What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
When Sequel Pro cannot connect to MySQL, the most common mistake is entering the database’s public name in the wrong field. In Sequel Pro’s SSH mode, the app first logs in to an SSH server and creates a port forward. It then makes an ordinary MySQL TCP connection from that SSH server to the MySQL host.
If MySQL is running on the same server you use for SSH, set MySQL Host to 127.0.0.1 and use the MySQL listener port, normally 3306. Put the server’s public hostname, account, key and SSH port in the separate SSH fields. If the database is on another private machine, use that machine’s private hostname or address as MySQL Host instead.
How Sequel Pro’s SSH connection actually works
Sequel Pro does not make one connection that is simultaneously SSH and MySQL. It performs two linked connections:
- Your Mac opens an SSH session to the SSH host.
- That session forwards a local port to a MySQL TCP port reachable from the SSH host.
- Sequel Pro sends MySQL credentials and queries through the forwarded connection.
This distinction explains most connection errors. SSH Host identifies the machine that accepts your SSH login. MySQL Host identifies the machine the SSH server must contact for MySQL. The value 127.0.0.1 refers to the SSH server from inside the tunnel, not automatically to your Mac.
#1 Best Overall
Remote MySQL access may be disabled by a hosting provider even when web hosting works normally. An SSH tunnel avoids exposing MySQL directly to the public internet, provided the SSH server can reach the database over TCP.
Choose the right connection mode
| Mode | Network path | MySQL Host and port | Encryption boundary | Best use |
|---|---|---|---|---|
| Standard | Mac directly to MySQL | Public or reachable DNS name and MySQL port | Only MySQL TLS, if configured | A database intentionally exposed to your network |
| SSH in Sequel Pro | Mac → SSH host → MySQL | Host as seen from the SSH server; usually 127.0.0.1:3306 |
Mac-to-SSH leg is encrypted; the onward leg needs MySQL TLS when it crosses an untrusted network | A private database reachable through a bastion or server |
| Manual SSH tunnel plus Standard profile | Mac → local forwarded port → SSH host → MySQL | 127.0.0.1 and the local forwarding port, such as 3307 |
Same SSH boundary as built-in mode | GUI key-agent, sandbox or compatibility problems |
Standard mode is simpler, but it requires direct network reachability and can expose a MySQL listener. Built-in SSH mode keeps the client-to-bastion path inside SSH. A manual tunnel uses the same network design while letting Terminal handle SSH.
Think of the fields as describing two different network viewpoints. In a Standard profile, Host is the address your Mac contacts. In an SSH profile, MySQL Host is the address contacted after the SSH login. Reusing one hostname in both fields is correct only when that name resolves appropriately from both locations. A public name that works on your Mac may resolve to a public interface, fail DNS resolution, or be blocked by policy when the bastion tries it.
What you need before configuring Sequel Pro
- An SSH hostname or IP address, SSH username and SSH port. Port
22is common, but providers often change it. - An SSH password or private key that the account is permitted to use.
- The MySQL hostname as viewed from the SSH server. Use
127.0.0.1only when MySQL runs on that same server. - A MySQL username, password and database name, if the account is restricted to a particular database.
- The MySQL TCP port, conventionally
3306, unless the server administrator configured another listener. - Permission for the SSH account to create port forwards and permission for the MySQL account to connect from the relevant host.
Ask your hosting provider or administrator for the actual values rather than assuming the defaults. The conventional ports are useful starting points, not guarantees. A provider may assign a different SSH port, and MySQL may listen on a nonstandard port or on a private interface.
First test the SSH leg independently. In Terminal, use the same host, user, port and key you intend to enter in Sequel Pro:
ssh -p 22 username@example-serverReplace the port and hostname with your provider’s values. If this command fails, Sequel Pro cannot repair the SSH credentials or server-side access; fix that login first. Also note which key Terminal actually uses. A working command that relies on an agent or an SSH configuration entry may not be using the file you select in the graphical client.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Configure Sequel Pro’s built-in SSH tunnel
- Open the SSH connection tab. In Sequel Pro’s connection window, select SSH rather than Standard.
