pg_hba.conf Generator
Build PostgreSQL pg_hba.conf rules for local sockets, TLS-only host connections, replication and a final reject, with warnings for trust, md5 and open ranges.
Free · No sign-up · Your inputs stay in your browser
Input
Generate pg_hba.conf rules
Output
pg_hba.conf
366 characters
PostgreSQL uses the first line whose type, database, user and address match, so order is the policy: specific rules first, a catch-all reject last. Reload with SELECT pg_reload_conf(); and check with SELECT * FROM pg_hba_file_rules; which reports lines that failed to parse.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
First match wins
PostgreSQL reads pg_hba.conf top to bottom and uses the first line whose type, database, user and address match the connection; later lines are never consulted. So specific rules go first and a catch-all reject goes last. The pg_hba.conf chapter describes every field and method.
Applying changes
Edits take effect on reload, not restart: SELECT pg_reload_conf(); or pg_ctl reload. Before relying on the new rules, SELECT * FROM pg_hba_file_rules; shows how the server parsed each line, including any line it rejected with an error.