How do I rotate my database password in Neon after a security incident?

Quick answer

In Neon, rotating a password means resetting the password for the affected Postgres role. You can do this from the Neon Console (Branches → branch → Roles & Databases → Reset password), through the Neon API, or with an SQL ALTER ROLE statement. A Console or API reset generates a new password immediately. Copy the updated connection string from the Connect modal. Any new connection attempt using the old password fails to authenticate.

Reset the password

Pick the interface that matches your workflow. The result is the same: a new password and a new connection string.

ConsoleAPISQL

1. Open the Neon Console and select your project.
2. Go to Branches and select the branch where the role lives (usually production or main).
3. On the Roles & Databases tab, open the role menu and choose Reset password.
4. Confirm. Neon shows the new password once. Copy it.
5. Click Connect on the Project Dashboard to copy the updated connection string.

See Reset a password for screenshots.

Update your applications

A new password produces a new connection string. Any process still using the old DATABASE_URL will fail to authenticate on its next connection attempt.

Update the connection string everywhere it's stored:

• Vercel, Render, Fly, Railway, or other deploy targets: project Environment Variables
• GitHub Actions or CI secrets
• Local .env files
• Secret managers (AWS Secrets Manager, Doppler, 1Password, etc.)
• Long-running workers, cron jobs, and background services

If the leak might have exposed more than one role, see How do I rotate all my Neon database credentials after a breach?.