In the case where your application and database are running on the same server, you can eliminate the database password entirely by running the application in a

In the case where your application and database are running on the same server, you can eliminate the database password entirely by running the application in a separate user account [1] and running your database on a UNIX socket [2] with peer authentication [3]. [1] You should really be running your web application in its own user account regardless of how you interface to your database. [2] Running daemons on a UNIX socket is better security-wise than running on localhost, because you can protect the UNIX socket with filesystem permissions. [3] http://www.postgresql.org/docs/9.3/static/auth-methods.html#AUTH-PEER http://www.postgresql.org/docs/9.3/static/auth-methods.html#...