- Fill in the MySQL fields. Enter the database username and password. Set MySQL Host to
127.0.0.1when MySQL is on the SSH server. If the database is on a separate private host, enter its private DNS name or address. Set MySQL Port to the actual TCP listener, normally3306. - Fill in the SSH fields. Set SSH Host to the bastion or server that accepts your SSH login. Enter the login account in SSH User, select the permitted private key or enter the SSH password, and set SSH Port to
22unless your provider specifies another port. - Test the connection. A successful test means both the SSH session and the subsequent MySQL authentication completed. Save the profile only after verifying that the selected key and host are correct.
Do not put the SSH hostname in MySQL Host merely because it is the server’s public name. The database connection is created from inside the SSH server, so a public DNS name may resolve differently there or may be blocked entirely.
Example: MySQL on the SSH server
| Field | Example value |
|---|---|
| MySQL Host | 127.0.0.1 |
| MySQL Port | 3306 |
| MySQL User | Your database account |
| SSH Host | server.example.com |
| SSH User | Your server login account |
| SSH Port | 22, or the provider’s assigned port |
Example: MySQL on another private host
Suppose you SSH to bastion.example.com, while MySQL runs on db.internal. Keep SSH Host as bastion.example.com, but set MySQL Host to db.internal. The bastion must be able to resolve and reach that private name on the selected MySQL port.
Diagnose the most common errors
“SSH port forwarding failed” or “connection refused”
Check the SSH hostname and port first. Then verify the destination from the SSH server’s point of view. A forwarding error can mean that MySQL is stopped, listening only on a different port, bound only to a different interface, blocked by a firewall, or unreachable from the bastion’s network.
Rank #2
After logging in over SSH, test the destination with the tools available on that server. For example:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutenc -vz 127.0.0.1 3306Use the private database hostname instead of 127.0.0.1 when appropriate. A refusal indicates that nothing is accepting TCP connections at that address and port; a timeout usually points to routing or firewall rules. The server administrator may need to enable TCP/IP support, open the internal firewall path, or grant the SSH account forwarding permission.
Do not treat a successful SSH login as proof that forwarding is allowed. An administrator can permit shell access while restricting TCP forwarding, and a bastion can be reachable while having no route to the database subnet. Those are server-side conditions, not Sequel Pro field-formatting problems.
The MySQL Host value is wrong
127.0.0.1 is relative to the machine initiating the second connection: the SSH host. It is correct when the database service is local to that machine. It is incorrect when the database is hosted on a separate private server. In that case, use the private address that the SSH host can reach, not the address your Mac would use.
If the administrator gives you a private DNS name, verify that the bastion can resolve it. If the name resolves to several addresses, the reachable address and firewall policy still determine whether forwarding succeeds. Changing the MySQL Host field cannot create a route that the SSH server does not have.
MySQL uses skip-networking
With skip-networking enabled, MySQL accepts local socket connections but does not listen for TCP clients. Sequel Pro’s normal SSH feature forwards TCP, so it cannot reach a socket-only server. An administrator must enable a TCP listener or provide a specialized socket bridge; changing the Sequel Pro host field alone will not solve this configuration.
This is why a local command-line client on the server may work while the tunnel fails. The local client can use a Unix socket, whereas the forwarded connection still needs a TCP endpoint and listener port.
SSH succeeds, but MySQL authentication fails
SSH authentication and MySQL authentication are independent. A successful server login proves only that the SSH account, key or password is valid. Recheck the database username, password, selected database and the host permissions attached to that MySQL account.
Authentication-plugin compatibility can also matter with older macOS clients and newer MySQL servers. Ask the administrator which authentication plugin is enabled and whether the client version supports it. Do not “fix” a database authentication error by changing SSH credentials. Conversely, changing the MySQL password will not repair a rejected SSH key.
