Port Checker
See whether a TCP port answers from the internet, on a server you run or on your own router, with a plain open or closed answer.
Enter a host and the port you want to test.
Type it as host:port if you like, or pick a common port below the bar. To check your own router, press “Use my IP” under the bar.
What a port check does
A server can run many services at once, and each one listens on its own numbered port: 443 for HTTPS, 22 for SSH, 25 for mail and so on. A port check asks a simple question, can I connect to this port from the outside?, and tells you the answer. It's the quickest way to tell whether a problem is the service, a firewall, or something in between.
People use it to confirm a port forward on a home router, to see whether a web, mail or game server is reachable, to find out whether a provider is blocking port 25, and to make sure a firewall rule did what was intended.
How this port checker works
For each port we start a normal TCP connection from our server to the host. TCP opens with a three-step handshake. If it completes, the port is open. If the host refuses the connection, or nothing comes back within three seconds, it's closed. We close the connection straight away and send no data, so this tests connectivity and nothing else.
Open or closed: what each result means
Open
The connection went through. Something is listening on that port and nothing between us and it is blocking the way. That proves the port is reachable, not that the service behind it is working properly.
Closed
No connection could be made. The service may not be running or may not be listening on that port, a firewall may be refusing or silently dropping the traffic, a router may have no port forward for it, or the host may be offline. From the outside these all look the same, so a closed result means the port can't be used from here.
Is this my network's view? Not quite
The check comes from our server, so it tells you whether the port is reachable from there. It can't see what a different network can reach, or whether your own connection blocks outgoing traffic. It only covers TCP: UDP has no handshake, so a UDP port can't be tested reliably this way. To test from your own device, run one of these:
- macOS and Linux:
nc -vz example.com 443 - Windows PowerShell:
Test-NetConnection example.com -Port 443
Checking port forwarding on your own router
Press “Use my IP” under the search bar to fill in your public address, enter the port you forwarded, and run the check. An open result means the forward works from the internet. If it shows closed, check the right LAN address and protocol, the device's own firewall, and whether your provider uses CGNAT. Test from outside your network where you can, since some routers can't reach their own public address.
Why a port shows closed
- The service isn't running, or crashed.
- It's listening only on 127.0.0.1 (local) instead of on all addresses.
- The port number differs from the one you configured.
- A host firewall or cloud security group rejects or silently drops the connection.
- The router has no port forward for it, or your provider blocks the port.
- The host is switched off or unreachable.
When nothing answers on any port, a ping test or a traceroute will show whether the host is reachable at all.
Common ports
| Port | Service | Notes |
|---|---|---|
| 21 | FTP | File transfer. Unencrypted, SFTP is the safer choice. |
| 22 | SSH | Secure remote login and SFTP. |
| 25 | SMTP | Mail between servers. Often blocked by providers. |
| 53 | DNS | Name lookups. Mostly UDP, TCP for large answers. |
| 80 | HTTP | Plain web traffic. |
| 110 / 995 | POP3 / POP3S | Downloading mail. 995 is the encrypted one. |
| 143 / 993 | IMAP / IMAPS | Reading mail on the server. 993 is encrypted. |
| 443 | HTTPS | Encrypted web traffic. Nearly every website. |
| 465 / 587 | SMTP submission | Sending mail from a mail client. 465 uses TLS from the start, 587 upgrades to it. |
| 3306 | MySQL / MariaDB | Database. Shouldn't face the internet. |
| 3389 | Remote Desktop | Windows remote access. A common attack target. |
| 5432 | PostgreSQL | Database. Shouldn't face the internet. |
| 5900 | VNC | Remote screen sharing. |
| 8080 | HTTP (alternate) | Often a web app, proxy or admin panel. |
| 25565 | Minecraft | The default Java Edition server port. |
Ports 0 to 1023 are the well-known ones, 1024 to 49151 are registered for specific software, and 49152 upwards are used for short-lived connections. A service can be moved to any port, so a name in the table is what's expected there, not a guarantee.
Port 25, 465 and 587: email
Port 25 carries mail between servers, and it's the one most often blocked, because it's what spam botnets use. Mail clients should submit messages on 587 (which upgrades to encryption) or 465 (encrypted from the first byte). If you run a mail server and want to know whether its address is on any spam lists, use the blacklist check.
Ports worth keeping closed
Web and mail ports are meant to be public. Others are not: Remote Desktop (3389), SMB file sharing (445), databases such as MySQL, PostgreSQL, Redis, MongoDB and Elasticsearch, and VNC are all heavily targeted when reachable from the internet. If one shows up open and you didn't intend that, restrict it to known addresses or put it behind a VPN. We call these out in the results.
Use it responsibly
Check hosts you own or have permission to test. Probing other people's systems can break their provider's rules and, depending on where you are, the law. This tool checks one port per request, limits how often you can run it, and only reaches public addresses. It is not a port scanner. To see who runs an address before you test it, the WHOIS lookup shows the network owner.
Frequently asked questions
How do I check if a port is open?
Enter the host (a domain or IP address) and the port, then run the check. We try to open a TCP connection from our server and report whether it was accepted (open) or not (closed). To test your own router, press "Use my IP" under the search bar so your public address is filled in for you.
What does a closed port mean?
It means we couldn't open a connection to that port from our server. The usual reasons are that the service isn't running or isn't listening on that port, a firewall is refusing or dropping the traffic, a router has no port forward for it, or the host is offline. We can't tell those apart from the outside, so a closed result means the port can't be used from here.
Why does my port show closed when I've set up port forwarding?
The usual causes are that the forward points at the wrong LAN address or protocol, the device's own firewall blocks the port, or the service isn't running or only listens on 127.0.0.1. If nothing you try works, your provider may be using CGNAT, in which case you don't have a public IP of your own and forwarding can't work.
What is CGNAT and why does it break port forwarding?
Carrier-grade NAT means your provider shares one public IP address between many customers. Your router gets a private-range address on the provider's side, so connections from the internet never reach it. A sign of it is a router WAN address starting with 100.64 to 100.127, or one that differs from the public IP shown here. Many providers will give you a public address on request.
Is port 25 blocked by my ISP?
Quite possibly. Many residential providers and cloud hosts block port 25 to cut down on spam. If port 25 is closed while other ports are fine, that's usually the reason. Mail clients normally send on 587 or 465 instead, which aren't blocked.
Can I check UDP ports with this tool?
No. A UDP port has no connection handshake, so there's nothing reliable to test: silence can mean open or closed. This tool only does TCP, which covers web, SSH, mail, remote desktop and most game servers.
Does an open port mean the service is working?
No. It means a TCP connection was accepted. The program behind the port could still be misconfigured, overloaded or returning errors. For a website, open a page to confirm it works, and use the open result to rule out the network.
Is it safe to leave ports open to the internet?
Only the ones you actually need. Web (80, 443) and mail ports are meant to be public. Remote Desktop, database ports like 3306 and 5432, Redis, Elasticsearch and file sharing (445) are heavily targeted and are best restricted to known addresses or kept behind a VPN. We flag these when they show up open.
Is it legal to check someone else's ports?
Check systems you own or have permission to test. Probing machines you don't control can breach acceptable-use rules and, depending on where you are, the law. To keep this tool from being misused it checks one port at a time, limits how often you can run it, and only reaches public addresses.
Why can I connect from my network but this tool says the port is closed?
Because a port can be open to some networks and blocked for others. Our check comes from one place on the internet. A firewall rule that only allows certain addresses, or a router that can't reach its own public IP from the inside, can make the two views differ.