TL;DR — Hetzner Cloud Servers and VPS instances don't come with a database GUI. Instead of installing phpMyAdmin on your server (and opening another attack surface), you can use DBEverywhere to connect to your Hetzner MySQL database from any browser. Add our static IP to your Hetzner Cloud Firewall, enter your credentials, and you're in. No software to install, no Docker container to maintain.

Table of Contents

• The Hetzner MySQL GUI problem
• How developers usually manage Hetzner databases
• Self-hosted phpMyAdmin vs SSH tunnel vs browser-based GUI
• How to connect to your Hetzner MySQL database from a browser
• Setting up Hetzner Cloud Firewall for remote database access
• Hetzner Web Hosting vs Hetzner Cloud: what's different
• Data sovereignty and Hetzner's EU data centers
• FAQ

How to Manage Your Hetzner MySQL Database from a Browser

If you're running MySQL or MariaDB on a Hetzner Cloud Server, you've probably noticed something missing: there's no built-in Hetzner MySQL GUI. No database browser, no query editor, no visual table manager. You get a server, a terminal, and that's it.

This is the trade-off with Hetzner. Their Cloud Servers start at just EUR 3.79/month for a CX22 instance (2 vCPUs, 4 GB RAM), making them one of the most affordable VPS providers in Europe. But unlike managed database platforms that bundle a web dashboard, Hetzner hands you the keys to a Linux box and leaves the rest to you.

For many developers, this means either installing phpMyAdmin directly on the server, setting up an SSH tunnel to a desktop client, or just using the MySQL CLI for everything. None of these options are great. In this guide, we'll walk through a better approach to Hetzner database management — one that gives you a full phpMyAdmin or Adminer interface in your browser without installing anything on your server.

The Hetzner MySQL GUI problem

Hetzner serves over 500,000 customers, with a massive user base across Germany, Finland, and the rest of the EU. Their Cloud Servers are particularly popular with developers who want affordable, self-managed infrastructure. According to Hetzner's own product pages, the CX line offers:

These are powerful enough to run MySQL or MariaDB for production workloads. But once your database is running, how do you actually look at your data?

Hetzner's konsoleH control panel includes a basic phpMyAdmin instance — but only for their web hosting products. If you're on a Cloud Server (which is what most developers use), there's no database GUI at all. You're on your own.

This creates a gap. You have a MySQL server running on port 3306, locked behind a firewall, and no straightforward way to browse tables, run queries, or export data without touching the command line.

How developers usually manage Hetzner databases

There are three common approaches, and each has trade-offs.

1. Install phpMyAdmin on the server. This is the most common approach and probably the worst from a security standpoint. You install Apache/Nginx plus PHP plus phpMyAdmin on the same server as your database. Now you have a web-accessible admin panel sitting at yourserver.com/phpmyadmin that every bot on the internet will find and try to brute-force. You also need to keep phpMyAdmin updated (CVEs are published regularly — phpMyAdmin Security Advisories lists dozens of historical vulnerabilities). And it consumes RAM and CPU on a server that might already be tight.

2. SSH tunnel + desktop client. The secure approach. You open an SSH tunnel (ssh -L 3306:localhost:3306 user@your-hetzner-ip) and connect through a desktop client like MySQL Workbench, DBeaver, or TablePlus. This works well, but requires the client installed on every machine you use. If you're on a tablet, a borrowed laptop, or a machine with restrictive IT policies, you're out of luck. It also means managing SSH keys across devices.

3. Use the MySQL CLI. Fine for quick queries. Not practical for browsing large tables, exporting data, or anything visual. Most developers default to this when the other options feel like too much effort — and then avoid looking at their data entirely.

Self-hosted phpMyAdmin vs SSH tunnel vs browser-based GUI

Here's how the three approaches compare side by side:

The browser-based approach hits a useful middle ground: no software to install, no attack surface on your server, and it works from any device with a browser. The trade-off is that your database needs to accept connections from an external IP — which is where Hetzner's Cloud Firewall comes in.

