Secrets in PostgreSQL

2026-02-15 · postgresql security

How to store passwords, tokens, and keys in PostgreSQL instead of files. Encryption via pgcrypto.

Schema

CREATE TABLE secrets (
  id SERIAL PRIMARY KEY,
  path TEXT UNIQUE,
  encrypted_value BYTEA,
  created_at TIMESTAMP DEFAULT NOW()
);

Insert

INSERT INTO secrets (path, encrypted_value)
VALUES ('group/name',
  pgp_sym_encrypt('secret_value', 'master_password'));

Read

SELECT pgp_sym_decrypt(encrypted_value, 'master_password')
FROM secrets WHERE path = 'group/name';

Why not KeePass

KeePass = file. File = single user. PostgreSQL = network, backups, queries.

CLI wrapper: vault-get "group/name" → returns password.

Simple, encrypted, works.