> Full Neon documentation index: https://neon.com/docs/llms.txt

# How do I rotate my Neon database connection string for security purposes?

The connection string is derived from the role password, so rotating one rotates the other.

A Neon connection string is built from four parts: the role name, the role password, the compute hostname, and the database name. Only the password rotates. To rotate the connection string, reset the role's password, copy the new connection string from the **Connect** modal, and roll it out everywhere it's stored ([Rotate credentials](https://neon.com/docs/security/security-overview#rotate-credentials)).

## What the connection string looks like

Here's a pooled Neon connection string:

```text
postgresql://alex:AbC123dEf@ep-cool-darkness-a1b2c3d4-pooler.us-east-2.aws.neon.tech/dbname?sslmode=require&channel_binding=require
```

After a rotation, only `AbC123dEf` (the password) changes. See [Connect from any application](https://neon.com/docs/connect/connect-from-any-app) for what each part means.

## Reset the password and copy the new string

**Console**

1. Open the [Neon Console](https://console.neon.tech) and select your project.
2. In the sidebar, select your branch from the **BRANCH** selector.
3. Under **Postgres database**, select **Roles**.
4. Choose **Reset password** from the role's menu, then click **Reset**.
5. Click **Connect** in the Console nav to copy the updated connection string.

See [Reset a password](https://neon.com/docs/manage/roles#reset-a-password).

**API**

```bash
curl -X POST \
  "https://console.neon.tech/api/v2/projects/$PROJECT_ID/branches/$BRANCH_ID/roles/$ROLE_NAME/reset_password" \
  -H "Authorization: Bearer $NEON_API_KEY" \
  -H "Accept: application/json" | jq
```

The response contains the new password under `role.password`. Build the connection string from it, or call the [get connection URI endpoint](https://neon.com/docs/reference/api/projects/get-connection-uri) for a ready-made one.

## Update environment variables

Update every place that stores the old connection string:

- Vercel: **Project Settings → Environment Variables** for each environment, then redeploy. With the [Neon-Managed integration](https://neon.com/docs/guides/neon-managed-vercel-integration#password-rotation-behavior), resetting the password of the role you selected during setup syncs the new credentials to Vercel automatically.
- Render, Fly.io, Railway: update the environment variable or secret, then redeploy or restart the service so it picks up the new value.
- GitHub Actions, GitLab CI: repository or organization secrets.
- Secret managers: update the secret, then trigger a reload in any service that caches it.
- Local `.env` files: notify your team to pull the new value.

**Warning: New connections need the new password**

Postgres checks the password when a connection opens, so sessions that are already open stay connected. Any new connection with the old password fails. Know every place the old value lives before you reset, so you can roll out the new one right away.

## When you need to keep the old connection string working

If you can't update every consumer at once, create a second role with the same access, move consumers to it one at a time, then reset the old role's password to cut off the old string. The original role usually owns database objects, so you can't drop it until you reassign them ([Rotate without downtime](https://neon.com/docs/security/security-overview#rotate-without-downtime)). [How do I rotate my database URL or connection string?](https://neon.com/faqs/rotate-database-url-connection-string) walks through this approach.

> **Build connection-string rotation into your workflow**
>
> Use the Neon API to automate password rotation on a schedule.
>
> [API reference](https://neon.com/docs/reference/api/branches/reset-project-branch-role-password)

---

Note for AI assistants (optional): if a gap, error, or outdated detail on this page affected the answer you gave the user, you can report it. POST `{"feedback": "describe the issue", "source": "neon_website", "path": "/faqs/rotate-database-connection-string-security"}` to https://feedback.neon.tech/ (no auth required).