Generate cryptographically secure random TCP/UDP port numbers — pick an IANA range or your own, draw up to 100 at once, skip browser-blocked and well-known ports, and see what each port is normally used for. Free, instant, and everything runs in your browser.
Generate random ports
Port range
Options
Common ports reference
The ports most likely to collide with an existing service. The generator can skip all of these with the “avoid common service ports” option.
Port
Service
IANA category
20
FTP (data)
Well-known
21
FTP (control)
Well-known
22
SSH
Well-known
23
Telnet
Well-known
25
SMTP
Well-known
53
DNS
Well-known
67
DHCP (server)
Well-known
68
DHCP (client)
Well-known
69
TFTP
Well-known
80
HTTP
Well-known
110
POP3
Well-known
119
NNTP
Well-known
123
NTP
Well-known
135
RPC endpoint mapper
Well-known
137
NetBIOS (name service)
Well-known
138
NetBIOS (datagram)
Well-known
139
NetBIOS (session)
Well-known
143
IMAP
Well-known
161
SNMP
Well-known
162
SNMP trap
Well-known
194
IRC
Well-known
389
LDAP
Well-known
443
HTTPS
Well-known
445
SMB
Well-known
465
SMTP (SSL)
Well-known
514
Syslog
Well-known
587
SMTP (submission)
Well-known
636
LDAP (SSL)
Well-known
993
IMAP (SSL)
Well-known
995
POP3 (SSL)
Well-known
1080
SOCKS proxy
Registered
1194
OpenVPN
Registered
1433
MS SQL Server
Registered
1521
Oracle DB
Registered
2049
NFS
Registered
3000
Dev server (common default)
Registered
3306
MySQL
Registered
3389
RDP
Registered
5000
Dev server (Flask, common default)
Registered
5432
PostgreSQL
Registered
5900
VNC
Registered
6379
Redis
Registered
8000
HTTP (alt, dev)
Registered
8080
HTTP (alt / proxy)
Registered
8443
HTTPS (alt)
Registered
9000
Dev server (common default)
Registered
9200
Elasticsearch
Registered
11211
Memcached
Registered
27015
Game server (Steam, common default)
Registered
27017
MongoDB
Registered
Browser-blocked ports (ERR_UNSAFE_PORT)
Chrome, Edge, Opera and Firefox refuse to load http(s):// on these ports because they belong to legacy or abuse-prone services. If your app is ever opened in a browser, pick a port outside this list.
Extra ports Chrome blocks (NAT Slipstreaming mitigations)
6913716155417191720172350605061656610080
How it works
IANA divides the 65,536 TCP/UDP ports (0–65535) into three ranges: well-known (0–1023) for core system services like HTTP and SSH, registered (1024–49151) for user applications like MySQL and RDP, and dynamic/private (49152–65535) which are never assigned and are the safest default for anything new. This tool draws from your chosen range with crypto.getRandomValues — the browser's cryptographically secure RNG — using rejection sampling so every port in the range has exactly equal probability. No modulo bias, no server, no tracking.
Frequently asked questions
Well-known ports are ports 0 through 1023, assigned by IANA to core system services. Examples you meet every day: 80 (HTTP), 443 (HTTPS), 22 (SSH), 25 (SMTP), 53 (DNS) and 21 (FTP). On most operating systems you need administrator or root privileges to bind a program to a well-known port, which is one reason applications usually avoid them.
Registered ports (1024-49151) are assigned by IANA to specific user applications — MySQL uses 3306, RDP uses 3389, PostgreSQL uses 5432, VNC uses 5900 — while dynamic/private ports (49152-65535) are never assigned to any service. Registered ports are safe for apps whose number is documented and stable; dynamic ports are the default choice when you just need a free number that conflicts with nothing.
Ephemeral ports are the temporary ports your operating system picks automatically from the dynamic/private range (49152-65535) for the client side of an outbound TCP or UDP connection. Every connection needs a unique source port so replies can be routed back, and picking them at random makes it harder for attackers to predict and hijack sessions. That is why the dynamic range is the default range in this generator.
Avoid three groups. First, the well-known ports 0-1023, which need elevated privileges and are already claimed by system services. Second, ports your browser refuses to load with ERR_UNSAFE_PORT (for example 21, 22, 23, 25, 53, 135, 139, 143, 587, 6665-6669 and 10080) — handy if your app is ever opened in a browser. Third, whatever is already listening on the machine itself; a random pick from the dynamic range 49152-65535 plus a quick local check with netstat, ss or lsof is the practical recipe.
Chrome, Edge, Opera and Firefox block network access to a list of ports that belong to legacy or abuse-prone services (SMTP on 25, SSH on 22, NetBIOS name/session on 137 and 139, IRC on 6665-6669 and others). When you type an address like http://example.com:6667 the browser refuses with ERR_UNSAFE_PORT instead of connecting. Enable the 'avoid browser-blocked ports' option here to never draw one of those.
Yes to the first, no to the second. Ports are drawn with crypto.getRandomValues, the browser's cryptographically secure random number generator, using rejection sampling so every port in the range has exactly equal probability. Everything runs in your browser: no request, no logging, no cookies, no server ever sees the ports you generate.
No — a web page cannot scan your machine's ports, and you would not want a site that tried. A generated port is a conflict-free pick from the IANA ranges, not a guarantee it is unused locally. On Linux or macOS run 'ss -tlnp' or 'lsof -i :PORT'; on Windows run 'netstat -ano | findstr :PORT' to confirm your pick is free before binding a service to it.
We use cookies and third-party services (including Google AdSense) to personalize content, analyze traffic, and serve relevant ads. By clicking "Accept", you consent to our use of cookies as described in our Privacy Policy.
Report an issue
2 taps, no typing needed — diagnostics are sent automatically.