> ## Documentation Index
> Fetch the complete documentation index at: https://ngquct-feat-saved-query-version-control.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Redis
> Browse keys by namespace, manage TTLs, and run Redis commands directly from the editor
The sidebar splits keys into folders at every `:`, and each key gets a grid row with its type, TTL, length, and value. The editor takes Redis commands, one per statement, and passes them through as written. Redis needs no plugin: its hiredis-based driver is part of the app, and it reaches standalone servers, Sentinel-managed primaries, and Redis Cluster.
## Quick setup
Click **New Connection…**, select **Redis**, and enter host, port, password, and database index
Click **Test Connection**, then **Save & Connect**
## Connection settings
| Field | Default | Notes |
| ------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------- |
| **Connection Mode** | `Standalone` | `Sentinel` for a Sentinel-managed primary, `Cluster` for a sharded cluster |
| **Host** | `localhost` | Standalone only |
| **Port** | `6379` | Standalone only |
| **Username** | - | Redis 6 ACL user, sent as `AUTH username password`. Empty signs in as `default` |
| **Password** | - | Empty for a server with no `requirepass`, and for a `nopass` ACL user |
| **Database Index** | `0` | Options tab. Type the index or use the stepper; connecting fails with the server's error if it has no such database |
| **Key Separator** | `:` | Options tab. What the sidebar splits key names on |
No minimum server version. ACL users need Redis 6, a Sentinel ACL user needs 6.2, and Cluster mode reads routing tips from Redis 7 where they exist.
The sidebar then lists one entry per database, `db0` upward, counted from the server's own `CONFIG GET databases`. ElastiCache, Azure Cache for Redis and Memorystore refuse `CONFIG`, and so do ACL users without `config|get`; those servers are listed as 16 databases, or up to the highest one `INFO keyspace` names as holding keys. A key count left blank means the server would not answer `INFO` for your user. Click a database to browse it in place, which is also how the database index changes after connecting.
## Connection URL
```text theme={null}
redis://:password@host:6379/0
rediss://:password@host:6380/0
```
`rediss://` connects with TLS. See [Connection URL Reference](/connections/urls).
## Authentication
The Username field selects a Redis 6 ACL user. Empty signs in as `default`, the identity a bare `requirepass` password belongs to.
A username is sent as `AUTH username password` even when Password is empty, which is the form a `nopass` ACL user needs. Every other user rejects that form, so the connection either holds the identity typed into the form or fails.
A `nopass` user accepts any password, so a leftover value in Password still signs in as that user.
## Connection modes
### Standalone
The default. One server, named by Host and Port.
### Sentinel
For a deployment fronted by [Redis Sentinel](https://redis.io/docs/latest/operate/oss_and_stack/management/sentinel/). The quorum says which node is primary and the data connection opens there; a failover is read from the quorum on the next health check and the connection moves itself. A demoted primary keeps answering `role:master` and keeps accepting writes for several seconds, and those writes are lost, so the quorum is the only signal worth trusting.
| Field | Notes |
| ---------------------- | ----------------------------------------------------------------------------------- |
| **Sentinel Nodes** | One or more `host:port` entries. Port defaults to `26379` |
| **Primary Group Name** | The name after `sentinel monitor` in `sentinel.conf`, usually `mymaster` |
| **Sentinel Username** | Under Authentication. Only when Sentinel has its own ACL user |
| **Sentinel Password** | Under Authentication. Only when Sentinel has its own password. Kept in the Keychain |
Host and Port are ignored here. Username and Password under Authentication belong to the primary; Sentinel is a separate plane with its own. The rest of the quorum is discovered at connect and remembered, so a lookup still works once the node you listed goes down. If none can be reached, or none monitors the group you named, the error lists the addresses tried and the groups they do monitor.
### Cluster
For a sharded [Redis Cluster](https://redis.io/docs/latest/operate/oss_and_stack/management/scaling/). The shard map is read with `CLUSTER SHARDS`, or `CLUSTER SLOTS` on Redis 6; a connection opens to every primary and each command goes to the shard that owns its key.
| Field | Notes |
| ---------------------- | ----------------------------------------------------------------------------------------------------------------- |
| **Cluster Seed Nodes** | One or more `host:port` entries. Any reachable member is enough, the rest are discovered. Port defaults to `6379` |
`DBSIZE` is summed across shards, browsing merges their keys into one tree, and `MGET`, `MSET`, `DEL`, `EXISTS`, `TOUCH` and `UNLINK` are split per shard and recombined. When one shard refuses its part, or cannot answer because it is loading or busy running a script, the command reports that shard's error instead of a partial total. Redis cannot undo the part of a split write that already ran, so the error lists the keys it changed, or for `FLUSHDB` the nodes. A shard that denies `DBSIZE` leaves the sidebar key count blank, and on a cluster with more than one database each count is `INFO keyspace` summed across primaries. A `MOVED` re-points the slot and retries, an `ASK` retries against the importing node, and one command follows at most five redirects. What Cluster mode cannot do is under [Limitations](#limitations).
