Oracle Database

Connect to Oracle Database with TablePro

TablePro supports Oracle Database 11.1 and later. It speaks the Oracle TNS wire protocol directly in Swift, so no Oracle Instant Client or other external library is required. This covers Oracle Database instances running on-premises, in Docker, or Oracle Cloud.

Oracle 10g and earlier are not supported: they use the older O3LOGON handshake that the pure-Swift driver does not implement.

Servers behind a RAC SCAN listener, shared server, or a load balancer are supported: TablePro follows the listener’s redirect to the instance that serves the session. Servers that require Native Network Encryption (SQLNET.ENCRYPTION_SERVER or SQLNET.CRYPTO_CHECKSUM_SERVER set to REQUIRED) are also supported: TablePro offers AES encryption with a SHA crypto-checksum to every server and the server turns it on when required, the same as SQL Developer and DBeaver. There is no option to configure.

On iPhone and iPad

TablePro Mobile connects to Oracle too. The driver is built into the app, so there is no plugin to install. Enter host, port, username, password, and either a service name or a SID, and pick an SSL mode. You can browse schemas, tables, columns, indexes, and foreign keys, run queries, and edit rows.

Two things stay Mac-only: creating or altering tables and triggers, and certificate files. Certificates live on the device that created the connection and do not sync, so a connection set up on your Mac with a CA or client certificate reports that the file is missing when you open it on iPhone. Clear the certificate path and the verify modes fall back to the system trust store, which is all a publicly trusted server such as Oracle Autonomous Database needs.

Install Plugin

The Oracle driver is a downloadable plugin on macOS. When you select Oracle in the connection form, TablePro prompts you to install it. You can also install it manually:

1. Open Settings > Plugins > Browse
2. Find Oracle Driver and click Install
3. The plugin downloads and loads immediately, no restart needed

Connection Settings

Enter host, port, username, password, and service name, then click Save & Connect.

Field	Default	Notes
Host	localhost
Port	1521	Listener port
Service Name	-	Required. Check tnsnames.ora if unclear. To connect by SID instead, set Connection Type to SID and enter the SID.
Username	-	Requires username/password auth (no OS auth)
Role	Normal	Set to SYSDBA or SYSOPER for an administrative logon. The account needs the matching privilege, and Oracle treats the session as SYS rather than as the user you signed in with.

Oracle connection form

Example Configurations

Local (Oracle XE): host localhost:1521, user system, service XEPDB1

Docker: gvenzl/oracle-xe:21-slim image, same config as local

Remote: Standard host/port/credentials, service name from DBA

Oracle Cloud (ADB): Copy host, port, and service name (format mydb_tp) from the TLS connection string in the Oracle Cloud Console, then set SSL mode to Required (or Verify CA with the CA certificate). TablePro connects with one-way TLS and does not read Oracle wallet files.

This needs the database to allow TLS without mutual TLS, which means setting Mutual TLS (mTLS) authentication to Not Required and giving the database an access control list or a private endpoint. Oracle rejects the connection otherwise. Use the TLS connection string, not the mTLS one: mTLS is served on port 1522 only, while TLS is on 1521 or 1522.

If you have an older wallet that stopped working, this is the path to switch to. Oracle’s DigiCert G1 roots were distrusted in April 2026, so ADB wallets generated on or before 28 January 2026 no longer connect. One-way TLS is unaffected.

SSL/TLS

OracleNIO has no TLS fallback. Preferred connects in plain TCP (the SSL pane shows a warning). Use Required for TCPS, Verify CA with a CA certificate path for strict validation. See SSL/TLS for details.

Connection URL

oracle://user:password@host:1521/service_name

See Connection URL Reference for all parameters.

Features

Schema Selection: Each user is a schema. The sidebar lists every schema and loads a schema’s tables when you expand it. Switch the active schema with Cmd+K or the Schema toolbar button.

Table Info: Structure (columns, types, nullability, primary keys), indexes, foreign keys, and CREATE TABLE DDL.

