How to give pg_dump a password on Windows (pgpass.conf, PGPASSWORD)

pg_dump has no --password=… option on purpose: anything on a command line can be read by other programs listing processes. You have three ways to give it a password, and one of them is right for scheduled backups.

Option 1: The password file (pgpass.conf), best for schedules

PostgreSQL's client tools look for a password file. On Windows the default location is:

%APPDATA%\postgresql\pgpass.conf

That's C:\Users\<you>\AppData\Roaming\postgresql\pgpass.conf. Note pgpass.conf, not .pgpass as on Linux. Create the folder if it doesn't exist. Each line is:

hostname:port:database:username:password

for example:

localhost:5432:shop:postgres:s3cret
db.example.com:5432:*:backup_user:another-password

* matches anything in that field. The first line that matches the connection wins, so put specific lines before wildcard ones.

Escaping

If the password (or any field) contains : or \, put a backslash before it: the password a:b\c is written a\:b\\c.

The encoding trap

Windows PowerShell 5.1's Set-Content -Encoding UTF8 and Notepad's older "UTF-8" option add a byte-order mark to the start of the file. libpq reads it as part of the first host name, the first line never matches, and pg_dump asks for a password as if the file didn't exist. Write the file as ASCII (or "UTF-8" without BOM):

$dir = "$env:APPDATA\postgresql"
New-Item -ItemType Directory -Force $dir | Out-Null
Set-Content -Path "$dir\pgpass.conf" -Encoding Ascii -Value 'localhost:5432:shop:postgres:s3cret'

Scheduled tasks and other accounts

%APPDATA% belongs to whoever is running the program. A task running as SYSTEM has a different profile, so it never finds the file in yours. Point the tools at a file explicitly with the PGPASSFILE environment variable:

$env:PGPASSFILE = 'C:\ProgramData\pg-backup\pgpass.conf'

Keep that folder readable only by SYSTEM, Administrators and you:

icacls 'C:\ProgramData\pg-backup' /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' "${env:USERNAME}:(OI)(CI)F"

On Linux, libpq ignores a password file that others can read. On Windows it doesn't check permissions, so locking the folder down is up to you.

Option 2: The PGPASSWORD environment variable

$env:PGPASSWORD = 's3cret'
pg_dump -h localhost -U postgres -F c -f shop.dump shop
Remove-Item Env:PGPASSWORD

Fine for a quick one-off in your own terminal. In a script, the password then sits in the script file in plain text. Use a password file instead.

Option 3: Type it when asked

Without either, pg_dump prompts. In scripts, always add -w (--no-password) so a missing password fails immediately rather than hanging forever on a prompt nobody will answer.

Still being asked for a password?

• Check the file name and folder: pgpass.conf in %APPDATA%\postgresql, or the exact path in PGPASSFILE.
• Check for the byte-order mark: Format-Hex "$env:APPDATA\postgresql\pgpass.conf" | Select-Object -First 1. If it starts with EF BB BF, rewrite it as ASCII.
• Match the host exactly as you typed it: localhost and 127.0.0.1 are different strings to libpq.
• Include the right port. A Supabase pooler on 5432 and a DigitalOcean cluster on 25060 need their own ports in the line.
• A password authentication failed error (rather than a prompt) means the file was found but the password is wrong.

How PostgresBackup handles passwords

PostgresBackup saves each server's login once, in a settings folder that only your account, Administrators and its background service can read. Passwords are never shown in the app and never put on a command line: pg_dump gets them through its environment, for the one process that needs them. There's no password file to write, and no encoding to get wrong.