blank {} buffer; saving inserts the document, and Mongo generates the ObjectId when _id is omitted.

The database-wide search enumerates every collection in every non-system database, samples each to learn its field names, then matches with a case-insensitive escaped regex.

The + button creates an empty collection (column definitions are ignored — a collection is schemaless), and the tree's Truncate deletes every document in one.

JSON documents are inserted as-is with insertMany; a headerless CSV is synthesized into col1…colN documents.

Not object names — actual data. Every base table in every user schema is scanned with each column cast to text and matched case-insensitively, with system schemas excluded and unreadable tables skipped silently.

Search runs table by table and result cards appear as each table lands, under a header reading "Scanning 12/94 tables · 3 with matches" with a filling progress bar.

A Stop button cancels the in-flight scan, and starting a new search cancels the old one — no orphaned queries left running against your server.

Each table returns at most 20 matching rows (flagged 20+ when truncated), four workers scan concurrently on their own pooled connections, every query carries a 2.5s statement timeout, and the whole scan stops at a 25s deadline.

Open all opens the table with the search term pre-applied; double-clicking a result row opens the table filtered to that single record.

Every occurrence of the term is wrapped in an amber mark, and cells are coloured by type with the same palette as the main grid.

Closing the dialog snapshots the term and results so reopening restores them instantly. If specific tables were edited meanwhile, only those tables are re-scanned instead of redoing the whole database.

An always-visible Replace field with Replace (next match), Replace all and a match-case toggle, doing substring replacement across every occurrence in a cell.

Only real text columns are scanned, so a substring replace can never corrupt a uuid, number or date. Each match is addressed by primary key, tables without one are skipped and reported, and scans are capped at 500 cells.

Replace all shows a red strip quoting the search and replacement text and warning that the writes go straight to the database and cannot be undone — then reports the exact number of cells replaced.

Opening from the top bar scopes replace to the entire database; the Replace button beside the in-table search opens the same panel scoped to just that table, with the title changing to match.

The footer Export button writes every row matching the active filters, search and sort — not just the visible page — paging out 1,000 rows at a time. Free exports up to 100 rows; Pro up to 10,000.

Right-click a table for Export → CSV / JSON / SQL. Unlike the footer export this ignores the open tab's filters and dumps the table itself.

Right-click a cell and Copy As offers Plain Text, JSON, Markdown Table, TSV, TSV with Header, CSV, CSV with Header and INSERT Statement — acting on the whole multi-row selection when there is one.

Copy the raw content of a single cell — dates as ISO strings, objects as JSON, NULL as empty — with a fallback path for when the clipboard API is blocked.

A cell-menu item downloads exactly the rows currently rendered in the grid page, named after the table.

RFC-style CSV quoting for values containing quotes, commas or newlines; 2-space pretty JSON; INSERT statements with quoted identifiers and escaped literals. Dates become ISO strings and objects become JSON text.

When an export hits the plan's row cap a warning toast fires — free users are told the 100-row limit, paid users are told the export was truncated. A success toast otherwise reports the exact row count.

Columns are matched by header name (or by position when there is no header), only CSV columns that exist in the table are inserted, empty cells become NULL, and rows go in as chunked 100-row multi-VALUES INSERTs inside one transaction that rolls back on error.

Accepts a JSON array of row objects or a single object. Keys are intersected with real table columns and nested values are stringified so json/jsonb columns accept them, chunked and transactional like CSV.

From SQL dump… reads a .sql file and runs it through the normal query runner, so the statement guard still applies and the toast reports the resulting command tag.

Import is reachable from the footer button, the grid cell menu and the sidebar table menu. Picking a format pre-filters the OS file picker; with no format chosen the importer is inferred from the file extension.

A successful import reports "Imported N row(s) into <table>" and re-fetches the current page if that table is the one on screen.

Back the active database up to a file in Custom (.dump) or Plain SQL (.sql) format, written to a path chosen in a native Save dialog.

A .sql file is replayed with psql; anything else goes through pg_restore with --no-owner --clean --if-exists. Benign pg_restore warnings are tolerated — an error is only raised when the output really contains one.

The Windows build ships pg_dump, pg_restore and psql inside the app, so backup works with nothing else installed. On macOS and Linux PgDeck resolves them from the standard install directories and your PATH, and tells you exactly what to install if it finds neither.

Opening the dialog probes each tool and shows either a green "Client tools detected" line or an amber panel explaining exactly what to install. Backup disables without pg_dump; Restore needs pg_restore or psql.