Query Editor: SQL and PL/SQL (anonymous blocks). Pagination uses OFFSET/FETCH syntax:

SELECT *
FROM hr.employees
ORDER BY employee_id
OFFSET 0 ROWS FETCH NEXT 50 ROWS ONLY;

Schema Editing: ALTER TABLE with double quotes for case-sensitive names. Supports ADD, RENAME COLUMN, MODIFY, DROP, CREATE INDEX.

Auth Compatibility

TablePro authenticates via OracleNIO, a pure-Swift implementation of the Oracle TNS wire protocol (no Oracle Instant Client needed). Username and password are the only credentials it accepts; OS auth and Oracle wallets are not supported. Create a user with:

CREATE USER app_user IDENTIFIED BY "Password1!";
GRANT CREATE SESSION, SELECT ANY TABLE TO app_user;

dba_users.password_versions	Status
12C only (recommended)	✓ Supported
11G 12C	✓ Supported
10G 11G 12C	✓ Supported
10G 11G (legacy migration)	✓ Supported
10G only (deprecated)	✓ Supported, but consider rotation
External / Kerberos / LDAP-managed	✗ Not supported. File an issue.

10G hash is supported for compatibility with legacy environments. It uses DES-based hashing without modern salting and is deprecated by Oracle. Rotate affected accounts under modern auth so password_versions contains only 11G or 12C:

ALTER USER <USER> IDENTIFIED BY <new-secure-password>;
SELECT username, password_versions FROM dba_users WHERE username = '<USER>';

If the connection fails with “Unsupported Password Verifier”, check password_versions first. “Server Version Not Supported” means the database is older than 11.1 (10g or earlier), which the driver cannot connect to.

Column Type Support

Oracle type	Display
VARCHAR2, NVARCHAR2, CHAR, NCHAR, LONG, CLOB, NCLOB, JSON	Text as stored
NUMBER	Exact integer up to Int64 range; decimals up to 17 digits of precision
BINARY_FLOAT, BINARY_DOUBLE	Native Swift Float/Double
DATE	yyyy-MM-dd
TIMESTAMP	ISO-8601 in UTC with fractional seconds
TIMESTAMP WITH TIME ZONE	ISO-8601 in the host’s local time zone with explicit offset
TIMESTAMP WITH LOCAL TIME ZONE	ISO-8601 in the host’s local time zone with explicit offset
INTERVAL DAY TO SECOND	D HH:MM:SS plus fractional seconds when non-zero (up to 9 digits, trailing zeros trimmed)
INTERVAL YEAR TO MONTH	Y-MM
RAW, LONG RAW, BLOB	Lowercase hex, truncated to 4 KB
ROWID	As stored
BOOLEAN	true / false
BFILE	<bfile> placeholder (locator only)

Columns with types not yet supported render as <unsupported: type> rather than crashing or corrupting data. Report unsupported types via GitHub Issues.

Limitations

• Username and password auth only. No OS auth, wallets, Kerberos, or LDAP.
• BFILE columns show the locator only. Fetching content through DBMS_LOB is not supported.
• PL/SQL runs as anonymous blocks only.

Troubleshooting

Connection refused: check the listener is running with lsnrctl status, confirm port 1521 is open, and on Docker confirm the container is up (docker start oracle-xe).

Invalid service name: confirm the service exists with SELECT value FROM v$parameter WHERE name = 'service_names';, or list what the listener serves with lsnrctl services.

Connection dropped during handshake: the server closed the connection mid-login. The error dialog shows the handshake phase it stopped at (for example advancedNegotiation, dataTypeNegotiation, or authentication). Check for a firewall, VPN, or proxy that resets traffic, and confirm the host and port reach the listener directly.

Native network encryption not completed: the server requires native network encryption and the negotiation did not finish. The server likely requires an encryption or checksum algorithm the driver does not support; the error dialog shows the reason. File an issue with your Oracle version and that reason. For encryption in transit you can also use TLS by setting an SSL mode in the SSL settings.

Login handshake timed out: the TCP connection is accepted but login never finishes, so the connect stops after 30 seconds instead of waiting for the server to reset. Check for a firewall, VPN, or proxy that stalls traffic after the TCP handshake, and confirm the host and port reach the listener directly.