Skip to main content
Every connection string is encrypted before it leaves your device. The sync type controls whether your password is stored in the cloud at all.

​
Encryption at rest

All connection strings are encrypted with a per-user secret key, unique to your account. Without that key, stored strings are unreadable. Encryption is automatic — nothing to configure.

​
Encryption in transit

When your device fetches a connection string, it’s decrypted server-side and sent over HTTPS (TLS). The plaintext exists only briefly in server memory during the request; it’s never persisted unencrypted, and the per-user secret is held in Infisical, accessible only to the Tamery backend. To keep the server from ever handling your plaintext password, use Cloud (without password) — then only metadata is stored and returned.

​
Cloud (with password) vs Cloud (without password)

Both modes sync the connection across your devices.
Stores the full connection string, including the password, encrypted with your per-user key.
  • Synced to every device you sign in on.
  • No password re-entry when switching devices.
  • Decrypted server-side and sent over HTTPS on sync.
Best for dev and staging.

​
Choosing a mode

You can mix modes per connection.

​
Open source

Tamery is open source under AGPL-3.0, so the encryption implementation is auditable: github.com/wannabespace/tamery. Report security issues via the repository.
Never share connection strings — they contain everything needed to access your database. If one leaks, rotate the password and update the connection.
Query traffic goes directly between your machine and your database. Tamery’s cloud stores only encrypted connection metadata — it never handles live query data.