Port Inspector probes the TCP ports of a URL, hostname or IP address and shows you only the ports that are actually open, together with what the service on that port is normally used for. Results stream in live while the scan is still running.
Entering a target
- Enter a hostname (example.com), a full URL (https://example.com/page) or an IP address.
- Only the host part matters — a path, a query string and a :port suffix are stripped, because the tool scans a port range, not a single port.
- Up to four resolved addresses are probed per port, so a host that load-balances over several IPs still reveals each service it exposes.
- Private (10/8, 172.16/12, 192.168/16), loopback and link-local addresses are refused.
Choosing what to scan
- Common services — the roughly 100 ports that account for nearly all traffic on the internet. Fastest option and a good first look.
- Well-known 1-1023 — the range reserved for standard services.
- All 65535 — the complete TCP port space, including the dynamic/private range 49152-65535. Takes noticeably longer.
Reading the results
- Only ports that completed a TCP handshake are listed. Everything else is omitted on purpose, so the list stays short and readable.
- Each row shows the port number, the IANA service name, the category, a one-line explanation of the typical use and a risk rating.
- Low means the service is commonly public-facing and hardened for it. Medium means it is often needed but should be restricted or placed behind a VPN. High means exposing it to the whole internet is a well-known cause of breaches.
- Newest hits appear at the top while the scan streams.
Why the scan runs on the server
A browser cannot open raw TCP connections to arbitrary ports: a page served over HTTPS is not allowed to connect to tcp:// or ws:// targets, which rules out the mixed content rules. The public scanner APIs (hackertarget, portchecker.io) do not send CORS headers, so a browser cannot call them either.
The TCP connections are therefore opened from the webhost running this site. Your browser only receives the results over the ordinary HTTPS connection it already had open.
References
Every row links to at least three independent third-party sources so you can verify the claims:
- nmap-services — the service name database shipped with Nmap.
- Wikipedia — list of TCP and UDP port numbers.
- IANA — the official Service Name and Transport Protocol Port Number Registry.
Where one exists, a relevant RFC or vendor document is linked as well.
Interpreting the result correctly
- A closed port and a filtered port look identical from the outside. If a host drops packets silently, the scanner reports the port as not listening.
- An open port tells you a service accepted a connection. It says nothing about whether that service is configured safely.
- Results change over time. A scan from a different network, or after a configuration change, can look completely different.
- Scan only hosts you own or are authorised to test. Port scanning is illegal in many jurisdictions without permission.
Entering a target
- Enter a hostname (example.com), a full URL (https://example.com/page) or an IP address.
- Only the host part matters — a path, a query string and a :port suffix are stripped, because the tool scans a port range, not a single port.
- Up to four resolved addresses are probed per port, so a host that load-balances over several IPs still reveals each service it exposes.
- Private (10/8, 172.16/12, 192.168/16), loopback and link-local addresses are refused.
Choosing what to scan
- Common services — the roughly 100 ports that account for nearly all traffic on the internet. Fastest option and a good first look.
- Well-known 1-1023 — the range reserved for standard services.
- All 65535 — the complete TCP port space, including the dynamic/private range 49152-65535. Takes noticeably longer.
Reading the results
- Only ports that completed a TCP handshake are listed. Everything else is omitted on purpose, so the list stays short and readable.
- Each row shows the port number, the IANA service name, the category, a one-line explanation of the typical use and a risk rating.
- Low means the service is commonly public-facing and hardened for it. Medium means it is often needed but should be restricted or placed behind a VPN. High means exposing it to the whole internet is a well-known cause of breaches.
- Newest hits appear at the top while the scan streams.
Why the scan runs on the server
A browser cannot open raw TCP connections to arbitrary ports: a page served over HTTPS is not allowed to connect to tcp:// or ws:// targets, which rules out the mixed content rules. The public scanner APIs (hackertarget, portchecker.io) do not send CORS headers, so a browser cannot call them either.
The TCP connections are therefore opened from the webhost running this site. Your browser only receives the results over the ordinary HTTPS connection it already had open.
References
Every row links to at least three independent third-party sources so you can verify the claims:
- nmap-services — the service name database shipped with Nmap.
- Wikipedia — list of TCP and UDP port numbers.
- IANA — the official Service Name and Transport Protocol Port Number Registry.
Where one exists, a relevant RFC or vendor document is linked as well.
Interpreting the result correctly
- A closed port and a filtered port look identical from the outside. If a host drops packets silently, the scanner reports the port as not listening.
- An open port tells you a service accepted a connection. It says nothing about whether that service is configured safely.
- Results change over time. A scan from a different network, or after a configuration change, can look completely different.
- Scan only hosts you own or are authorised to test. Port scanning is illegal in many jurisdictions without permission.
Entering a target
- Enter a hostname (example.com), a full URL (https://example.com/page) or an IP address.
- Only the host part matters — a path, a query string and a :port suffix are stripped, because the tool scans a port range, not a single port.
- Up to four resolved addresses are probed per port, so a host that load-balances over several IPs still reveals each service it exposes.
- Private (10/8, 172.16/12, 192.168/16), loopback and link-local addresses are refused.
Choosing what to scan
- Common services — the roughly 100 ports that account for nearly all traffic on the internet. Fastest option and a good first look.
- Well-known 1-1023 — the range reserved for standard services.
- All 65535 — the complete TCP port space, including the dynamic/private range 49152-65535. Takes noticeably longer.
Reading the results
- Only ports that completed a TCP handshake are listed. Everything else is omitted on purpose, so the list stays short and readable.
- Each row shows the port number, the IANA service name, the category, a one-line explanation of the typical use and a risk rating.
- Low means the service is commonly public-facing and hardened for it. Medium means it is often needed but should be restricted or placed behind a VPN. High means exposing it to the whole internet is a well-known cause of breaches.
