Read the encryption code AES-256-GCM + Argon2id

The database manager
that isn't an Electron app.

A native, open-source SQL client for Postgres, MySQL, SQLite, CockroachDB and Supabase. Built in Rust. An 11 MB installer — not a 250 MB Java IDE, not a 200 MB Chromium bundle pretending to be an app.

Apple Silicon · Windows x86_64 · Linux x86_64  ·  MIT licensed  ·  zero app telemetry

Footprint · to scale

The other 689 megabytes
weren't doing anything.

Same six engines, same SSH tunneling, same visual EXPLAIN viewer. Minus the 250 MB Chromium runtime everyone else ships. The bars below are real installer sizes — drawn at a constant 180 MB/s, so the chart unfolds in roughly the time the downloads would actually take.

QueryDen Tauri · Rust
~11 MB
TablePlus native
~50 MB
pgAdmin 4 Python · web
~200 MB
Beekeeper Electron
~200 MB
DBeaver CE Eclipse · JVM
~250 MB
DataGrip JetBrains · JVM
~700 MB

Sizes verified against each project's public installer pages. The cyan bar is the entire QueryDen app — drivers, vault, SSH, EXPLAIN viewer, AI assistant. See the full comparison →

Inside the small one

Everything is a keystroke.

The 11 MB isn't a stripped-down toy. It's six engines, a schema-aware editor, a plan-tree viewer, an AI optimizer, parallel multi-DB query, line-level history, a real SSH stack — all reachable from one palette and one editor. Try the palette below.

⌘K
type to switch · click an item in-app: runs the command
EXPLAIN ANALYZE · plan tree · sorted by cost
Hash Join
312
Seq Scan · orders
298 96%
Filter customer_email = $1
no idx
Index Scan · users_pkey
12
hot path · click to see suggested index
AI · OpenAI / Anthropic / Gemini / Ollama · BYO key
runs locally · key stays on disk · no telemetry
Schema-aware autocomplete · FK graph
SELECT *
FROM   users u
JOIN   orders o
ON     
knows your aliases · knows your foreign keys
Compare · prod ↔ staging
prod.users
  • id uuid
  • email text
  • created_at timestamptz
staging.users
  • id uuid
  • email text
  • + email_verified bool
  • + verified_at timestamptz
  • created_at timestamptz
2 added columns · run the migration on prod →
Local history · 5-second snapshots · this tab
- WHERE id = 42
+ WHERE customer_id = 42
ORDER BY created_at DESC
LIMIT 100
8 snapshots · 14 minutes ago
Mask · safe for screensharing
idemailorgverified
1••••••@••••••.dev••••••true
2•••@•••••.com••••••true
3••••••••@•••.io••••••••false
cell mask is per-column · keymap-toggleable
Ctrl + Enter

Runs only the
statement you mean.

SELECT count(*) FROM users;
SELECT * FROM orders WHERE total > 1000
DELETE FROM cart WHERE expires_at < now();

Parse-aware. Cursor decides what runs — not the file.

Safety net

Every five seconds.
Forever.

14:32 WHERE id = 42
14:33 WHERE customer_id = 42
14:38 WHERE customer_id IN (…)
14:46 WITH recent AS (…)

Silent line-level snapshots of every tab. Locally — never leaves your laptop.

Parallel

One query.
Many databases.

Pick the engines, run once, get merged rows tagged with their source.

Embedded CLI

psql, but the right version.

Auto-downloads the matching server-version client. No "version mismatch" surprises.

Ctrl + Enter
Run statement under cursor
Ctrl + Click
Jump to definition
Alt + Enter
Intention actions
Ctrl + Shift + F
Format SQL (in editor)
Cmd + K
Command palette

And about 45 more — multi-cursor, schema search, transaction controls, query history, saved snippets, custom keymap presets, tab cycling, definition peek, EXPLAIN cost heatmap, signed updater, SSH tunneling, SQLite per-project files… all of them in the docs →

Security

Credentials, locked to your hardware.

Every encrypted file is fingerprinted to the machine that wrote it. Copy your connections to another laptop and they're noise — by design. Read the threat model →

Layer

AES-256-GCM

Authenticated encryption for every connection, every saved query, every vault entry. Tampering invalidates the MAC; the file refuses to decrypt.

Layer

Argon2id KDF

Master password → key via a memory-hard KDF, making brute-force orders of magnitude slower than a GPU farm.

Layer

Machine fingerprint

Mixed into the KDF. Linux: /etc/machine-id. macOS: IOPlatformUUID. Windows: CSP UUID. Change machines, the vault refuses to load.

Layer

OS keychain

Master key in macOS Keychain (Secure Enclave-bound), Windows Credential Manager (DPAPI), or libsecret on Linux.

Deep dive

See the bytes of an encrypted vault.

The Security page walks the full file format — magic header, Argon2id salt, GCM nonce, ciphertext, MAC — annotated against the source. Plus the threat model: what we defend against, and what we don't.

Open the threat model
How we compare

Six tools, side-by-side.

Verified against each project's public docs and changelog. Hover a column to highlight; we've left the gaps where the gaps are.

13 rows · 6 tools · cyan column = QueryDen
Capability
Engines supported
6 (PG · MySQL · Maria · SQLite · Cockroach · Supabase)
90+ (incl. NoSQL)
20+
15+ (relational)
10+
PostgreSQL only
Native (no Chromium bundled)
Installer size
~11 MB
~250 MB
~50 MB
~700 MB
~200 MB
~200 MB
Machine-locked vault
Brute-force lockout
Local history · diffs
Yes
Yes
Yes
Yes
Limited
Integrated psql · per-version
bundled
AI assistant · BYO key
OpenAI · Anthropic · Google · Ollama
Yes (paid)
Paid
Yes (BYO)
Visual EXPLAIN ANALYZE
Yes
Yes
Yes
Yes
SSH tunneling
Telemetry
Zero
Opt-out
Crash reports
Opt-out
Opt-out
None
Price (1 seat)
Free
Free
$89 one-time
$229/yr
Free / $19
Free
License
MIT
Apache 2.0
Commercial
Commercial
MIT (community)
PostgreSQL
QueryDen wedge wins
  • ~11 MB native installer
  • No Chromium bundled
  • Machine-locked vault, brute-force lockout
  • Integrated psql (per Postgres version)
  • AI assistant — BYO key, 4 providers
  • Zero app telemetry by default
Ship the small one

Stop waiting for a database client to start.

An 11 MB installer. Native binaries on macOS, Windows, and Linux. MIT licensed. Zero app telemetry.

v1.0.23 · published 2026-05-26 · SHA-256 verified · all platforms