Connection Sharing

Export connections to a file, share links, import from other apps, and resolve passwords from secret managers

Passwords stay in your Keychain, so every route here hands over a connection definition and leaves the other person to supply their own credential. An encrypted export is the one exception.

Route	Use it when	Passwords	Needs
.tablepro file	One-off, any number of connections	Only with Include Credentials	Nothing
tablepro:// link	One connection, pasted into a chat	Never	Nothing
Linked Folder	A shared set has to stay current	Never	Starter
Team Catalog	Your team already shares a repo or a drive	Never	Team
Team Library	Your team shares nothing on disk	Never	Team
iCloud Sync	Your own second Mac, not a colleague	Optional	Starter

Export

Right-click a connection > Share > Export to File…, selecting several first to export them together, or File > Export > Export Connections… for all of them.

The file carries what the connection form holds, from host and port through SSH and SSL configuration, color, tags, group, Safe Mode level, startup commands, AI policy, the Local only flag, and any driver field the plugin does not mark secret. Passwords, key passphrases, TOTP secrets, and secret driver fields stay behind.

Export connections

Copy Connection String writes a database URL that carries the password in plain text, plus the SSH password when the connection tunnels. TablePro marks the clipboard item concealed, which keeps it out of the history of clipboard managers that follow that convention and out of nothing else. Copy TablePro Link and Copy as JSON carry no secrets.

Encrypted export

Needs a Starter license.

Turn on Include Credentials in the export sheet and enter a passphrase of 8 characters or more. Credentials go out under AES-256-GCM, keyed from the passphrase with PBKDF2 at 600,000 iterations. Importing asks for the passphrase.

Encrypted export

Import

Open a .tablepro file through File > Import > Import Connections…, by right-clicking the empty area of the connection list, by double-clicking the file, or by dragging it onto TablePro. File > Import > Import from URL… takes a database URL instead, described in Connection URLs.

A preview badges each connection before anything is saved: a green checkmark for ready, a yellow triangle when an SSH key or certificate is missing, a “duplicate” tag for one that already exists. Duplicates match by host, port, database, and username and start unchecked. Check one, then pick As Copy, Replace, or Skip.

Import preview

Anything that decides where a credential comes from is stripped on the way in, from a file and from a link alike: AWS options including IAM authentication, the region, the profile and the RDS endpoint; Use Password File; Prompt for password; the SSL client key passphrase; the pre-tunnel host and port; and the Pre-Connect Script. Startup SQL does arrive, and the confirmation sheet shows it in full. Read it before you save, because it runs on every connect with your credentials.

Share via link

Share > Copy TablePro Link produces a tablepro://import?… URL with the name, host, port, type, username, database, and any SSH or SSL settings. The recipient opens it, reviews the prefilled form, adds a password, and saves.

tablepro://import?name=Staging&host=db.example.com&port=5432&type=PostgreSQL&username=admin

tablepro://connect/<uuid> opens a saved connection rather than importing one. No menu item builds it; see URL Scheme.

Import from other apps

Choose File > Import > Import from Other App…, pick the source, then review the list and resolve duplicates before clicking Import. Groups and folders carry over, and the source app does not have to be running.

Pick the source app

App	Databases	Passwords	Notes
TablePlus	MySQL, PostgreSQL, MongoDB, SQLite, Redis, and more	From Keychain
Sequel Ace	MySQL	From Keychain
DBeaver	MySQL, PostgreSQL, SQLite, SQL Server, Oracle, and more	Decrypted from config file	Read from the data folder, so every edition works
DataGrip	MySQL, PostgreSQL, SQLite, SQL Server, Oracle, and more	From Keychain or c.kdbx	Reads recent projects with SSH and SSL settings. A master password blocks it
Beekeeper Studio	MySQL, PostgreSQL, SQLite, SQL Server, Oracle, and more	Decrypted from its app.db store	Brings SSH bastion hosts across
Navicat	MySQL, MariaDB, PostgreSQL, SQLite, SQL Server, Oracle, MongoDB	Decrypted from .ncx file	Export from Navicat first, with Export Password on, then pick the .ncx

On iPhone

TablePro for iPhone reads and writes the same file. Tap the more menu (•••) above the connection list and choose Import Connections, or open a .tablepro file from Files or AirDrop. Export Connections shares through the system share sheet, leaving passwords out unless you turn on Include passwords and set a passphrase.

