--- title: "How to browse your PostgreSQL database with pgweb on Rock8Cloud" description: "Your database only answers services inside your project. Deploy pgweb next to it and get a browser SQL client with generated credentials and its own URL." tech: "pgweb" icon: postgresql category: applications pubDate: 2026-08-11 image: /how-to/og/browse-postgres-pgweb.png imageAlt: "How to browse your PostgreSQL database with pgweb on Rock8Cloud" headerImage: true heroImage: src: /how-to/pgweb/hero.webp alt: "pgweb open on a Rock8Cloud PostgreSQL database, schema tree on the left and the query editor on the right" width: 1920 height: 329 ctaTitle: "Your database, in the browser." ctaTitleHighlight: "In two minutes." ctaSubtitle: "Add pgweb to your project, link it to your PostgreSQL, sign in and start querying. No tunnel, no exposed port, no local setup." ctaIcons: [postgresql] order: 93 steps: - name: "Add the service" text: "In the project that holds your database, click Add Service and pick Application, then pgweb." - name: "Link your database" text: "Keep the generated login user and password, then link PGWEB_DATABASE_URL to your PostgreSQL service's Connection URL. Copy the password before you deploy." - name: "Deploy" text: "Deploy pgweb. It comes up in your project on its own public URL, next to the database it browses." - name: "Sign in" text: "Open the URL and sign in with the generated user and password." - name: "Browse and query" text: "Read rows, inspect structure, indexes and constraints, run SQL in the Query tab, and export results as JSON, CSV or XML." faq: - q: "Why can't I reach my Rock8Cloud database from my laptop?" a: "Databases on Rock8Cloud are network-isolated. They only accept connections from services running inside the same project, and they are never given a public address. The way in is a client that runs inside the project, which is exactly what pgweb is." - q: "Which connection URL does pgweb need?" a: "The plain Connection URL. The libpq-compatible variant appends uselibpqcompat, a Go-specific flag that pgweb's driver rejects. Linking PGWEB_DATABASE_URL to your PostgreSQL service picks the right one for you." - q: "Where do the pgweb login credentials come from?" a: "Rock8Cloud generates them on the add-service screen and saves them as the PGWEB_AUTH_USER and PGWEB_AUTH_PASS environment variables. Change either one in the service's Environment tab and pgweb redeploys with the new login." - q: "Can pgweb reach a database I didn't link?" a: "No. The service ships with multiple sessions disabled and the session locked to the connection you linked, so whoever signs in sees that one database and nothing else in your project." - q: "Is it safe to leave pgweb running?" a: "Its URL is public and the login is the only thing in front of your data, so treat it like production access. Use a strong password, rotate it from the Environment tab, and stop or delete the service when you are done with it." --- A PostgreSQL you provision on Rock8Cloud is **network-isolated**. It answers services inside your project and nothing else, and it never gets a public address. That is the right default for production data, and it is also the moment you want to look at a row and cannot. The fix is to put the client inside the project. **pgweb** is a browser-based SQL client that Rock8Cloud deploys as a one-click application. It sits next to your database, talks to it over the project's private network, and gives *you* a URL with a login. Your data stays where it was. Only the browser window is new. ## 1. Add pgweb to the project Open the project that holds the database and click **Add Service**. pgweb is under **Application**, the catalog of pre-configured services that deploy from a ready-made image instead of from a repo. ![The Add Service menu on Rock8Cloud with the Application option highlighted](/how-to/pgweb/add-service.webp) Add Service → Application ## 2. Link it to your database The panel asks for three things and prefills all of them. **Version and replicas.** pgweb 0.17.0 and a single instance is what you want. One person queries at a time and there is no state to spread. **Login credentials.** Rock8Cloud generates a user and a password for you and saves them as the `PGWEB_AUTH_USER` and `PGWEB_AUTH_PASS` environment variables. Copy the password now. They are ordinary variables afterwards, so you can change either one later in the service's **Environment** tab and pgweb redeploys with the new login. **The database.** `PGWEB_DATABASE_URL` is the connection string pgweb browses. Point it at your PostgreSQL service and pick **Connection URL**. Use the plain one, not the libpq-compatible variant: that one appends `uselibpqcompat`, a Go-specific flag pgweb's driver rejects. ![The pgweb add-service panel showing version, replicas, generated login credentials and the PGWEB_DATABASE_URL variable linked to a PostgreSQL service](/how-to/pgweb/configure.webp) Generated credentials, and PGWEB_DATABASE_URL linked to the Postgres service > **Pro tip:** the link is live, not a copy. Rotate the database password and pgweb picks up the new connection string on its next deploy, with nothing to paste. ## 3. Deploy Hit **Deploy pgweb**. It comes up as an application in your project, next to the database it browses, with its own public URL. ![The Rock8Cloud project overview with pgweb running and its public URL, listed alongside the postgresql-1 database](/how-to/pgweb/running.webp) pgweb running in the project, with its own URL ## 4. Sign in Open the URL. The browser asks for the credentials from step 2 before anything loads. ![The browser sign-in prompt on the deployed pgweb URL asking for a username and password](/how-to/pgweb/sign-in.webp) The generated user and password from the add-service screen ## 5. Browse, query, export You land on the database you linked, with its schemas in the sidebar and a tab row across the top. - **Rows** - read and filter table data. - **Structure**, **Indexes**, **Constraints** - the shape of a table without writing catalog queries. - **Query** - run SQL, with **Explain Query** next to it for a plan. - **History** - every statement you ran this session. - **Activity** - what the database is doing right now, which is where you look when something is slow. - **JSON**, **CSV**, **XML** - export the result set you are looking at. ![pgweb showing the schema tree with tables, views and functions on the left and the SQL query editor with export buttons on the right](/how-to/pgweb/query.webp) Full read and write access to the linked database ## What pgweb can and cannot reach The service is locked to the connection you linked. Multiple sessions are off and the session is pinned to that one database, so whoever signs in sees that database and nothing else in your project. Everything else about it is a normal service. It has an **Environment** tab, **Logs**, and the same deploy history as your app. ## Treat the URL like production access pgweb's URL is public and the login is the only thing between the internet and your data, with full write access behind it. So: - **Keep the generated password.** It is long and random on purpose. If you replace it, replace it with something as strong. - **Rotate it** from the Environment tab whenever someone who had it moves on. - **Stop or delete the service** when you are done. A database browser that nobody is using is a door nobody is watching. Adding it back is the same two minutes. Full reference and troubleshooting in the [pgweb docs](https://docs.rock8.cloud/docs/databases-and-storage/pgweb). Related: [Provision PostgreSQL](/how-to/provision-postgresql) · [Provision Dragonfly (Redis)](/how-to/provision-dragonfly) · [S3 object storage](/how-to/provision-s3).