Port Scanner

Check whether common or custom TCP ports are open on a host or IP address.

Enter a host name or IP address to begin.

Port bundles - choose at least one, or enter custom ports below

Common Ports 21, 22, 23, 25, 53, 80, 110, 143, 443, 465, 587, 993, 995, 1433, 1521, 3306, 3389, 5432, 6379, 8080, 8443 Web Services 80, 443 Email 25, 110, 143, 465, 587 Remote Access & Management 22, 23, 3389 File Transfer 20, 21, 445 Core Infrastructure 53, 67, 68, 123

Custom ports (optional)

Digits and commas only, e.g. 22,80,443. Bundles and custom ports combine into one scan (max 40 ports total) - select at least one bundle or enter at least one custom port.

Reference

Understanding Port Scans

A port scan checks whether a host accepts TCP connections on specific ports - useful for confirming a firewall rule actually works, or that a service you meant to expose (or lock down) is doing what you expect.

Open, closed, and filtered: Open means a real service answered the connection attempt. Closed means the host actively refused it (a real, reachable machine with nothing listening on that port). Filtered means neither happened - no response at all within the check window, almost always a firewall silently dropping the packet rather than a slow or missing service.
Port bundles: A curated set of ports for one common purpose - Web Services, Email, Remote Access, File Transfer, Core Infrastructure - so you can check web ports without typing 80 and 443 by hand. Select as many as you need; they combine into one scan alongside any custom ports you add.
Well-known ports: Ports 0-1023 are reserved by IANA for standard services - 22 for SSH, 80 for HTTP, 443 for HTTPS - so most software expects them there by default. Ports above that are free for anything, including a service deliberately run on a non-standard port.
Why this matters: An open port that shouldn't be reachable from the internet - a database, an admin panel, a dev server - is one of the most common ways a system gets compromised. This check is the same firewall-verification step a real attacker's own reconnaissance would run first.

Checking one specific service's own certificate instead? See SSL Checker.