Reference

TCP and UDP ports, explained

A port number identifies a service on a host, not the host itself. This reference covers the ports you meet in logs, firewall rules and connection strings, with the transport and the exposure risk stated plainly.

Three ranges, different rules

IANA divides ports into well-known (0–1023), registered (1024–49151) and dynamic or private (49152–65535). The ranges are conventions for assignment, not enforcement: nothing stops a service from listening on any number, and containers routinely publish high ports that map to low ones.

Opening a port is not the same as running a service. A closed port refuses the connection; a filtered port silently drops it. When a scan reports a port as open, it means something accepted a TCP handshake or answered a UDP probe.

Exposure is the real decision

Web, mail and SSH ports are designed to face the internet. Database, cache and remote-desktop ports are not. Exposing 3306, 5432, 6379, 27017 or 3389 to the public internet invites automated brute force, and for Redis and MongoDB the default configuration has historically allowed unauthenticated access.

The safe pattern is the same for all of them: bind to a private interface, require authentication, and reach them through a VPN, a bastion or an SSH tunnel. A firewall rule that allows the whole internet turns a development convenience into an incident.

All entries

20 — FTP dataPort 20 carries FTP data in active mode, from server to client. 21 — FTP controlPort 21 carries FTP commands and responses, including credentials in plain FTP. 22 — SSHPort 22 carries SSH: encrypted remote shell, SFTP, SCP and port forwarding. 23 — TelnetPort 23 is the legacy Telnet service, which sends everything including passwords in clear text. 25 — SMTPPort 25 is the classic SMTP port for server-to-server mail delivery. 53 — DNSPort 53 resolves domain names, over UDP for queries and TCP for large answers or zone transfers. 80 — HTTPPort 80 is the default port for plain HTTP. 110 — POP3Port 110 is the POP3 mailbox protocol, traditionally download-and-delete. 143 — IMAPPort 143 is IMAP, which keeps mail on the server and synchronises folders across devices. 443 — HTTPSPort 443 is the default port for HTTPS and for HTTP/3 over QUIC. 445 — SMBPort 445 carries SMB file sharing on Windows networks and must never face the internet. 587 — SMTP submissionPort 587 is the authenticated submission port for sending mail from a client. 993 — IMAPSPort 993 is IMAP over TLS, encrypted from the first byte. 995 — POP3SPort 995 is POP3 over TLS, encrypted from the first byte. 3306 — MySQLPort 3306 is the default MySQL and MariaDB listener. 3389 — RDPPort 3389 is Microsoft Remote Desktop, a frequent target for brute force and ransomware. 5432 — PostgreSQLPort 5432 is the default PostgreSQL listener. 6379 — RedisPort 6379 is the default Redis listener, and an unauthenticated Redis is a common breach. 8080 — HTTP alternatePort 8080 is a common alternate HTTP port for proxies, development servers and admin panels. 8443 — HTTPS alternatePort 8443 is a common alternate HTTPS port for admin interfaces and application servers. 27017 — MongoDBPort 27017 is the default MongoDB listener and a repeated target of mass ransom campaigns.

Use these with

Port Lookup

Search TCP and UDP ports by number, service or risk, and open the reference entry.

Open tool →

HTTP Header Inspector

Paste raw request or response headers to see what each one does and which security headers are missing.

Open tool →

New tools, straight to your inbox

One short email when we add tools worth using. No spam, unsubscribe anytime.