← Data Console

Browse SQL Server without handing out a login

SQL Server access usually means a login, SSMS and a laptop. For anyone who needs to look at a few rows rather than administer the server, that is a lot of surface. The console gives them the tables they are allowed to see, masked where it matters, in a browser.

Create a read-only SQL Server user

Run against a live server, then re-connected as that user to confirm SELECT worked and INSERT and DROP were refused.

-- SQL Server 2022, verified.
-- A LOGIN authenticates to the server; a USER authorises inside one database.
-- You need both.
CREATE LOGIN dbshift_ro WITH PASSWORD = 'a-strong-password';

USE your_db;
CREATE USER dbshift_ro FOR LOGIN dbshift_ro;
ALTER ROLE db_datareader ADD MEMBER dbshift_ro;

What browsing SQL Server looks like

  • Schema-qualified tables, so dbo, sales and staging stay distinct instead of colliding in one list.
  • SQL Server types are shown as themselves: UNIQUEIDENTIFIER, DATETIMEOFFSET and NVARCHAR(MAX) are not flattened to text.
  • DATETIMEOFFSET keeps its UTC offset, so a timestamp means the same thing on screen as in the database.
  • Foreign keys are followed in one click.

What catches people out on SQL Server

db_datareader covers every table, including future ones

The role is database-wide by design, which is convenient and blunt. Where only part of the database should be visible, grant SELECT on specific schemas or objects instead — and use the console's allowlist rather than relying on the grant alone.

An untrusted constraint tells you the data was never checked

Foreign keys re-enabled after a bulk load without WITH CHECK are marked is_not_trusted. The relationship displays normally and was never validated against the rows sitting under it.

A login without a user cannot see the database

Creating the LOGIN and stopping there produces a credential that authenticates and then finds nothing. The CREATE USER step inside the database is not optional.

A read-only login still shows everything

The user above stops writes. It does not stop someone reading every email address, card number and salary in the database, and it does not record who did. The console adds the other half: sensitive columns are detected and masked before the rows leave the server, unmasking is granted per column to named people, and every access is logged. Access Review answers "who can see what" across every source in one report, which is the question that is very hard to answer from a pile of grants.

Start freeHow the console works

Questions

How do I create a read-only user in SQL Server?

Create a server LOGIN, then a database USER mapped to it, then add that user to db_datareader. All three steps are required. Verified on SQL Server 2022: SELECT permitted, INSERT and DROP refused.

Can people browse SQL Server without SSMS?

Yes. The console runs in the browser, so there is nothing to install, and the people you share a source with never receive the login it connects with.

More on SQL Server

Letting an AI agent read SQL Server

The read-only user above is the floor, not the ceiling — it still exposes every row it can select. What a scoped agent token changes, on this engine.

547

The INSERT statement conflicted with the FOREIGN KEY constraint. The conflict occurred in database "db", table "dbo.parent", column 'id'.

Other databases

PostgreSQL

Browse a PostgreSQL database with PII masked, follow foreign keys, and give your team read-only access without sharing the connection string.

MySQL

Browse a MySQL database from the browser with PII masked, follow foreign keys, and give teammates read-only access without sharing the root password.

MariaDB

Browse MariaDB in the browser with PII masked and per-person access, without handing out a shared database login.

Oracle

Browse an Oracle database in the browser with PII masked and per-person access, without granting a schema account to everyone who needs a look.

MongoDB

Browse MongoDB collections in the browser with PII masked — and the one configuration detail that decides whether a read-only user means anything at all.

SQLite

Browse a SQLite database in the browser, with the read-only open mode that actually prevents writes and the type behaviour that surprises people.