How do I get my PostgreSQL connection string?

In your database provider's dashboard, click Connect to retrieve your connection string. It typically looks like: postgresql://user:password@host:5432/dbname.

Which connection method should I use?

Select the Transaction pooler option. This ensures compatibility with stateless applications and allows dbdiagramr to detect connections properly.

What if I forgot my database password?

Regenerate your password in the Shared pooler section of your database provider's dashboard and copy-paste the new credentials into your connection string.

Free Supabase security check

See which tables have Row Level Security off.

Connect with a read-only role. dbdiagramr reads the RLS flags and policy counts from PostgreSQL, draws your public schema, and marks every table. No signup, no storage.

Check my database See the demo

Public schema only today. RLS off is a risk signal, not proof that data is public — check grants too.

RLS2 off1 no policies3 on

React Flow

Example schema. Hover a table to see its RLS status. Live connections show your real flags.

What the badges mean

RLS off

The table has no Row Level Security. Check grants and API exposure.

RLS on, no policies

Non-owners are denied by default. Confirm that is intentional.

RLS on

At least one policy exists. Review the policy logic separately.

RLS unknown

Pasted SQL cannot show RLS. Connect live to read the flags.

Run it with a read-only role

Metadata lives in PostgreSQL system catalogs, so the role only needs CONNECT and USAGE. It does not need SELECT on your tables.

CREATE ROLE dbdiagramr_reader LOGIN PASSWORD '...';
GRANT CONNECT ON DATABASE your_db TO dbdiagramr_reader;
GRANT USAGE ON SCHEMA public TO dbdiagramr_reader;

Use the Session pooler (5432) or Transaction pooler (6543) connection string from Supabase → Connect.

What we read

· Table and column names, types, keys and foreign keys.
· The RLS flag and the number of policies per table.
· Never row data, policy expressions or secrets.
· The connection string is used once, then discarded.
· TLS certificates are always verified.

Prefer to keep everything in the browser? Paste SQL into the schema analyzer. It cannot see RLS, but it catches missing keys and unindexed foreign keys.

Questions

What does RLS disabled mean?

It means Row Level Security is not enabled on that table. That is a risk signal, not proof that the data is public: access also depends on table grants and whether the table is exposed through your API. Check both the flag and the grants.

What if RLS is on but there are no policies?

RLS is enabled with zero policies, so non-owners are denied by default. That can be intentional, or it can break an app that expected access. Confirm which one you meant.

Does this work with Supabase?

Yes. Use the Session pooler (port 5432) or Transaction pooler (port 6543) connection string. Direct connections are IPv6-only and often fail from hosted apps.

Do you store my connection string or schema?

No. The connection string is sent to our backend for one request, then discarded. We read catalog metadata only, never table rows. Nothing is saved.

Which schemas do you check?

The public schema today. Supabase internal schemas such as auth and storage are not included. Multi-schema support is planned.

Why does pasted SQL show RLS as unknown?

A CREATE TABLE script usually does not contain enough information to know whether RLS is enabled or how many policies exist. Connect live to read the real flags from PostgreSQL.

Check your public schema in 10 seconds.

See every table, its foreign keys, and whether RLS is on. Free, no account, nothing stored.

Run the RLS check