Linked Folders

Needs a Starter license.

Press Cmd+,, then Settings > Account > Linked Folders > Add Folder… and point it at a directory of .tablepro files: a Git repo, a Dropbox folder, a network drive. Those connections appear read-only in the sidebar, and each person enters their own password.

Linked Folders settings

Team Catalog

Needs a Team license.

Share > Publish to Team Catalog… writes each selected connection as its own .tablepro file into a shared folder, asking for the folder the first time. Republishing overwrites the file, and passwords, passphrases, and TOTP secrets are never written. Teammates add that folder as a Linked Folder.

Environment variables

Needs a Starter license.

Write $VAR or ${VAR} in a .tablepro file and it resolves from TablePro’s process environment at connect time. An app launched from the Dock inherits no shell exports, so set the variable with launchctl setenv NAME value or launch TablePro from a terminal.

{ "host": "${DB_HOST}", "username": "$DB_USER" }

Password sources

A connection in ~/Library/Application Support/TablePro/connections.json can say where its password comes from instead of keeping one in the Keychain, which suits a script that provisions connections. The source resolves at connect time, replaces the Keychain lookup rather than supplementing it, and never syncs to iCloud. A source that fails to resolve fails the connection.

{ "passwordSource": { "kind": "file", "path": "~/.config/tablepro/secrets/feature-x.pw" } }
{ "passwordSource": { "kind": "env", "variable": "STAGING_DB_PASSWORD" } }
{ "passwordSource": { "kind": "command", "shell": "op read op://vault/feature-x/password" } }
{ "passwordSource": { "kind": "onePassword", "reference": "op://vault/feature-x/password" } }
{ "passwordSource": { "kind": "vault", "path": "secret/data/staging/db", "field": "password" } }
{ "passwordSource": { "kind": "awsSecretsManager", "secretId": "prod/db", "jsonKey": "password" } }

kind	Reads from	Set up first
file	The file at path, minus a trailing newline	chmod 600 the file
env	The named environment variable	Same Dock caveat as environment variables
command	stdout of the command, run through /bin/bash. A non-zero exit fails the connect
onePassword	op read on the reference	op signin
vault	vault kv get for one field at a path	VAULT_ADDR and VAULT_TOKEN in TablePro’s environment
awsSecretsManager	aws secretsmanager get-secret-value. jsonKey pulls one field out of a JSON secret; omit it for the whole value

Every command gets 30 seconds. The three CLI kinds quote each argument, so a reference cannot break out into the shell, and they need the tool on PATH, in /usr/local/bin, or in /opt/homebrew/bin.

Editing connections.json by hand costs one extra step. TablePro stamps the file when it writes it, and a file that changed underneath it fails the connect with “Your connections file was changed outside TablePro, so this connection’s password source was not run. Open the connection and save it again to confirm the change.” Save it once from the app and sources run again.

File format

JSON. The envelope needs formatVersion, exportedAt, and appVersion; each connection needs name, host, port, database, username, and type, and an empty string is fine where a value does not apply. Groups and tags match by name and are created when missing. Groups export flat, name and color only. Paths use ~/ so they travel.

{
  "formatVersion": 1,
  "exportedAt": "2026-07-14T09:00:00Z",
  "appVersion": "0.57.0",
  "connections": [
    {
      "name": "Production",
      "host": "db.example.com",
      "port": 3306,
      "database": "app",
      "username": "deploy",
      "type": "MySQL",
      "tagName": "production"
    }
  ],
  "groups": [{ "name": "Backend", "color": "Blue" }],
  "tags": [{ "name": "production", "color": "Red" }]
}