Deliberate decision: unauthorized port scanning is an abuse vector and has legal implications in several countries. We prefer a clear, safe reference.
Carregando ferramenta… / Loading tool…
Curated TCP/UDP port catalog. Not a scanner, a catalog.
This tool is a search interface over a curated catalog of TCP and UDP ports used in everyday dev and ops: web, email, databases, remote access, messaging, relevant gaming and more. Ports are numeric identifiers from 0 to 65535 that, together with the IP address, tell which service a connection is meant for, IANA splits them into three ranges (well-known, registered and dynamic). Entries follow the IANA Service Name and Transport Protocol Port Number Registry and the original RFCs, with fields for protocol, range, category, security level and the encrypted counterpart where one exists (for example, 80 → 443). Deliberate decision: the tool does not perform port scans against external addresses. Unauthorized port scanning is an abuse vector and legally gray in many jurisdictions; we prefer a clear, safe reference that runs entirely in your browser from an embedded dataset.
An IP address identifies the machine; the port identifies the service inside it. A connection is defined by the tuple protocol + source IP + source port + destination IP + destination port, and that is what lets the operating system deliver each packet to the right program. Ports range from 0 to 65535 and exist separately for TCP (reliable, ordered connection) and UDP (connectionless, faster), so the same number can mean different things in each protocol.
IANA organizes this space into three ranges: well-known (0–1023), assigned to core services and requiring root privilege to listen on Unix; registered (1024–49151), for applications that request a fixed number; and dynamic or ephemeral (49152–65535), used by the system as a temporary source port when opening outbound connections.
Example 1, direct lookup: search 443 and you find HTTPS (HTTP over TLS), in the well-known range, web category, marked encrypted; the same port 443 over UDP serves HTTP/3 with QUIC. Search ssh and you reach port 22, used by Secure Shell and SFTP, with end-to-end encryption.
Example 2, hardening a config: filter by security 'cleartext' and you see the migration candidates. The catalog points to each one's secure counterpart: HTTP 80 → HTTPS 443, FTP 21 → FTPS 990 (or SFTP 22), POP3 110 → POP3S 995, IMAP 143 → IMAPS 993 and SMTP 25 → submission 587. It is the map of where to move each legacy service.
Use the catalog when writing firewall rules, configuring an nginx proxy, documenting a service or reviewing what a container exposes. It also flags dangerous ports: databases like MySQL (3306), PostgreSQL (5432) and Redis (6379) should never be open to the internet, and the Docker API without TLS (2375) is equivalent to remote root access.
The tool is a reference, not a scanner: it does not connect to IPs or probe ports on third-party machines, by ethical and legal choice. All searching happens over the embedded dataset, in your browser, without sending queries to a server. Each tool has an /embed/{locale}/port-finder route with noindex and minimal branding, ready for iframes.
Paste the code into your HTML and the tool shows up on your page, without J-Kit's navigation and ads. It still runs in the browser of whoever visits your site.
<iframe
src="https://jkit.tools/embed/en-US/port-finder"
width="100%"
height="600"
style="border:0"
loading="lazy"
title="Port Reference"
></iframe>These references help contextualize formulas, standards, APIs and limitations used on this page. They do not replace professional validation when a result has legal, financial, medical or operational impact.
Deliberate decision: unauthorized port scanning is an abuse vector and has legal implications in several countries. We prefer a clear, safe reference.
FTP data channel (active mode). Cleartext, prefer SFTP (22) or FTPS (990).
FTP control channel. Cleartext. Prefer SFTP (22) or FTPS (990).
SSH remote shell and SFTP file transfer with end-to-end encryption.
Legacy cleartext remote shell. Replaced by SSH (22).
Mail relay between servers. Supports STARTTLS. Often blocked by ISPs for end-users.
Name resolution. UDP for normal queries, TCP for zone transfers and large answers. DoT (853) and DoH (443) encrypt.
DHCP server listens for client requests on this port.
DHCP client receives server replies on this port.
Simple unauthenticated transfer. Common in PXE boot and network appliances.
Cleartext HTTP. In production always use HTTPS (443).
