Browse MySQL safely, without sharing the root password
Most MySQL access in a small team ends up being the application user or, worse, root, shared around because it is the credential someone had. The Data Console replaces that with per-person access to specific tables, PII masked unless granted, and an audit trail of who looked at what.
Create a read-only MySQL user
Run against a live server, then re-connected as that user to confirm SELECT worked and INSERT and DROP were refused.
-- MySQL 8, verified CREATE USER 'dbshift_ro'@'%' IDENTIFIED BY 'a-strong-password'; -- SHOW VIEW matters: without it, views are invisible rather than readable. GRANT SELECT, SHOW VIEW ON your_db.* TO 'dbshift_ro'@'%'; FLUSH PRIVILEGES;
What browsing MySQL looks like
- TINYINT(1) is surfaced as a boolean while plain TINYINT stays numeric, so a flag reads as true/false and a rating still reads as a number.
- ENUM columns keep their value list, which makes filtering a status column a pick list rather than guesswork.
- JSON columns are shown formatted rather than as a single long string.
- Foreign keys are followed in one click — on InnoDB tables, where they exist.
What catches people out on MySQL
'%' is every host on the network
Creating the user as 'dbshift_ro'@'%' lets it connect from anywhere that can reach the port. Narrow it to the address the console connects from if the database is not already behind a private network.
MyISAM tables have no foreign keys to follow
Older schemas on MyISAM declare relationships only by convention, so there is nothing for the console to link. It is also worth knowing that those relationships were never enforced by the database.
utf8 is not UTF-8
MySQL's legacy utf8 stores at most three bytes per character, so emoji and some CJK characters were already mangled before anyone browsed them. utf8mb4 is the real one.
A read-only login still shows everything
The user above stops writes. It does not stop someone reading every email address, card number and salary in the database, and it does not record who did. The console adds the other half: sensitive columns are detected and masked before the rows leave the server, unmasking is granted per column to named people, and every access is logged. Access Review answers "who can see what" across every source in one report, which is the question that is very hard to answer from a pile of grants.
Questions
How do I create a read-only MySQL user?
Create the user, then grant SELECT and SHOW VIEW on the database. SHOW VIEW is the part people miss: without it the views exist but do not appear. The sequence above was run against MySQL 8 and confirmed to permit SELECT while refusing INSERT and DROP.
Can I browse MySQL without installing a client?
Yes — the console runs in the browser, so there is nothing to install and no connection string to distribute. People you share a source with never see the credentials it was connected with.
Other databases
PostgreSQL
Browse a PostgreSQL database with PII masked, follow foreign keys, and give your team read-only access without sharing the connection string.
MariaDB
Browse MariaDB in the browser with PII masked and per-person access, without handing out a shared database login.
SQL Server
Browse SQL Server from the browser with PII masked and per-person access, without distributing a login or installing SSMS.
Oracle
Browse an Oracle database in the browser with PII masked and per-person access, without granting a schema account to everyone who needs a look.
MongoDB
Browse MongoDB collections in the browser with PII masked — and the one configuration detail that decides whether a read-only user means anything at all.
SQLite
Browse a SQLite database in the browser, with the read-only open mode that actually prevents writes and the type behaviour that surprises people.