How to connect to your Hetzner MySQL database from a browser

Here's the step-by-step process using DBEverywhere:

Step 1: Configure MySQL to accept remote connections.

By default, MySQL on most Hetzner servers binds to 127.0.0.1 (localhost only). You need to change this to allow connections from outside the server.

Edit your MySQL configuration file:

sudo nano /etc/mysql/mysql.conf.d/mysqld.cnf

Find the bind-address line and change it:

# Before
bind-address = 127.0.0.1

# After
bind-address = 0.0.0.0

Then restart MySQL:

sudo systemctl restart mysql

Step 2: Create a MySQL user for remote access.

Don't use your root account. Create a dedicated user that can only connect from DBEverywhere's static IP:

CREATE USER 'dbeverywhere'@'<DBEverywhere-IP>' IDENTIFIED BY 'your-strong-password';
GRANT ALL PRIVILEGES ON your_database.* TO 'dbeverywhere'@'<DBEverywhere-IP>';
FLUSH PRIVILEGES;

You'll find the current static IP on the DBEverywhere dashboard after signing up. Restricting the MySQL user to that IP adds an extra layer of security on top of the firewall rule.

Step 3: Whitelist the static IP in Hetzner Cloud Firewall.

This is the critical step. See the next section for the full walkthrough.

Step 4: Connect through DBEverywhere.

1. Go to dbeverywhere.com and sign up (free tier gives you 5 sessions/month).
2. Click Connect.
3. Enter your Hetzner server's public IP, port 3306, the MySQL username and password you just created, and your database name.
4. Click Connect — you'll have a full phpMyAdmin or Adminer interface in your browser.

Your credentials are used to establish the session and are not stored unless you explicitly opt in (a paid-tier feature for saved connections).

Setting up Hetzner Cloud Firewall for remote database access

Hetzner Cloud Firewalls are free and configured through the Hetzner Cloud Console. Here's how to add a rule for DBEverywhere:

1. Log in to the Hetzner Cloud Console.
2. Go to Firewalls in the left sidebar (under Networking).
3. Select your existing firewall or click Create Firewall.
4. Click Add Rule with the following settings:
5. Direction: Inbound
6. Protocol: TCP
7. Port: 3306
8. Source IP: <DBEverywhere-IP>/32
9. Description: "DBEverywhere — browser database access"
10. Click Apply.
11. Make sure the firewall is applied to your server (under the "Apply to" tab).

The /32 CIDR notation means only that single IP address is allowed. No range, no wildcards. Your MySQL port is now accessible from exactly one IP in the world — the DBEverywhere gateway.

For more details on Hetzner's firewall configuration, see the Hetzner Cloud Firewall documentation.

Important: If you're using ufw or iptables on the server itself (in addition to the Hetzner Cloud Firewall), you'll need to add a matching rule there too:

sudo ufw allow from <DBEverywhere-IP> to any port 3306

Hetzner Cloud Firewalls operate at the network level (before traffic reaches your server), while ufw operates at the OS level. Both need to allow the connection.

Hetzner Web Hosting vs Hetzner Cloud: what's different

Hetzner offers two very different products, and the database management story is different for each.

Hetzner Web Hosting (konsoleH) includes a bundled phpMyAdmin instance. If you're on a web hosting plan, you can access your databases through konsoleH without any additional setup. However, these are shared hosting environments with limited control — you can't install custom software, configure firewalls granularly, or run anything beyond PHP/MySQL.

Hetzner Cloud (Cloud Servers, Dedicated Servers) gives you a full Linux server with root access. You have complete control but zero database tooling out of the box. This is where the gap exists and where a browser-based tool like DBEverywhere makes the most sense.

If you're reading this article, you're almost certainly on Hetzner Cloud. The developers who need a Hetzner phpMyAdmin alternative are the ones running self-managed MySQL on cloud servers — not the ones on shared hosting where phpMyAdmin is already provided.

