What “open port” really means
A port is not a physical socket; it is a number, from 1 to 65535, that a program on a machine uses to distinguish its conversations. One server can run a website on port 443, email on port 25 and remote administration on port 22 simultaneously, because each service listens on its own number. When this tool reports a port as open, it means a program on that host accepted a TCP connection on that number from our server. When it reports closed, something answered but refused, or nothing answered at all — the distinction between those last two cases matters, and is explained below.
The TCP handshake behind the test
Every TCP connection begins with a three-way handshake. Our server sends a SYN packet — essentially “may I talk to you on this port?” If a service is listening and the path is clear, the host replies SYN-ACK, we complete the exchange with ACK, and the connection is established. That moment is what this tool times and reports in milliseconds. We then close the connection immediately, without sending any application data: the test proves reachability, nothing more. If the host replies with a RST packet instead, the machine is reachable but no service is listening, and if nothing comes back at all, the request or the reply was silently dropped somewhere along the way.
Open, closed and filtered: three different answers
An open result is unambiguous — the service is up and reachable from the public internet, at least from our network. A closed result means the host itself actively refused the connection: the machine is online, but nothing is listening on that port, or its own firewall is configured to reject rather than ignore. A timeout — often labelled filtered — means silence. A firewall, security group or NAT device between us and the host dropped the packets without answering. This checker reports timeouts as closed with the elapsed time shown, so interpret a result that took the full timeout very differently from one refused in a few milliseconds: the first points at a firewall or routing problem, the second at the service itself.
Firewalls, NAT and the usual reasons a port looks closed
When you have started a service and this tool still says closed, work through the layers in order. First, is the program actually listening, and on the right interface — many services bind only to localhost by default, which makes them invisible externally by design. Second, the operating system's own firewall must allow the port. Third, if the machine sits behind a router, a NAT or port-forwarding rule must send external traffic to the correct internal address; without it, the router discards the request and the host never knows you knocked. Fourth, most cloud and VPS providers add an external security group or network firewall on top of all this, and it is the layer people most often forget. Finally, some providers and ISPs block well-known ports such as 25 outright, in which case no local change will open them.
Security: an open port is a door, not a verdict
Every open port is a service the whole internet can attempt to talk to. That is necessary for public websites and mail servers, and unnecessary risk for everything else. Database ports such as 3306 and remote-desktop ports such as 3389 appear in the quick checks above precisely because they are so often found exposed by accident, and they are scanned by automated attackers within minutes of appearing. If a quick check reveals something open that you did not expect, treat it as a finding: identify the service, restrict it to the addresses that genuinely need it, or close it. Conversely, a closed result is not a certificate of security — it describes one port, from one vantage point, at one moment.
How to use this tool
Enter a hostname or IP address and a port, then press Check port: the result shows open or closed together with the connection time in milliseconds. For a fuller picture, use the quick-check buttons to test the six common ports against the same host sequentially; results accumulate in a summary table so you can compare them at a glance. Repeat a surprising result once — transient packet loss can produce a single misleading timeout.
Frequently asked questions
Why is my port closed when the service is running?
Almost always one of the layers in between: the service bound to localhost only, the OS firewall, a missing NAT forwarding rule, or the provider's security group. Check them in that order, retesting after each change.
Can this tool check UDP ports?
No. UDP has no handshake, so there is no reliable way to distinguish open from silently filtered from the outside. This checker tests TCP only, which covers the great majority of web, mail and administration services.
Is port checking legal?
Testing your own systems, or systems you have been hired or asked to test, is normal administration. Scanning other people's systems without permission can breach computer-misuse laws and provider terms, which is why this tool tests one host and port at a time.
Why did the same port give different times on repeat tests?
The figure is the time to complete a real handshake across the public internet, so it varies with routing and load. Look at the pattern rather than a single reading — and remember our server's location is part of the measurement.
Related tools
- SSL Checker — inspect the service listening on port 443
- DNS Lookup — confirm the hostname points where you think
- What Is My IP? — see your own public address
- Subnet Calculator — plan firewall and NAT address ranges
- Password Generator — strengthen the logins behind open ports