75+ Security & Audit Extensions for PostgreSQL
pgaudit, anon, pgcrypto, pgsodium, and other Postgres extensions for audit logging, encryption, and data anonymization. Ranked by GitHub stars.
AWS RDSprovides auditing functionality
Provides a trigger-based row-level audit log of table changes; intended as a demo and reference rather than production.
Provides a trigger-based row-level audit log of table changes; intended as a demo and reference rather than production.
Postgres extension for libsodium functions
Provides an audit trail with schema versioning using triggers, PL/pgSQL functions, and JSONB delta logging.
Provides an audit trail with schema versioning using triggers, PL/pgSQL functions, and JSONB delta logging.
Extension for logging and monitoring functions in PostgreSQL
Extension for logging and monitoring functions in PostgreSQL
Learns a whitelist of allowed queries by userid and blocks or warns on unrecognized statements to protect against SQL injection.
Learns a whitelist of allowed queries by userid and blocks or warns on unrecognized statements to protect against SQL injection.
PostgreSQL Extension Whitelisting
Extension that secures a cluster on a cloud environment
Extension that secures a cluster on a cloud environment
credcheck - postgresql plain text credential checker
similar to SET ROLE but with added logging
Manage authentication sessions using JWTs
Provides a cryptographically verifiable audit trail by applying blockchain-style Merkle proofs to relational data.
Provides a cryptographically verifiable audit trail by applying blockchain-style Merkle proofs to relational data.
Tracks changes to selected tables in separate _log tables so rows can be queried as they existed at any past timestamp.
Tracks changes to selected tables in separate _log tables so rows can be queried as they existed at any past timestamp.
Exposes OpenSSL's X.509 certificate parser as SQL functions, powering crt.sh-style certificate transparency search.
Exposes OpenSSL's X.509 certificate parser as SQL functions, powering crt.sh-style certificate transparency search.
Provides trigger-based table auditing that stores row diffs as JSONB for easy querying.
Provides trigger-based table auditing that stores row diffs as JSONB for easy querying.
Function for collecting statistics about messages in logfile
Function for collecting statistics about messages in logfile
login_hook - hook to execute login_hook.login() at login time
login_hook - hook to execute login_hook.login() at login time
Exposes the Themis cryptographic library to Postgres for encrypting and decrypting data via Secure Cell and Secure Message primitives.
Exposes the Themis cryptographic library to Postgres for encrypting and decrypting data via Secure Cell and Secure Message primitives.
Provides functions and views to inspect PostgreSQL object access privileges across roles.
Provides functions and views to inspect PostgreSQL object access privileges across roles.
monitor connection attempts per user
The PostgreSQL Antivirus
What is a PostgreSQL Security Extension?
Security extensions add capabilities Postgres core deliberately leaves out — session and statement-level audit logging (pgaudit), data anonymization for development environments (anon), modern encryption primitives (pgsodium goes beyond pgcrypto with libsodium), trusted language extensions for safer multi-tenant deployments (pg_tle), row-level password policies (passwordcheck), and privilege escalation primitives (set_user). They're typically required for compliance frameworks like PCI-DSS, HIPAA, SOC 2, and GDPR — and increasingly expected by enterprise procurement and security review processes.
When to Add a Security Extension
Enable pgaudit when you need to log every DDL or DML operation for compliance — most managed Postgres providers support it out of the box. Use anon when developers need realistic test data without exposing PII to staging environments. Use pgsodium for application-layer encryption at the column level (data-at-rest column-encryption with key management). pgcrypto remains the standard for password hashing and basic crypto operations. Don't pile these on speculatively — each adds latency, audit-log volume, and operational complexity; enable per actual compliance or security requirement.
Frequently Asked Questions
What is pgaudit?
What's the difference between pgcrypto and pgsodium?
How do I anonymize Postgres data for development?
Does pgaudit work on AWS RDS Postgres?
How do I encrypt sensitive columns in Postgres?
Manage PostgreSQL Visually
1bench is a modern GUI client for PostgreSQL — install extensions, write queries, and inspect schemas without leaving the IDE.
Try 1bench for PostgreSQL