- Newest hits appear at the top while the scan streams.
Why the scan runs on the server
A browser cannot open raw TCP connections to arbitrary ports: a page served over HTTPS is not allowed to connect to tcp:// or ws:// targets, which rules out the mixed content rules. The public scanner APIs (hackertarget, portchecker.io) do not send CORS headers, so a browser cannot call them either.
The TCP connections are therefore opened from the webhost running this site. Your browser only receives the results over the ordinary HTTPS connection it already had open.
References
Every row links to at least three independent third-party sources so you can verify the claims:
- nmap-services — the service name database shipped with Nmap.
- Wikipedia — list of TCP and UDP port numbers.
- IANA — the official Service Name and Transport Protocol Port Number Registry.
Where one exists, a relevant RFC or vendor document is linked as well.
Interpreting the result correctly
- A closed port and a filtered port look identical from the outside. If a host drops packets silently, the scanner reports the port as not listening.
- An open port tells you a service accepted a connection. It says nothing about whether that service is configured safely.
- Results change over time. A scan from a different network, or after a configuration change, can look completely different.
- Scan only hosts you own or are authorised to test. Port scanning is illegal in many jurisdictions without permission.
Entering a target
- Enter a hostname (example.com), a full URL (https://example.com/page) or an IP address.
- Only the host part matters — a path, a query string and a :port suffix are stripped, because the tool scans a port range, not a single port.
- Up to four resolved addresses are probed per port, so a host that load-balances over several IPs still reveals each service it exposes.
- Private (10/8, 172.16/12, 192.168/16), loopback and link-local addresses are refused.
Choosing what to scan
- Common services — the roughly 100 ports that account for nearly all traffic on the internet. Fastest option and a good first look.
- Well-known 1-1023 — the range reserved for standard services.
- All 65535 — the complete TCP port space, including the dynamic/private range 49152-65535. Takes noticeably longer.
Reading the results
- Only ports that completed a TCP handshake are listed. Everything else is omitted on purpose, so the list stays short and readable.
- Each row shows the port number, the IANA service name, the category, a one-line explanation of the typical use and a risk rating.
- Low means the service is commonly public-facing and hardened for it. Medium means it is often needed but should be restricted or placed behind a VPN. High means exposing it to the whole internet is a well-known cause of breaches.
- Newest hits appear at the top while the scan streams.
Why the scan runs on the server
A browser cannot open raw TCP connections to arbitrary ports: a page served over HTTPS is not allowed to connect to tcp:// or ws:// targets, which rules out the mixed content rules. The public scanner APIs (hackertarget, portchecker.io) do not send CORS headers, so a browser cannot call them either.
The TCP connections are therefore opened from the webhost running this site. Your browser only receives the results over the ordinary HTTPS connection it already had open.
References
Every row links to at least three independent third-party sources so you can verify the claims:
- nmap-services — the service name database shipped with Nmap.
- Wikipedia — list of TCP and UDP port numbers.
- IANA — the official Service Name and Transport Protocol Port Number Registry.
Where one exists, a relevant RFC or vendor document is linked as well.
Interpreting the result correctly
- A closed port and a filtered port look identical from the outside. If a host drops packets silently, the scanner reports the port as not listening.
- An open port tells you a service accepted a connection. It says nothing about whether that service is configured safely.
- Results change over time. A scan from a different network, or after a configuration change, can look completely different.
- Scan only hosts you own or are authorised to test. Port scanning is illegal in many jurisdictions without permission.
Entering a target
- Enter a hostname (example.com), a full URL (https://example.com/page) or an IP address.
- Only the host part matters — a path, a query string and a :port suffix are stripped, because the tool scans a port range, not a single port.
- Up to four resolved addresses are probed per port, so a host that load-balances over several IPs still reveals each service it exposes.
- Private (10/8, 172.16/12, 192.168/16), loopback and link-local addresses are refused.
Choosing what to scan
- Common services — the roughly 100 ports that account for nearly all traffic on the internet. Fastest option and a good first look.
- Well-known 1-1023 — the range reserved for standard services.
- All 65535 — the complete TCP port space, including the dynamic/private range 49152-65535. Takes noticeably longer.
Reading the results
- Only ports that completed a TCP handshake are listed. Everything else is omitted on purpose, so the list stays short and readable.
- Each row shows the port number, the IANA service name, the category, a one-line explanation of the typical use and a risk rating.
- Low means the service is commonly public-facing and hardened for it. Medium means it is often needed but should be restricted or placed behind a VPN. High means exposing it to the whole internet is a well-known cause of breaches.
- Newest hits appear at the top while the scan streams.
Why the scan runs on the server
A browser cannot open raw TCP connections to arbitrary ports: a page served over HTTPS is not allowed to connect to tcp:// or ws:// targets, which rules out the mixed content rules. The public scanner APIs (hackertarget, portchecker.io) do not send CORS headers, so a browser cannot call them either.
The TCP connections are therefore opened from the webhost running this site. Your browser only receives the results over the ordinary HTTPS connection it already had open.
References
Every row links to at least three independent third-party sources so you can verify the claims:
- nmap-services — the service name database shipped with Nmap.
- Wikipedia — list of TCP and UDP port numbers.
- IANA — the official Service Name and Transport Protocol Port Number Registry.
Where one exists, a relevant RFC or vendor document is linked as well.
Interpreting the result correctly
- A closed port and a filtered port look identical from the outside. If a host drops packets silently, the scanner reports the port as not listening.
- An open port tells you a service accepted a connection. It says nothing about whether that service is configured safely.
- Results change over time. A scan from a different network, or after a configuration change, can look completely different.
- Scan only hosts you own or are authorised to test. Port scanning is illegal in many jurisdictions without permission.