SSL or TLS errors appear after the tunnel opens
An SSH tunnel encrypts the connection between your Mac and the SSH host. It does not automatically encrypt the onward SSH-host-to-MySQL segment. If that segment crosses a network you do not trust, configure MySQL TLS as required by the server and select the corresponding SSL options in the client. A tunnel is transport protection, not a replacement for database-layer encryption.
Separate the two questions: can the SSH session be established, and does the MySQL server accept the requested TLS mode? A TLS error after forwarding starts generally means the SSH leg is functioning and the database-layer settings need review.
SSH works in Terminal but Sequel Pro fails
GUI applications can encounter key-agent, file-permission or macOS sandbox restrictions that do not affect an interactive Terminal session. Use a manual local tunnel and connect Sequel Pro with a Standard profile:
- Open Terminal and create a local forward. This example maps local port
3307to MySQL port3306on the SSH server:
ssh -N -L 3307:127.0.0.1:3306 -p 22 username@example-serverKeep that Terminal process running. If MySQL is on another private host, replace the destination 127.0.0.1 with that host’s private name or address.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- In Sequel Pro, select the Standard tab.
- Set Host to
127.0.0.1and Port to3307. - Enter the normal MySQL username and password, then connect.
This arrangement removes Sequel Pro’s responsibility for starting SSH while preserving the same forwarding path. A local port already in use will prevent the command from starting; choose another unused local port and use that same number in the Standard profile.
The tunnel process must remain alive for the entire database session. Closing Terminal, suspending the SSH process, or losing the SSH connection closes the forwarded path even though the saved Standard profile still appears correct. When you finish, stop the forwarding command rather than leaving an unnecessary tunnel running.
Socket errors occur even though MySQL is local
A Unix socket connection is different from a TCP connection. SSH forwarding carries TCP, not a local socket file. Prefer 127.0.0.1 and the forwarded TCP port when using SSH. Some macOS sandboxed clients also cannot access socket files outside their permitted locations, making TCP the more portable choice.
Verify each side of the tunnel separately
Testing in layers prevents you from changing working settings blindly:
Recommended Free Tools
- SSH reachability: confirm that
ssh -p PORT USER@HOSTlogs in with the intended key or password. - Destination reachability: from that SSH session, check that the chosen MySQL hostname resolves and that its TCP port accepts connections.
- MySQL credentials: confirm the database account independently with an approved MySQL client or with the administrator.
- Sequel Pro mapping: ensure MySQL Host and port describe the destination from the SSH host, while SSH Host and port describe the bastion login.
Keeping these tests separate identifies whether the failure is transport, routing, server configuration or database authentication. Record the working hostnames and ports as you test; this makes it easier to spot when a GUI profile has silently retained an old value.
Security practices for SSH-tunneled MySQL
- Verify the SSH host fingerprint on first connection and investigate unexpected fingerprint changes.
- Protect private keys with appropriate filesystem permissions and a passphrase; do not copy them into shared folders.
- Use a dedicated SSH account with only the forwarding and server access it needs.
- Restrict the MySQL account to the required databases and privileges.
- Use MySQL TLS when the connection from the SSH host to the database traverses an untrusted or shared network.
- Avoid embedding database passwords in connection strings or scripts. MySQL documentation explicitly warns: “Specifying an explicit password in the connection specification is insecure and not recommended.”
Remember that SSH protects the client-to-SSH leg. Anyone who can inspect traffic on an unencrypted onward network segment may still observe that segment unless MySQL TLS is enabled. The tunnel also does not grant additional MySQL privileges: the database server still evaluates the account, password, host permissions and TLS requirements.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When Sequel Pro itself is the problem
Sequel Pro is an older open-source macOS client associated with the project’s 2019 era. Newer macOS sandboxing, key handling and authentication defaults can expose limitations that were not present when the application was maintained.