Hetzner also doesn't currently offer a managed database service (unlike DigitalOcean's Managed Databases or AWS RDS). This means every MySQL instance on Hetzner Cloud is self-managed: you install it, you configure it, you back it up, and you figure out how to access it.

Data sovereignty and Hetzner's EU data centers

One reason many developers choose Hetzner is data sovereignty. Hetzner operates data centers in:

• Falkenstein, Germany
• Nuremberg, Germany
• Helsinki, Finland
• Ashburn, USA (newer addition)

For EU-based companies dealing with GDPR requirements, keeping data in German or Finnish data centers can simplify compliance. Your database stays on Hetzner's EU infrastructure. When you connect through DBEverywhere, the connection is established in real time — your actual data remains in your database. DBEverywhere acts as a gateway, not a data store.

This matters because some database tools require you to sync or cache data locally. Desktop clients pull query results to your machine (which might be anywhere). Browser-based access through a gateway keeps the data flow between the gateway and your server, with only the rendered interface reaching your browser.

If data residency is a concern for your organization, you can also restrict your MySQL user to only accept connections from DBEverywhere's static IP (as shown in Step 2 above), ensuring no other path exists to your database.

FAQ

Can I use DBEverywhere with MariaDB on Hetzner?

Yes. MariaDB is wire-compatible with MySQL, and phpMyAdmin works with both. Many Hetzner users run MariaDB instead of MySQL (it's the default on some Linux distributions). The connection process is identical — same port (3306), same protocol, same firewall rules.

Is it safe to open port 3306 on my Hetzner server?

Opening port 3306 to the entire internet would be dangerous. But you're not doing that. You're opening it to a single IP address using Hetzner's Cloud Firewall. Combined with a strong MySQL password and a dedicated user restricted to that IP, this is comparable in security to an SSH tunnel — the connection is encrypted with TLS, and the attack surface is limited to one known address. See our security overview for more detail.

What if my Hetzner server is behind a private network (vSwitch)?

If your MySQL server is on a Hetzner private network (vSwitch or Cloud Network) with no public IP, you'll need an SSH tunnel to reach it. DBEverywhere's paid tier ($5/month) supports SSH tunnel connections — you provide your bastion host's public IP and SSH credentials, and DBEverywhere tunnels through to your private database. This is common in production setups where the database server is deliberately isolated from the public internet.

Does DBEverywhere work with Hetzner's Robot (dedicated servers)?

Yes. Hetzner Robot dedicated servers work the same way as Cloud Servers for this purpose. You'll configure your OS-level firewall (ufw or iptables) to allow DBEverywhere's static IP on port 3306, since Robot servers don't use Hetzner Cloud Firewalls. Everything else — MySQL user creation, the connection process — is the same.

How many databases can I manage?

The free tier gives you 5 sessions per month with a 20-minute timeout per session. Each session connects to one database, but you can start a new session to connect to a different database (or the same one again). The paid tier ($5/month) gives you unlimited sessions with an 8-hour timeout, plus the ability to save connection details so you don't have to re-enter credentials each time.

Conclusion

Hetzner gives you excellent infrastructure at a hard-to-beat price. What it doesn't give you is a Hetzner MySQL GUI. For developers running self-managed MySQL or MariaDB on Hetzner Cloud Servers, the choice has traditionally been: install phpMyAdmin on the server and accept the security risk, set up SSH tunnels on every device you use, or just avoid looking at your data.

DBEverywhere fills that gap. Add one IP to your Hetzner Cloud Firewall, and you get a full phpMyAdmin or Adminer interface from any browser — no installation, no maintenance, no exposed admin panels. The free tier is enough for occasional database checks. The paid tier at $5/month handles daily use with saved connections and SSH tunnel support.

Your Hetzner server should run your application and your database. It shouldn't also run a database admin tool that you have to keep patched and secured. Let it do what it's good at, and manage your data from the browser.

Try DBEverywhere free -- connect to your Hetzner database in 60 seconds