Postgres ACL decoder

Paste the privilege string. Get one row per role, in words.

Paste what relacl or the "Access privileges" column shows. It is read in your browser and not sent anywhere.

Role	Privileges	Data API	Granted by
`postgres`	INSERT, SELECT, UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER, MAINTAIN	SELECT, INSERT, UPDATE, DELETE	`postgres`
`anon`	TRUNCATE, REFERENCES, TRIGGER, MAINTAIN	none: requests as this role get 42501	`postgres`
`authenticated`	INSERT, SELECT, UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER, MAINTAIN	SELECT, INSERT, UPDATE, DELETE	`postgres`
`service_role`	INSERT, SELECT, UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER, MAINTAIN	SELECT, INSERT, UPDATE, DELETE	`postgres`

The sample is a table created after Supabase's change: anon holds only the four privileges the Data API does not use, so requests as anon get 42501.

How to read one entry

Each entry has the form grantee=letters/grantor. An empty name before the equals sign means PUBLIC, which is every role. A star after a letter means that privilege was given with grant option. The PostgreSQL manual's own example: calvin=r*w/hobbes gives calvin SELECT with grant option and UPDATE, both granted by hobbes.

Every letter

Letter	Privilege	Applies to
`r`	SELECT	Table, column, sequence, large object
`a`	INSERT	Table, column
`w`	UPDATE	Table, column, sequence, large object
`d`	DELETE	Table
`D`	TRUNCATE	Table
`x`	REFERENCES	Table, column
`t`	TRIGGER	Table
`m`	MAINTAIN	Table
`C`	CREATE	Database, schema, tablespace
`c`	CONNECT	Database
`T`	TEMPORARY	Database
`X`	EXECUTE	Function, procedure
`U`	USAGE	Schema, sequence, type, domain, language, foreign data wrapper, foreign server
`s`	SET	Parameter
`A`	ALTER SYSTEM	Parameter

Where to get the string

select relname, relacl
from pg_class
where relnamespace = 'public'::regnamespace
  and relkind in ('r', 'p', 'v');

An empty relacl means nobody has run a grant or revoke on the object yet: the owner has everything and other roles have nothing on a table.

Three strings you will meet on Supabase

ACL entry	Reads as	Through the Data API
`anon=arwdDxtm/postgres`	Every table privilege (the old automatic default on Postgres 17).	Reachable. Row level security is the only filter.
`anon=Dxtm/postgres`	TRUNCATE, REFERENCES, TRIGGER, MAINTAIN. No SELECT, INSERT, UPDATE or DELETE.	42501 for every request. This is a new table after the change.
`anon=r/postgres`	SELECT only.	Reads work. Writes get 42501.

Supabase documents the middle case: New tables keep truncate, references, trigger, and maintain, and new sequences keep update. We ran the same revoke in our test and decoded the result with this page's decoder.

Write the fix for your tables

One table is free. The whole schema with a rollback file is $9 one-time.

Paste schema SQL or table names

Waiting for a paste.

Who can reach each table

Your tables show up here, one row each, with a choice of who can reach them.

Start clean: revoke older grants from anon and authenticated first, as the Supabase guide does.

The SQL appears here as soon as a table is found.

Parsed in your browser. Your SQL is never uploaded, and no site or database is scanned.

Questions

What does arwdDxt stand for?

INSERT (a, "append"), SELECT (r, "read"), UPDATE (w, "write"), DELETE (d), TRUNCATE (D), REFERENCES (x) and TRIGGER (t). Postgres 17 adds m for MAINTAIN, so a full table entry there reads arwdDxtm.

Why is the role name empty in "=r/postgres"?

An empty grantee is PUBLIC, the pseudo-role that stands for every role in the database.

Does this page send my ACL anywhere?

No. The string is decoded by the script in this page. The site records only that the decoder was used and how many entries it found.

Sources

PostgreSQL manual: Privileges, read 2026-11-10
Supabase docs: Securing your API, read 2026-11-10
Our own test: the behaviour the reference pages describe, run against PGlite, read 2026-11-10