Sequel Ace is a maintained successor that documents Sequel Pro migration, SSH behavior and workarounds for modern macOS restrictions. Consider moving the saved connection to Sequel Ace when Sequel Pro cannot read an otherwise valid key, cannot access a required socket, or fails while the same SSH command works in Terminal. Migration does not change the network values: you still need the correct SSH host, SSH user, MySQL host as seen from the server, ports and database credentials.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsBefore migrating, reproduce the problem with the manual tunnel. If Sequel Pro connects through the Standard profile at 127.0.0.1 and your chosen local port, the server path and MySQL credentials are probably sound; the built-in SSH implementation or macOS access restrictions are the likely difference. If the manual tunnel also fails, continue investigating routing, listener configuration and authentication instead of changing clients.
Frequently asked questions
Why can’t Sequel Pro connect when my website is working?
Web hosting and MySQL reachability are separate services. A provider may disable public MySQL access while still serving the website. SSH provides a controlled path to a server that can reach the database internally.
What should MySQL Host be in Sequel Pro SSH mode?
Use 127.0.0.1 when MySQL runs on the SSH server. Use the private hostname or address of another database machine when the SSH server must reach that machine.
Should SSH Host and MySQL Host be identical?
Only when the MySQL service is on the same machine and the name is valid from the SSH server. Otherwise SSH Host is the bastion, while MySQL Host is the separate database destination.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can I use port 22 and 3306 automatically?
They are common defaults, not requirements. Confirm the provider’s SSH port and the server’s actual MySQL TCP listener before saving the profile.
Why does a local MySQL socket work but SSH mode fail?
A socket is not a TCP listener. Sequel Pro’s SSH forwarding needs MySQL to accept TCP; a server configured with skip-networking requires an administrator to enable TCP or supply a specialized bridge.
Best Value
Is the MySQL password protected by the SSH tunnel?
The Mac-to-SSH portion is encrypted by SSH. The onward connection from the SSH host to MySQL is not automatically protected by SSH, so use MySQL TLS when that segment is untrusted.
What if Terminal works but the SSH tab does not?
Run a manual ssh -N -L forward, then use a Standard Sequel Pro profile pointed at 127.0.0.1 and the local forwarded port. This bypasses GUI key-agent and sandbox problems.
Does changing the MySQL username fix an SSH error?
No. SSH and MySQL authenticate separately. Change SSH host, user, key or port for an SSH failure; change database credentials or plugin/TLS settings for a MySQL authentication failure.
Final troubleshooting checklist
- Can you log in with SSH using the exact host, user, port and key entered in the client?
- Is MySQL Host set to
127.0.0.1only when MySQL runs on the SSH server? - If MySQL is separate, can the SSH server resolve and reach its private hostname and TCP port?
- Are the MySQL listener port and SSH port correct for this server rather than merely their usual defaults?
- Is MySQL listening on TCP, rather than using
skip-networkingand a socket only? - Do the database username, password, authentication plugin and required TLS settings match the server?
- If the built-in SSH tab fails while Terminal works, does a manual tunnel plus a Standard profile succeed?
Frequently Asked Questions
What should MySQL Host be in Sequel Pro SSH mode?
Use 127.0.0.1 when MySQL runs on the SSH server. For a separate private database, enter the private hostname or address reachable from that SSH server.
Why does SSH work in Terminal but fail in Sequel Pro?
GUI key-agent, file-permission or macOS sandbox restrictions can interfere. Create a manual SSH port forward and connect Sequel Pro with a Standard profile at 127.0.0.1 and the local forwarded port.
Can Sequel Pro tunnel to a MySQL server using skip-networking?
Not with its normal SSH feature, because forwarding requires TCP. An administrator must enable a TCP listener or provide a specialized socket bridge.
Free tools Windows power users keep installed
One-click scans. No signup required.
Is port 3306 always the correct MySQL port?
No. 3306 is conventional. Use the listener port configured by the provider or server administrator.
The Bottom Line
In Sequel Pro SSH mode, separate the two destinations: SSH Host is where your Mac logs in, while MySQL Host is where that SSH server connects. Use 127.0.0.1 only for a database running on the SSH server, verify TCP reachability and credentials independently, and add MySQL TLS when the onward network is not trusted. If the built-in tab fails despite a working Terminal login, a manual SSH tunnel plus a Standard profile—or a maintained client such as Sequel Ace—usually provides the reliable path.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
