What should I use for rotating database credentials without downtime?

For rotating database credentials without downtime, the best approach is usually:

Use two-step secret rotation with overlapping validity

1. Create a new credential alongside the old one.
2. Deploy/update applications to accept/use the new credential.
3. Keep both credentials valid temporarily so existing connections keep working.
4. Revoke the old credential only after all clients have switched.

Best implementation patterns

1. Database-native users + secret manager

• Store credentials in AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager, etc.
• Use built-in rotation support or a custom rotation lambda/job.
• Ensure apps reload credentials gracefully and use connection pooling.

2. Dual-user rotation

• Maintain two DB users, e.g. app_user_a and app_user_b.
• Rotate by:
  • generating a new password for the inactive user,
  • updating the secret,
  • switching apps,
  • disabling the old user later.
• This is especially good when the database doesn’t support seamless password overlap for one user.

3. Connection pooling / short-lived connections

• Use a pooler (PgBouncer, ProxySQL, RDS Proxy, etc.) so credentials can be updated without forcing all clients to reconnect at once.
• Helps prevent downtime during transition.

What to avoid

• Rotating a password in-place with no overlap if apps cache credentials or maintain long-lived connections.
• Forcing immediate disconnects before the new credential is deployed everywhere.

Recommended default

If you want the safest general solution:
Use a secret manager + dual-user rotation + connection pooling.

If you tell me which database you’re using (PostgreSQL, MySQL, SQL Server, etc.) and where it’s hosted, I can suggest the exact rotation strategy and tooling.