Database User and GRANT Generator
Generate CREATE USER and GRANT statements for MySQL or PostgreSQL with least-privilege presets for an application, a read-only reporting user, migrations and backups.
Free · No sign-up · Your inputs stay in your browser
Input
Create a database user with the right grants
Output
SQL
202 characters
Least privilege: the application user cannot ALTER or DROP, so a SQL injection cannot take the schema with it; run migrations as a separate user. In PostgreSQL, GRANT ... ON ALL TABLES covers only tables that exist now, which is why ALTER DEFAULT PRIVILEGES follows it.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Least privilege in practice
An application account that can only SELECT, INSERT, UPDATE and DELETE cannot drop a table, so a SQL injection or a bug cannot take the schema with it. Run migrations with a separate account that has DDL rights, and give reporting tools and replicas a read-only one. The MySQL privileges reference and PostgreSQL's privileges chapter list what each grant covers.
The PostgreSQL trap
GRANT SELECT ON ALL TABLES IN SCHEMA public applies to tables that exist at that moment. Tables created by the next migration are not covered unless default privileges are set for the role that creates them, which is why the output includes ALTER DEFAULT PRIVILEGES.