The wrong mode is caught at connect, on Valkey as on Redis: Standalone against a cluster member, or any data mode against a Sentinel port, names the field to change.
## Amazon ElastiCache (IAM)
Set **Authentication** to an AWS IAM mode (Access Key, Profile, or SSO). A short-lived IAM token becomes the Redis password and the username is your IAM-enabled Redis user. Enter the AWS region and the cache name (replication group ID), and turn TLS on, which ElastiCache IAM requires. Profiles resolve from `~/.aws/config` and `~/.aws/credentials`, `credential_process`, SSO, and assumed roles included.
## Browsing keys
`user:1` and `user:2` sit under a `user` folder, nested as deep as the key goes (`app:cache:session:1`). Change the separator on the Options tab. When the tree cannot load, the server's error takes its place; right-click **Keys** and choose **Refresh** to try again.
The grid columns are **Key**, **Type**, **TTL**, **Length**, and **Value**. Value is a preview for everything but a string; Length is what Redis reports, so the two together say how much is missing.
| Type | Value column | Length column |
| ---------- | ----------------------------------- | ------------------ |
| String | The entire value, however long | `STRLEN`, in bytes |
| Hash | First 100 fields, as a JSON object | `HLEN` |
| List | First 100 elements, as a JSON array | `LLEN` |
| Set | First 100 members, as a JSON array | `SCARD` |
| Sorted set | First 100 `[member, score]` pairs | `ZCARD` |
| Stream | Newest 5 entries, as `[id, fields]` | `XLEN` |
A value that is not valid UTF-8, such as a gzip or MessagePack payload, opens in the hex editor instead of as text.
A **Type**, **TTL**, **Length** or **Value** cell is NULL when the server will not say for your user. ACL key patterns do not filter `SCAN`, so a user limited to `~app:*` still sees every key name, and editing **Value** is skipped for a key whose **Type** is NULL.
### Editing
Editing a **Key** cell runs `RENAME`. Editing a **TTL** cell runs `EXPIRE`, or `PERSIST` when you set it to `-1`; in that column `-1` means no expiry and `-2` means the key is gone. Editing a **Value** cell runs `SET`, and only on a string, since a preview of a hash or list is not the whole structure.
Change the other types with a command: `HSET myhash field1 "value1"` rewrites one field and leaves the rest alone. Adding a row does follow the type you pick, generating `HSET`, `RPUSH`, `SADD`, `ZADD`, or `SET`.
### Filtering
Toggle the filter bar to search keys by pattern. Patterns are Redis glob (`*` any sequence, `?` one character, `[ae]` a character set) and case-sensitive, as in `redis-cli`. The type scope narrows to String, Hash, List, Set, Sorted Set, or Stream. Matching runs server-side with `SCAN MATCH` and `SCAN TYPE`.
## Redis CLI
Each statement is one command; separate several with `;`. Commands the driver does not recognize go through too, and only the result formatting is type-aware. A recognized command with arguments its result view does not model, such as `FLUSHDB ASYNC` or `CONFIG SET a 1 b 2`, is also sent exactly as typed, so the server answers it as `redis-cli` would. Arguments are quoted the way `redis-cli` quotes them, so `"` and `'` both work and `\xHH` writes a raw byte; unbalanced quotes are rejected rather than guessed at. Redis has no comment syntax and none is stripped, so a `--` or `#` line is sent to the server and fails.
```redis theme={null}
SET mykey "hello" EX 60
HGETALL myhash; LRANGE mylist 0 -1
SCAN 0 MATCH user:* COUNT 100
```
`SELECT` moves the editor's session only. The commands after it run on that database, while the sidebar, the key tree and the database tab stay on the database you clicked. Clicking a database moves the editor to that database.
`DB 3 GET key` runs one command on database 3 and leaves the session where it was. A key opened from the tree is read this way, and so are grid saves on a cluster.
### MULTI blocks
A command sent after `MULTI` answers `QUEUED` instead of its own reply, and nothing runs until `EXEC`. `EXEC` then returns every reply in order, errors included; an error element reads `(error) WRONGTYPE …`, the way `redis-cli` prints one.
The rest of the app reads the same session, so while the block is open it sends nothing of its own on it. The sidebar, the key browser, the key tree and a database click say the block is open instead, and the connection check skips its `PING`. Run `EXEC` or `DISCARD` to get them back. Saving grid edits is refused while keys are watched; run `EXEC`, `DISCARD` or `UNWATCH` first.
If the connection drops while a block is open or keys are watched, the server discards both. The next command reports the lost block or `WATCH` instead of running on the new session, and an `EXEC` the connection dropped under reports that whether the block ran is unknown.
