Online MySQL client & browser tools

Yes, transiently. After Turnstile and Connect, the password crosses the authenticated WSS/TLS connection from your browser to the odmin.biz MySQL gateway at mysql2.odmin.biz and exists in gateway and mysql2 client memory for authentication. It is not persisted, logged, placed in a URL, or retained for reconnect.

No. For a connection you configure, the selected key file and passphrase stay in current-tab browser memory on your machine. The gateway receives the derived public key and asks the browser to sign a bounded SSH authentication challenge. Browser code validates the username, service, method, algorithm, and public key before signing; only the signature returns. The gateway remains trusted to bind the opaque SSH session identifier to the selected host. The separate Real demo can use its own deployment key held only in a Kubernetes Secret and the gateway; that key never enters your browser.

The lightweight explorer has two choices: Open real demo requires fresh Turnstile and exercises the bounded read-only gateway with fixed server-side credentials, while Open sample data is a local in-browser simulation. The Adminer, phpMyAdmin, DbGate, CloudBeaver, and MySQL Shell GUI images below it open separate full community tools hosted on isolated server instances. Those available links all use the dedicated read-only Sakila dataset and must not receive private data.

Yes. The private-instance launcher at mysql.odmin.biz can connect phpMyAdmin and Adminer through an SSH tunnel, which is useful when shared hosting or a firewall blocks direct remote MySQL access. It verifies the SSH forwarding route and database login before creating the isolated instance. The public Sakila demos use their fixed operator-configured connections instead.

Browsers cannot speak the raw TCP protocol used by MySQL. The opt-in Node gateway provides that narrow bridge and exposes only the explorer's structured read operations. Use it as an occasional fallback when a normal trusted client is unavailable.

The connection originates from the odmin.biz Kubernetes gateway rather than your device IP. Fresh verification is required for every connection attempt to limit anonymous abuse without registration.

At most one hour, or fifteen minutes when idle. After either limit the database connection and in-memory session state are cleared, and reconnecting requires a fresh Turnstile challenge.

Yes. Append a #mysql? fragment to https://odmin.biz/tools/mysql-client. It may contain route, host, port, username, and database; route=ssh may also contain ssh=username@host, configurable sshPort, and an optional sshHostKeySha256 pin. The browser removes it immediately after parsing. It rejects passwords, private keys, passphrases, TLS state, consent, and Turnstile tokens, and never connects automatically.

A public IPv4 or IPv6 literal is accepted, and verified TLS may use an expected server name when its publicly trusted certificate identity differs from that address. Custom CA connections are not implemented. Explicit unverified TLS and plaintext modes are available only after acknowledging their warning on every attempt.

They do not weaken the browser-to-mysql2.odmin.biz connection, which always uses authenticated WSS/TLS. They apply only from the odmin.biz MySQL gateway to the selected MySQL server. On that leg, unverified TLS encrypts traffic but does not prove which server answered; plaintext also exposes the authentication exchange, metadata, definitions, and rows.

The sanitized message identifies the failed stage without exposing raw server details: browser-to-gateway availability, gateway-to-selected-host reachability, MySQL handshake, TLS availability, verified-certificate trust or identity, a server requirement for secure transport, account or database access, or a connection limit. Transport-mode errors affect only the gateway-to-selected-server leg.

No. Its protocol has no mutation or raw SQL operation, and the gateway sets the session default transaction mode to read-only before serving reads. Use a dedicated read-only MySQL account as the separate database authorization boundary.

Enable Connect through SSH tunnel, enter the public bastion as username@host with its configurable SSH port, browse to a supported Ed25519 or RSA private key, and enter the MySQL host as seen from that SSH server. A host-key pin is optional: supply a separately verified SHA-256 fingerprint when available, or confirm the observed fingerprint for that attempt. The gateway opens one MySQL-only forwarding channel and exposes no SSH shell, command, SFTP, or general proxy.

Test SSH tunnel authenticates and opens only the exact entered MySQL forwarding channel, then closes it without sending a MySQL payload or opening an SSH shell/session channel. Test database connection performs the normal selected transport, read-only session initialization, and initial metadata read, then closes. Both require fresh Turnstile and retain the selected browser-only key for retry.

Yes. Use Full screen in the connected workbench title bar. Use Exit full screen or press Escape to return to the page.