Port Checker

Test whether any TCP port is open or closed on any IP address or hostname in real time. Diagnose firewalls, confirm services are running, and verify network access instantly — no sign-up needed.

Enter a hostname or IP and a port number to test TCP connectivity from our servers.
Quick-fill a common port
Port 1433 on github.com
Closed
Port 1433 is CLOSED
on github.com  ·  Resolved to 140.82.121.3
Host
github.com
Service
MSSQL
Response
5006ms
Connection timed out
IP Details DNS Lookup New Check
Common Ports Reference
Show
21
FTP
22
SSH
23
Telnet
25
SMTP
53
DNS
80
HTTP
110
POP3
143
IMAP
443
HTTPS
465
SMTPS
587
SMTP TLS
993
IMAPS
995
POP3S
1433
MSSQL
3306
MySQL
3389
RDP
5432
PostgreSQL
6379
Redis
8080
HTTP Alt
8443
HTTPS Alt
27017
MongoDB
Tests run server-side
Real-time TCP check
No sign-up needed

What This Tool Does

This checker attempts a real TCP three-way handshake from our servers to your specified host and port. Because the test originates from our infrastructure rather than your own machine, the result tells you whether the port is publicly reachable from the internet — which is exactly what matters for web servers, mail servers and any externally accessible service. If the handshake completes within 5 seconds, the port is reported open with its response time in milliseconds. If it times out or is refused, it is reported closed.

Single Port Check

Test one specific port on any host and see whether it is open, closed or timing out, with response time in milliseconds.

Multi-Port Scan

Pass a comma-separated list via the ports parameter to scan several ports at once and view results in a table.

DNS Resolution Check

Hostnames are resolved before any port test. If DNS fails, a clear distinct message is shown rather than a misleading "closed" result.

Common Ports Reference

Quick-fill buttons and a collapsible reference panel for the most common TCP services, from HTTP to MongoDB.

Diagnosing Common Port Problems

Key Ports and Whether They Should Face the Internet

PortServicePublic internet exposure
22SSHOnly with strict IP allowlisting and key-based authentication.
80HTTPYes — but redirect all traffic immediately to HTTPS on 443.
443HTTPSYes — the primary port for all web traffic. Verify with SSL Checker.
3306MySQLNo — access via SSH tunnel or private network only.
5432PostgreSQLNo — same as MySQL; never expose directly.
3389RDPNo — one of the most aggressively scanned ports worldwide.
6379RedisNo — frequently exploited when left open with no authentication.
27017MongoDBNo — restrict to localhost or private network.
Frequently Asked Questions

What is a TCP port and why does it matter?

A port is a numbered logical endpoint on a networked server that routes incoming traffic to the correct application. Think of an IP address as a building and ports as individual office doors — each door leads to a different service. Web servers listen on port 80 for HTTP and port 443 for HTTPS, SSH uses port 22, MySQL uses port 3306, and PostgreSQL uses port 5432. Without ports, a single IP address could only run one service at a time.

Ports are divided into three ranges: well-known ports (0–1023) are reserved for standard services and require root privileges to bind; registered ports (1024–49151) are used by applications like databases and mail servers; and dynamic or private ports (49152–65535) are typically used for ephemeral client-side connections. Before running a port check, use our DNS Lookup to confirm the domain resolves to the IP you intend to test.

What is the difference between open and closed?

An open port means a service on the server accepted the TCP connection — it completed the three-way handshake and is actively listening and ready to communicate. A closed port can mean two quite different things in practice: either no service is running on that port and the server sent back an immediate TCP reset (RST), or a firewall is silently dropping packets before they reach the server at all.

The distinction matters for diagnosis. A genuine service refusal responds almost instantly — within a few milliseconds — and the response time shown will be very low. A firewall drop causes the full timeout period to elapse (up to 5 seconds in this tool) before returning "closed". If you see a very slow "closed" result, it is almost always a firewall drop rather than a stopped service. If port 443 shows open but you want to confirm HTTPS is also working correctly, run an SSL Certificate Check on the same host immediately after.

Why does my hostname show a DNS error instead of a closed port?

If the hostname cannot be resolved to an IP address — due to a typo, an unregistered domain, or a name with no DNS record — this tool shows a clearly distinct resolution failure message rather than reporting the port as closed. The distinction matters for the right fix: a closed port means the host exists but is not accepting connections on that port; a resolution failure means the host itself could not be found at all. Conflating the two leads to wasted debugging time.

If you see a DNS resolution error, check the spelling carefully, confirm the domain is registered and active, and verify it has an A or AAAA record using our DNS Lookup tool. If the domain is newly registered, DNS propagation may still be in progress. If you own the server and recently changed its IP, the old DNS record may still be cached — a DNS lookup will show the current published record regardless of caching at other resolvers.

Why would a port show closed even though my service is running?

