What Makes a PostgreSQL Extension "Trusted"?

PostgreSQL extensions package everything from new data types and functions to compiled C code into installable units. Normally, running CREATE EXTENSION requires superuser privileges because extensions can alter how the database server behaves. Trusted extensions relax that requirement: any user with CREATE privilege on a database can enable them.

That relaxation is deliberate. In cloud managed services, customers typically do not get superuser access for safety reasons. Without trusted extensions, they would be stuck with only the built-in functionality. Trusted extensions let them self-service common tools like hstore, citext, and pg_trgm, letting providers offer flexibility without handing out admin rights.

What "Trusted" Does and Doesn't Mean

The label is easy to over-read. A trusted extension is not certified bug-free, audited by PostgreSQL core developers, or guaranteed safe in every scenario. It is a narrower claim:

"We believe enabling this extension should not allow users to bypass security or harm the database server."

Whether an extension is trusted is decided per server, not per author. The extension's .control file contains the flag that tells PostgreSQL whether non-superusers may enable it:

trusted = true

If that line is missing, the extension is untrusted by default. But the local superuser can edit control files or manage access manually, so the same extension can be trusted on one server and untrusted on another. An apt analogy: the superuser is a teacher deciding which toys go in the open room versus the locked room. It is not about who made the toy or how popular it is — only whether unsupervised use is safe.

Why Some Extensions Are Trusted and Others Aren't

Contrib modules that ship bundled with PostgreSQL are commonly marked trusted because they provide relatively safe capabilities — new data types, functions, indexes — without dangerous side effects. External extensions, such as those developed by companies like CYBERTEC, are generally not auto-trusted; the authors and the administrators make that call.

Cautions for Everyday Use

  • Trust does not equal bug-free. It is an author's promise, not a full audit. Even trusted extensions can contain flaws.
  • C extensions require extra scrutiny. An extension that loads .so files can crash the database or introduce real risk. The same applies to pgrx extensions written in Rust. Label these trusted only after careful review.
  • Superusers retain final control. Admins can override trust by editing control files or restricting access rights manually.
  • Install and create are different steps. Installing means copying the files onto the server; creating means registering the extension inside a specific database with SQL.
  • You don't have to trust blindly. Even for an extension marked trusted, review the code yourself before letting users enable it.