For SSH connections a temporary tunnel is opened and the tools are pointed at the local port, always torn down afterwards. The password is passed via the environment rather than on the command line.

Restore does not run on the first click. An inline red banner names the target database and warns that restoring can overwrite data before it offers Choose file.

After a successful restore the app re-reads schemas, tables, rows and structure and drops the search cache, so restored data appears immediately with no disconnect and reconnect.

Every table you open becomes a tab in a horizontally scrolling strip. Click to switch, click the × or middle-click to close; tables and views carry distinct icons.

Right-click a tab for Pin/Unpin tab, Close, Close Others, Close to the Right and Close All. Entries that would be no-ops are hidden rather than greyed.

Pinning moves a tab to the front of the strip in pin order and swaps its icon for a pin, while unpinned tabs keep their open order behind it.

Each tab privately owns its search term, filters, sort, page, fetched rows, structure and uncommitted edits. Switching away parks that state and returning restores it exactly — a second tab can never reset the first one's view or drop its staged changes.

Closing the active tab focuses the tab to its right, or to its left if it was last; closing the final tab returns to the empty state. Closed tabs release their parked rows.

Split the active tab into a second pane to read two tables — or a table and a query — side by side, and split repeatedly into N vertical groups.

Only the focused pane is live and editable and gets an inset ring; the others render as frozen read-only snapshots labelled "Click to focus & edit this pane". Clicking one swaps it in.

A newly split pane inherits the visible rows but starts with empty pending update, delete and insert buffers, so staged edits never leak between panes.

Open tabs, the selected table, pinned tabs and the split layout are saved and restored the next time you connect to that database — including re-fetching each pane's rows so every pane shows data immediately.

The saved session is keyed by connection id plus its user@host:port/database identity, so pointing a connection at a different database starts clean instead of restoring tabs for tables that no longer exist — and pointing it back restores the old session.

Switching back to a connection you already opened this session restores its schemas, expanded tree, tabs, rows, structure and search results from memory — no re-fetch, no reconnect wait.

A left icon rail lists every connection open this session for one-click switching. It appears only once two or more are open, since with one there is nothing to switch between.

A Switch button opens a modal listing saved connections filtered across name, host, database and group, in collapsible folders with counts, Active and Open badges, colour tags and pin markers.

Move to New Window spawns a second app window that auto-connects to that database and lands straight in the workspace.

Hide the schema sidebar entirely, or drag the grab strip between it and the grid to resize it between 160 and 640px.

With no table open the editor area offers three quick actions — SQL query, Search all, Diagram — chips for your pinned tables, and a count of connected schemas.

An NProgress-style bar appears whenever anything is in flight — rows, schemas, structure, a running query or a connect — trickling toward 90% and snapping to 100% when work finishes.

Stacked success, error, info and warning toasts with a manual dismiss. They clear after 3 seconds, except errors, which linger for 6 so they can actually be read.

A single hand-tuned dark theme — VS Code Dark+ crossed with TablePlus — with semantic colours for strings, numbers, keywords, NULLs, dates and PK/FK/index badges, plus thin themed scrollbars throughout.

The action row adapts to the engine: a SQL editor where SQL exists, an Aggregate console for document stores, and Search all, Diagram and Backup only where they are actually supported.

Toolbar and footer buttons drop to icons on narrow windows, the search field absorbs leftover space, and the row-range readout truncates first.

Clicking the window's × while connected drops the connection and returns to the connections screen instead of quitting. The next close exits — so a stray ⌘W never kills a live session.

A second launch — the installer's run-app, a desktop double-click, the post-update relaunch — focuses and un-minimizes the existing window instead of starting a rival process fighting over the same resources.

The whole page chrome is a drag region, so the window moves by dragging empty UI rather than hunting for a title bar.

Each connect takes a ticket re-checked after every await, so switching connections during a slow handshake makes the older attempt abandon quietly instead of writing its schemas and tabs into the connection you switched to.

A row fetch that lands after you have already switched tabs is dropped rather than overwriting the newly active tab's data.

On quit every database pool is closed and the browser bridge is shut down so its port is free for the next launch. On macOS the app stays alive with all windows closed and re-creates one from the dock.

A first-run offer grants 30 days of full Pro against nothing but an email address. Skip it and you drop to Free with the gate never reappearing — the trial can still be started later from Account & License.