The most common causes in order of frequency are: a cloud security group or firewall rule blocking inbound traffic on that port — this is by far the most frequent cause on cloud-hosted servers; the application binding to 127.0.0.1 (localhost only) instead of 0.0.0.0 (all interfaces), which means the service can only be reached from the server itself; a network ACL at the infrastructure level separate from the OS-level firewall; the service running on a different port number than expected; or the process having crashed after its last restart check.

To diagnose: first confirm the service is actually running and listening locally using ss -tlnp or netstat -tlnp on Linux, or netstat -ano on Windows. If it appears in the local listener list but this tool shows closed, the issue is almost certainly a firewall or security group rule. To confirm you are testing the correct public IP, use our What Is My IP tool from the server itself if possible.

Can I scan multiple ports at once?

Yes — pass a comma-separated list of port numbers via the ports query parameter alongside your host. For example: /port-checker?host=example.com&ports=22,80,443,3306. The tool tests each port in sequence and presents results in a table showing the service name, open or closed status, and response time in milliseconds. This is useful for a quick firewall audit after provisioning a new cloud instance or after modifying a security group.

The multi-port scan uses a 3-second timeout per port rather than the 5-second default for single checks, to keep overall scan time reasonable for longer lists. Pair a multi-port scan with a DNS Lookup first to confirm the domain resolves to the expected IP, and follow up any open port 443 results with an SSL Checker run to verify the certificate is valid and trusted.

What is the difference between a port check and a ping?

A ping sends ICMP echo requests to measure whether a host is reachable at the network layer and how fast the round trip is. A port check goes one step further and attempts a full TCP connection to a specific service, confirming the application itself is listening and accessible from the internet. These are complementary rather than alternative tests.

Many cloud providers and corporate networks block ICMP entirely — a failed ping does not mean the host is down; it often just means ICMP is filtered while HTTP and HTTPS are working perfectly fine. Conversely, a successful ping only confirms the host is reachable at the IP layer, not that any specific service is running. Use both tests together for a complete picture: ping for basic network reachability, port check for application-layer confirmation. Our Ping Test tool is available for the ICMP side of this diagnostic pair.

Why is port 443 more important than port 80 for security?

Port 80 carries unencrypted HTTP traffic. Any data exchanged — form submissions, session cookies, API responses, login credentials — can be read by anyone with access to the network path between the user and the server. This is trivial on shared Wi-Fi networks and feasible in various network-level attack scenarios. Port 443 carries HTTPS traffic encrypted with TLS, making eavesdropping computationally infeasible with current technology.

Modern best practice is to have both ports open but immediately redirect all HTTP traffic from port 80 to HTTPS on port 443, then enforce this at the browser level with an HSTS header so browsers never attempt an unencrypted connection again. After confirming port 443 is open here, use our SSL Checker to verify the certificate is valid and not expiring, and our HTTP Headers tool to confirm HSTS is correctly configured.

Does this tool check UDP ports?

No — this tool only tests TCP ports. UDP is a connectionless protocol with no three-way handshake, so checking whether a UDP port is "open" requires sending a protocol-specific payload and interpreting a service-specific response, which varies significantly by application and cannot be generalised into a simple open/closed result the way TCP can.

Services commonly using UDP include DNS (port 53), VPN protocols like WireGuard (port 51820) and OpenVPN (port 1194 by default), QUIC/HTTP3 (port 443 UDP), and game servers. To verify DNS specifically, use our DNS Lookup tool which queries DNS records directly in real time using DNS-over-UDP and shows all record types for any domain.

Is scanning ports on other people's servers legal?

Scanning your own infrastructure is standard security practice and entirely legal. Scanning servers you do not own or have explicit written authorisation to test may violate computer access laws in many jurisdictions — including the Computer Fraud and Abuse Act (CFAA) in the United States and the Computer Misuse Act in the United Kingdom. Penalties can be serious even for tests that cause no damage, because the act of unauthorised access itself constitutes the offence in most frameworks.

This tool performs single-port tests from our servers and is intended solely for infrastructure you own or manage, or for which you have explicit written permission. Use our WHOIS Lookup to verify ownership of any IP range or domain before testing it. For any professional penetration testing work, always obtain written authorisation from the asset owner before beginning any port scanning activity.

Which mail ports should I check when troubleshooting email delivery?

Port 25 (SMTP) handles server-to-server mail delivery — most residential ISPs and shared hosting providers block outbound port 25 to prevent spam abuse. If you are testing a mail server's ability to receive mail from other servers, port 25 should be open on your MX hosts. Port 587 (SMTP with STARTTLS) is the standard authenticated submission port for email clients sending outbound mail. Port 465 (SMTPS) uses implicit TLS and is the modern alternative to 587 for encrypted submission.

Ports 993 (IMAPS) and 995 (POP3S) are the encrypted protocols for email clients retrieving mail from the server. After confirming these ports are open here, verify the mail server's DNS records — specifically the SPF, DKIM and MX records — with our DNS Lookup tool, and check the TLS certificate on the mail server with our SSL Checker to ensure it is not expired or untrusted.