pgAdmin 4 is the official, full-featured administration tool for PostgreSQL: a query tool with explain plans, a schema browser, backup and restore dialogs, user and permission management, server dashboards. It runs as a desktop app or as a web app (server mode).

Option 1: desktop app + SSH tunnel (recommended)

The safest setup exposes nothing new on your server. Install pgAdmin on your computer (Windows, macOS, Linux packages from pgadmin.org), then register your server with an SSH tunnel:

  • General → Name: web1-postgres
  • Connection → Host: 127.0.0.1, Port 5432, Username your PostgreSQL role
  • SSH Tunnel → Use SSH tunneling: on; Tunnel host 203.0.113.10, Username your SSH user, Authentication: identity file (your private key)

pgAdmin connects over SSH and then to PostgreSQL on the server’s localhost. PostgreSQL can keep listening on 127.0.0.1 only. See SSH tunnels.

Option 2: server mode with Docker

For a team that wants a shared web interface:

docker volume create pgadmin-data
docker run -d --name pgadmin --restart unless-stopped \
  -p 127.0.0.1:5050:80 \
  -e [email protected] \
  -e PGADMIN_DEFAULT_PASSWORD="$(openssl rand -base64 18)" \
  -v pgadmin-data:/var/lib/pgadmin \
  dpage/pgadmin4

Note the generated password (docker inspect pgadmin | grep PGADMIN_DEFAULT_PASSWORD, then change it in the UI). It listens on localhost; reach it via SSH tunnel, or publish it through an HTTPS reverse proxy with extra protection:

server {
    server_name pgadmin.example.com;
    location / {
        proxy_pass http://127.0.0.1:5050;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Add an IP allow-list or basic auth, plus certbot --nginx. pgAdmin also supports OAuth2/OIDC and LDAP login for teams.

To connect to PostgreSQL running on the host from the container, use the host’s Docker gateway address or host.docker.internal (with --add-host=host.docker.internal:host-gateway) — and make PostgreSQL listen on that interface with a matching pg_hba.conf entry. Or run pgAdmin on the same Docker network as a PostgreSQL container and use its service name.

Option 3: apt package (server mode)

pgAdmin provides an apt repository with pgadmin4-web, which runs under Apache with a setup script (/usr/pgadmin4/bin/setup-web.sh). Docker is usually simpler to keep isolated and up to date.

Features you’ll use most

  • Query Tool — run SQL, view results, Explain/Explain Analyze with a graphical plan (great for finding missing indexes).
  • Dashboard — sessions, transactions, locks, I/O per server and database. Kill runaway queries from the Sessions tab.
  • Backup / Restore — wrappers around pg_dump/pg_restore (for scheduled backups, use cron scripts instead — see pg_dump).
  • Login/Group Roles — create roles and grant privileges with dialogs, and see the generated SQL.
  • ERD tool — visualise and design schemas.
  • Schema Diff — compare two databases.

Security tips

  • Prefer SSH tunnels over exposing pgAdmin or PostgreSQL publicly.
  • Use dedicated PostgreSQL roles with only the privileges you need; avoid connecting as postgres for routine work.
  • Don’t let pgAdmin save passwords on shared machines.
  • Keep pgAdmin updated — it’s a web application with a large attack surface.

Lighter alternatives

  • psql on the server — fast and always available: psql commands.
  • Adminer — a single PHP file.
  • DBeaver, DataGrip, TablePlus — multi-database desktop clients.

Related: PostgreSQL remote connections and PostgreSQL users and databases.

  • PostgreSQL
  • pgAdmin
  • Databases