Free allows 2 saved connections and 2 concurrent SQL tabs, one filter condition, 100-row exports and the last 25 query-history entries, and browses without writing. Every blocked action explains itself and offers the upgrade rather than failing silently.

Pro removes the connection and SQL-tab caps entirely, unlocks multi-condition filters, raises exports to 10,000 rows and shows the whole query history.

SSL connections are deliberately never gated. Managed PostgreSQL — Supabase, Neon, RDS — requires SSL, and gating it would stop Free users connecting to any cloud database at all.

Every sensitive operation re-checks entitlement outside the interface layer, so a limit is a real limit rather than a hidden button — and raw SQL typed into the console is classified and gated the same way as the grid.

Paste a key in the Account or Upgrade dialog; the device is registered against your licence and the plan applies immediately. Activation errors surface the payment platform's own message rather than a generic failure.

Paid licences are re-checked shortly after launch and then every 6 hours, so a key refunded or disabled is picked up while the app is still open. Opening the Account dialog forces an immediate check.

If the licence server is unreachable, the last-good state is kept for 14 days from the last successful check — so a flight, a VPN or an outage never locks you out of your own database client.

Deactivate on this device releases the seat and clears every local licence field. The Account dialog shows how many of your devices are active.

The key is stored encrypted with the OS keychain and the interface only ever shows a mask. The Copy button copies the decrypted key from the main process, so it never crosses into the UI layer.

Entering a licence key while still on the 30-day trial does not silently burn it — the dialog shows the days remaining and offers Keep my trial or Activate anyway.

India sees native rupee pricing (₹99/month, ₹990/year) rather than a converted dollar price; everyone else sees $4/month or $39/year. Keys from either store activate — validation is store-agnostic.

Manage subscription opens your billing portal for payment method, invoices and cancellation, with a "view all orders" escape hatch that resolves orders from your sign-in email across every store.

A pill shows exactly where you stand — a countdown while on trial, a crown when subscribed, and an Upgrade button on Free that opens the paywall directly.

A blocked action opens the upgrade dialog carrying the reason for that specific block, next to the Pro feature list, both pricing cards and an inline activate-a-key box.

Updates download as a small progress pill while the app stays fully usable, with an × that cancels the transfer — not a blocking modal that leaves Task Manager as the only escape.

A release manifest marks an update mandatory by flag or by minimum version. Mandatory ones start downloading immediately; optional ones wait for an explicit Update now, and Later simply dismisses.

Restart & install runs the installer in the background with no second wizard and relaunches the app. Choosing Later applies the already-downloaded update the next time you close it, rather than re-downloading.

If staged inserts, updates or deletes are pending when an update is ready, the dialog counts them and warns that restarting discards them.

A button in the Account dialog forces a check and reports the outcome plainly — you are on the latest version, an update is available, or the feed could not be reached.

The app connects directly from your machine to your databases; database contents never reach PgDeck servers. Credentials live in the OS keychain. The only outbound calls are the update feed, licence validation and a small anonymous usage ping.

Four events only — app opened, connection created, database connected and your first successful query — carrying an install id, app version and OS. No SQL text, connection details, host or database names, row data, emails or licence keys. Set PGDECK_TELEMETRY=0 to disable it entirely.

A Windows x64 NSIS installer that installs per-user, lets you choose the directory and never deletes app data on uninstall; a macOS .dmg with hardened runtime; and a Linux AppImage.

Maximum-compression packaging plus a build step that strips roughly 37 MB of unused Chromium locale files, because every update is a full download for most users.

PgDeck Database Client runs the same app inside VS Code — an Activity Bar view and an Open Database Manager command — wiring credentials to VS Code Secret Storage and honouring the same licence.

The same interface in the browser, with queries executing in the desktop app over a local-only bridge — because a browser page cannot open a TCP socket, and your passwords should not leave your machine to work around that.

Four non-optional gates on every bridge request: bind to 127.0.0.1 only, require a browser-extension origin so no website can reach it, require a loopback Host header to defeat DNS rebinding, and require a pairing token compared in constant time.

The desktop app shows the browser pairing code masked, with reveal and copy buttons and the loopback address it is listening on. New code unpairs every browser at once.

Desktop, VS Code and browser share the same entitlement table and the same key — a Pro feature is Pro everywhere, and a Free user is gated identically everywhere.

The EULA gate is recorded outside browser storage precisely because the Windows updater force-kills the app — so accepting once means accepting once, not once per update.