Kerberos authentication (KDC). Active Directory foundation.
Mail retrieval (legacy). Cleartext. Use POP3S (995).
Usenet / newsgroups. Rarely used today. Secure variant: NNTPS (563).
Time synchronization. Often abused in amplification attacks.
Microsoft DCE/RPC endpoint mapper. Never expose to the internet.
NetBIOS name resolution. Historical worm vector (Sasser/Conficker).
SMB over NetBIOS. Replaced by direct SMB on 445.
Mailbox access. Cleartext. Use IMAPS (993).
Network device management. v1/v2c cleartext. SNMPv3 encrypts.
Receives SNMP traps/alerts.
Public-internet routing protocol. TCP sessions between ASes.
Traditional IRC. TLS variant: 6697.
Directory service (Active Directory, OpenLDAP). Use LDAPS (636) or StartTLS.
Encrypted web (TLS 1.2/1.3). Also used by HTTP/3 over QUIC (UDP 443).
Direct SMB file sharing over TCP. WannaCry vector, block at the perimeter.
Mail submission with implicit TLS. Modern alternative to 587 with STARTTLS.
Centralized logging. Unencrypted; use TLS syslog (6514) for sensitive traffic.
Authenticated mail submission from clients. STARTTLS required by modern providers.
Printing (CUPS). Frequently exposed unnecessarily.
LDAP encrypted with implicit TLS.
DNS queries encrypted with TLS.
Cleartext rsync sync. Prefer rsync over SSH.
FTPS implicit-TLS data channel.
FTPS with implicit TLS. SFTP (22) is usually simpler to operate.
Encrypted IMAP access.
Encrypted POP3.
SOCKS4/5 proxy. Used by Tor and generic proxy clients.
OpenVPN, usually UDP. Can run on TCP in restrictive networks.
SQL Server. Do not expose to the public internet.
Oracle listener. Keep behind a firewall.
PPTP VPN, considered insecure. Use OpenVPN, IKEv2 or WireGuard.
AAA authentication. Use RADSEC for encrypted transport.
RADIUS accounting.
MQTT broker without TLS. Use MQTTS (8883) in production.
Unix file sharing. NFSv4 supports Kerberos authentication.
Docker API without TLS, equivalent to remote root access. NEVER expose to the internet.
Docker API with mandatory mutual TLS.
Informal default for Node dev servers (Next.js, Express).
MySQL/MariaDB database. TLS optional; keep private.
Windows remote desktop. Always behind a VPN or gateway.
NAT traversal for WebRTC and VoIP.
Default Phoenix Framework dev port.
ngrok local tunnel inspector UI.
Default Flask dev server. Conflicts with AirPlay on macOS.
Cleartext VoIP signaling. SIP-TLS on 5061.
VoIP signaling with TLS.
Default Vite dev port (React/Vue/Svelte).
XMPP messaging. Supports StartTLS.
Server-to-server XMPP federation.
Zero-config service discovery (.local).
PostgreSQL database. TLS configurable; keep private.
AMQP brokers (RabbitMQ). TLS on 5671.
VNC web-based client.
VNC remote display (RFB protocol). Tunnel via SSH on untrusted networks.
WinRM over HTTP. Use HTTPS (5986).
WinRM with TLS.
Redis cache/KV store. NEVER expose without auth, common cryptominer target.
Kubernetes API server with mandatory mTLS.
Alternative IRC port range.
IRC with TLS.
HTTP dev servers (Django, http.server).
Alternative HTTP. Common for proxies, dashboards and Tomcat.
Alternative HTTPS, common on admin dashboards.
MQTT with TLS.
PHP-FPM and assorted dev tooling.
Prometheus metrics endpoint.
Kafka broker. TLS/SASL configurable.
Elasticsearch/OpenSearch HTTP API. Keep private.
In-memory cache. UDP is an amplification vector, use TCP and firewall.
Minecraft Java server.
Source-engine based servers (CS:GO, TF2, etc).
MongoDB database. Do not expose without auth.
WireGuard VPN. Default port from the official docs.
Everything runs locally in your browser from an embedded catalog. This tool does not connect to IPs or ports, it is not a scanner.