## SSL/TLS
Set this in the **SSL/TLS** pane. Upstash, Redis Cloud and the like require TLS; `rediss://` turns it on when importing a URL.
| Mode | hiredis behavior | Use for |
| -------------------------- | ---------------------------------- | ------------------------------------------- |
| **Disabled** | Plain TCP | Local dev |
| **Preferred** | TLS, do not verify peer | Same as Required here; there is no fallback |
| **Required (skip verify)** | TLS, do not verify peer | Self-signed certs, Upstash, untrusted CAs |
| **Verify CA** | TLS, verify peer with your CA cert | Private PKI; supply the CA path |
| **Verify Identity** | Same as Verify CA | Redis does no separate hostname check |
New connections default to **Disabled**. SNI is sent in every TLS mode.
## Limitations
* A command that fails while `EXEC` is running cannot be taken back. Standalone and Sentinel wrap a grid save in `MULTI`/`EXEC`, so the rest of the block stays applied and the error names the one that failed; check the keys it touched. A command refused before it runs, for a missing ACL permission, a full `maxmemory` or wrong arity, aborts the block and writes nothing.
* No transactions in Cluster mode. Grid saves run their commands one at a time, so a failure leaves the earlier ones applied. Deleting grid rows sends one `DEL` per hash slot, and **Save Incomplete** counts how many ran. Group keys under one hash tag if they must move together.
* A `SELECT` typed inside a `MULTI` block waits for `EXEC`, and never happens at all after a `DISCARD`. Clicking a database in the sidebar while a block is open is refused; close the block first.
* A service with one database, such as Upstash or Redis Cloud, refuses `CONFIG`, so the sidebar lists 16. Every database but `db0` shows the server's error when you click it.
* Redis Cluster serves database 0 only, and so does Valkey unless `cluster-databases` is above 1, in which case the sidebar lists each database. A cluster whose primaries refuse `CONFIG` shows `db0` alone. The Database Index field is hidden in Cluster mode, and a cluster connection always opens on `db0`.
* A command whose keys span hash slots, such as `RENAME`, `SMOVE`, or the `*STORE` commands, is refused in Cluster mode before it is sent. Give the keys a shared hash tag, like `{user}:1` and `{user}:2`.
* A key that is not valid UTF-8 never appears in the grid or the tree. Reach it from the CLI; values have no such limit.
* Pub/Sub has no grid support. `PUBLISH` runs in the CLI, and there is no subscriber view.
* The sidebar tree loads at most 50,000 keys and a filter scans at most 10,000 matches. Narrow the pattern, or `SCAN` from the CLI.
* Values and TTLs cannot be filtered on. Redis has no server-side primitive for either; filter by key pattern and type only.
* No import. Export works as it does elsewhere.
## Troubleshooting
### NOPERM … has no permissions to run the 'scan' command
The ACL user cannot run `SCAN`, which the key tree and the key browser read keys with, and key types need `TYPE`. Grant both with `ACL SETUSER +scan +type`, then right-click **Keys** and choose **Refresh**.
On iPhone and iPad the key list reads `SCAN` and `TYPE` too, and opening a key reads it by type: `GET`, `LLEN` and `LRANGE`, `HLEN` and `HSCAN`, `SCARD` and `SSCAN`, `ZCARD` and `ZRANGE … WITHSCORES`, or `XLEN` and `XRANGE`. A refusal there reads **Permission Denied**.
### SELECT … failed: ERR DB index is out of range
The server has no database with that index. A server that refuses `CONFIG` is listed as 16 databases whatever it holds, so check `databases` in `redis.conf` or the service's own limit, and browse a database the server has.
### Connection refused
The server is not listening where the connection points. Check Redis is running (`brew services start redis`), the port matches `redis.conf`, and the `bind` directive covers the address you are using.
### WRONGPASS invalid username-password pair or user is disabled.
The server rejected the pair. With Username empty, `AUTH password` is checked against the `default` user, and an ACL user's password fails that: fill in Username to authenticate as that user. With Username filled and Password empty, the named user has a password and needs it, or the name does not exist on this server.
One ACL trap produces the same error: `>password` sets a password, `#hash` sets a SHA-256 hash, and a 64-character hex string is valid for both, so `ACL SETUSER myuser on #<64-hex>` is accepted where `>` was meant. `ACL LIST` prints passwords as hashes, so a value copied from there is a hash, not a password.
### This server requires authentication.
The server answered `NOAUTH` to the first command, so the connection carries no identity. Check `requirepass` in `redis.conf` and whether the `default` user is `off` in `ACL LIST`. Fill in Password, and Username as well when the account is an ACL user.
### ERR wrong number of arguments for 'auth' command
The server predates Redis 6 and takes a password alone. Check its version with `INFO server`. Clear Username.
### Timeout
Nothing answered in time. Verify host and port, check the network and firewall, and allow your IP on a cloud-hosted Redis.
### Sentinel or cluster mode over SSH
A tunnel forwards one local port to one remote address, and the addresses Sentinel and Cluster hand back are the server's own. Over a tunnel only the first host in the list is used, as a standalone node, so failover and shard routing are unavailable.
### Slow key list
`KEYS` blocks the server on a large keyspace. Browse by namespace instead, and use `SCAN` in the CLI when you need a pattern. Check memory pressure with `INFO memory`.