Port Scanner
Check whether common TCP ports are open.
Enter a target
e.g. example.com · 8.8.8.8 · mail.example.com:25 — press ⏎ / ⌘⏎
What is Port Scanner?
The Port Scanner attempts TCP connections to show which ports are reachable from outside. Profiles for common services, mail, web, databases, remote access and "should not face the internet" come ready, and you can supply your own list.
The host:port form works directly for a single-port check — the fastest way to confirm whether a firewall rule is actually in effect.
The "risky" profile scans services that should never be internet-facing (databases, Redis, Memcached, RDP, SMB, Elasticsearch). Finding these open from outside is where most breaches start.
Frequently Asked Questions
9 questionsWhich ports are scanned?
The 20 most common TCP ports: FTP (21), SSH (22), SMTP (25/465/587), DNS (53), HTTP/S (80/443/8080/8443), IMAP/POP3, MySQL (3306), RDP (3389), PostgreSQL (5432), Redis (6379), MongoDB (27017) and others.
Is port scanning legal?
Scanning your own systems or systems you have written permission for is legal. Unauthorized scanning is an offense in many jurisdictions and against our terms. This tool only probes a limited list of common ports.
What exactly does "closed" mean?
A TCP connection couldn't be established within the timeout — the port may truly be closed, or a firewall silently drops packets (filtered). This tool doesn't distinguish the two.
Should I close a port that shows open?
Services that don't need internet exposure (databases, Redis, RDP) should be firewalled or moved behind a VPN. For ports that must stay open (80/443), keep software patched and configuration hardened.
Is scanning someone else's server legal?
A connection attempt is technically an ordinary TCP request, but unauthorised scanning is a problem in many jurisdictions and under nearly every provider's terms. Use it on your own infrastructure or where you have written permission.
What's the difference between closed and filtered?
A closed port actively refuses the connection (RST) and answers fast; a filtered port has a firewall silently dropping the packet, so it times out. This tool reports both as closed, but the latency column reveals the difference — timeouts are markedly slow.
Can I scan UDP ports?
No, TCP only. UDP has no connection concept, so "open" detection isn't reliable: no reply can mean open or filtered, and a correct answer requires protocol-specific probes.
How many ports are scanned at once?
In groups of ten, up to 48 ports. The cap is deliberate — it avoids flooding the target with connections and keeps scan time predictable.
What does the "risky" profile check?
Services that should never face the internet: databases (MySQL, PostgreSQL, MSSQL, Oracle, MongoDB), caches (Redis, Memcached), search (Elasticsearch), file sharing (SMB, NFS) and remote desktop (RDP, VNC). These being open from outside is the most common start of a breach.