Port Reachability Checker at a glance
- What it does
- Check whether a host answers on a given port from your browser, and understand what a browser-based probe can and cannot tell you about an open port.
- Where it runs
- Entirely in your browser — no data is uploaded
- Works offline
- Yes, once the page has loaded
- Cost
- Free, with no account and no usage limit
- Category
- Browser & Network
How to use the checker
- Enter the host - a hostname or IP address you own or are authorised to test.
- List the ports to probe, separated by commas.
- Run the check and read each line as it completes.
- Interpret the result using the table below, which matters more here than in most tools.
Only probe systems you own or have written permission to test. Scanning third-party infrastructure without authorisation is a criminal offence in many countries, including under the Computer Misuse Act in the UK and the Computer Fraud and Abuse Act in the US. Doing so also breaches our terms of use.
What each result actually means
| Result | What you can conclude |
|---|---|
| Response received | Something is listening and completed a TCP connection. Strong evidence the port is open. |
| Open or filtered | The connection was established but the browser refused to expose the response, almost always because of the same-origin policy. In practice this usually means open. |
| Closed / timeout | Nothing answered within the time limit. This could be a closed port, a firewall dropping packets silently, a slow network, or the browser refusing the request. |
Note the asymmetry: a positive result is fairly reliable, a negative one is not. Use the tool to confirm something is reachable, not to conclude something is closed.
Why browser-based probing is limited
Four restrictions apply, and they are all deliberate browser security features rather than bugs.
- Only HTTP and HTTPS. The browser speaks those protocols. It cannot open a raw TCP socket, so it cannot properly test SSH, SMTP, a database port or anything else that is not an HTTP service.
- Blocked ports. Browsers refuse connections to a list of ports associated with other protocols - 22, 25, 110 and around eighty others - to prevent web pages being used to attack them. Those will always look closed.
- Mixed content. A page served over HTTPS cannot open plain HTTP connections, which restricts what can be probed from a secure page.
- The same-origin policy hides the actual response, leaving only timing and error type to infer from.
For genuine port scanning, use a real tool from a machine you control: nmap for a full scan, nc -zv host port for a quick check, or Test-NetConnection in PowerShell.
Ports worth recognising
| Port | Service | Notes |
|---|---|---|
| 22 | SSH | Remote shell. Should never be open to the whole internet with password authentication enabled. |
| 80 / 443 | HTTP / HTTPS | The web. 80 should redirect to 443. |
| 3000 / 5173 / 8080 | Development servers | Node, Vite and various app servers. Should not be exposed publicly. |
| 3306 / 5432 | MySQL / PostgreSQL | Databases. Exposing these to the internet is a frequent and serious misconfiguration. |
| 6379 | Redis | Historically unauthenticated by default, and a well-known route into a network. |
| 27017 | MongoDB | Responsible for a long series of public data breaches from unsecured instances. |
If you are checking your own server
The general principle is that a port should be open only if a service on it is meant to be reachable from where you are testing. Practical steps: default the firewall to deny and open only what you need; bind development and database services to 127.0.0.1 rather than 0.0.0.0; put administrative access behind a VPN or an SSH tunnel instead of exposing it; and re-check after every deployment, because container platforms and cloud security groups publish ports more readily than people expect.
Frequently asked questions
No. It is a reachability check limited to HTTP and HTTPS from inside a browser sandbox. For an actual scan use nmap or netcat from a machine you control.
Most likely the browser blocks that port, the service does not speak HTTP, or a mixed-content restriction applies. Browser-based negative results are unreliable by nature.
Scanning your own infrastructure is fine. Scanning someone else's without written authorisation is unlawful in many jurisdictions regardless of intent. Get permission in writing first.
Sometimes, but modern browsers increasingly block requests from public pages to private address ranges - a protection against attacks on home routers. A local tool is the right approach.
Nothing you enter here leaves your browser
Port Reachability Checker does its work in JavaScript running on your own device. The page loads once, and after that there is no upload step and no server involved — which matters here because diagnostic output tends to describe your own network and machine.
You can verify this rather than taking our word for it: load the page, disconnect from the internet, and the tool keeps working. Our privacy policy sets out what is and is not collected, and this guide explains why the distinction matters.