Free tools Windows power users keep installed
One-click scans. No signup required.
For a quick check of whether a service is reachable from the public internet, use a scanner that tests the specific port from outside your network. For a broader authorized assessment, choose one that supports custom or larger port ranges. An online result describes what that scanner could observe from its own network; it does not by itself prove that a service is absent or secure.
Which online port scanner should you use?
Choose based on the question you need answered, not a claim that one scanner is universally the most accurate. A single-port check is usually enough to troubleshoot port forwarding. A common-port scan can quickly identify exposed services. A wider or custom scan is more appropriate for an authorized perimeter review.
| Scanner | Best fit | Ports and protocols | Other useful details |
|---|---|---|---|
| HackerTarget Online Nmap Scanner | Broader external assessment | Free scan checks ten common TCP ports; paid capabilities include all 65,535 TCP ports, UDP, and custom selections | Paid capabilities described by HackerTarget include scheduled scans, reports, IPv6, and API access |
| ViewDNS Port Scanner | Quick check of named, common services | Tests 15 listed ports: 21, 22, 23, 25, 80, 110, 139, 143, 445, 1433, 1521, 3306, 3389, 8080, and 8443 | Focused list; it does not establish the state of ports outside that list |
| DNSChecker Online Port Checker | Custom-port and forwarding checks | Accepts custom port lists and TCP or UDP choices, plus common-port presets | Reports open, closed, or timed-out/blocked outcomes |
| PortChecker.co | One-port check and router-forwarding diagnosis | Checks a specific port | Can use the visitor’s current IP or another IP; describes how blocked ports can affect application or game connectivity |
| YouGetSignal Open Port Check Tool | Simple external check, including a selectable region | Checks a port on an IP address or domain | Documents use for forwarding, firewall troubleshooting, and server-application problems |
| IPVoid TCP Port Scanner | Authorized TCP checks with common or custom ports | TCP; accepts common or custom ports and IPv4 or IPv6 input | IPVoid says the service uses Nmap and limits scans to addresses the user controls or is authorized to test |
For a fast forwarding diagnosis, start with PortChecker.co, YouGetSignal, or DNSChecker using the exact port and protocol your application needs. For a listed set of common services, ViewDNS is a narrow option. HackerTarget offers a path to broader scans and monitoring capabilities; IPVoid is a TCP option when IPv4/IPv6 input or custom ports matter. The options and capabilities above are those described by the services and project documentation accessed in 2026; availability and plan details can change.
How to check whether a port is open from outside your network
- Confirm the public target. Check that the hostname resolves to the public IP address you intend to test. If your domain points to an old address, a scan can correctly report the wrong system’s state.
- Start with the smallest useful scan. For forwarding, test one port and the protocol required by the application. Use a common-port list for a quick exposure check. Use custom or broad scans only when you are authorized and need that scope.
- Make sure the service is actually listening. A router rule alone does not create a service. The application must be running on the intended device and listening on the relevant port; the host firewall must also allow the traffic.
- Run the test externally. Use an online scanner to test the public IP or hostname. An external test is useful because a check from inside the LAN can follow a different route and may not exercise the public firewall and NAT path.
- Interpret the result in context. Open indicates that the scanner observed an accepting application. Closed means it could reach the target but found no application listening on that port. Filtered or timed out means the scanner could not determine the port’s state; it is not proof that no service exists.
- Change one setting at a time and retest. If you change a forwarding rule, firewall rule, or service configuration, test again from an external vantage point. This distinguishes a configuration change from unrelated differences in the scan path.
What open, closed, filtered, and timed out mean
Nmap defines an open port as one where an application is actively accepting connections. A closed port is reachable, but no application is listening. A filtered state means packet filtering prevents the scanner from deciding whether the port is open. Nmap also uses the states unfiltered, open|filtered, and closed|filtered; a web tool may present only a simpler subset of these outcomes.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- VERSATILE CABLE TESTING: Cable tester for data (RJ45) terminated cables and patch cords, ensuring comprehensive testing capabilities
- LARGE BACKLIT LCD: Backlit LCD display enables easy reading of pin-to-pin wiremap results, even in low-lit areas
- COMPREHENSIVE FAULT DETECTION: Test for Open, Short, Miswire, Split-Pair faults, Cross-over, and Shield, providing thorough fault detection
- INTUITIVE USER INTERFACE: User-friendly interface with three buttons and simple, easy-to-identify test responses, ensuring a smooth testing experience
- MULTIPLE TONE GENERATOR STYLES: Tone on a single wire, wire pair, or all 8 conductor wires using the multiple style tone generator (solid/warble); requires probe Cat. No. VDV500-123 (sold separately)
These labels describe the scanner’s observation, not an absolute property of the destination. Results can differ between an online test and a test on the local network because of firewall rules, routing, NAT, the scanner’s source location, and the scan method. A timeout is therefore inconclusive: traffic may be dropped by a firewall, the service may be unavailable, or the route may not permit a response.
Why port forwarding checks fail
The service is not listening
Forwarding traffic to a device does not start its server. Verify that the application is running, configured for the expected port and protocol, and bound to an interface reachable through the device’s network address. A closed result commonly points to no listener on the destination, though the scanner’s vantage point still matters.
Rank #2
- VERSATILE CABLE TESTING: Cable tester tests voice (RJ11/12), data (RJ45), and video (coax F-connector) terminated cables, providing clear results for comprehensive testing on unenergized Ethernet cables (not designed to test PoE)
- EXTENDED CABLE LENGTH MEASUREMENT: Measure cable length up to 2000 feet (610 m), allowing for precise cable length determination
- COMPREHENSIVE FAULT DETECTION: Test for Open, Short, Miswire, or Split-Pair faults, ensuring thorough fault detection and identification
- BACKLIT LCD DISPLAY: Backlit LCD screen displays cable length, wiremap, cable ID, and test results, ensuring easy readability in various lighting conditions
- EFFICIENT CABLE TRACING: Trace cables, wire pairs, and individual conductor wires using the multiple style tone generator (requires analog probe Cat. No. VDV500-123, sold separately), simplifying cable tracing tasks
The router rule points to the wrong device or port
Check the destination’s current local IP address and compare it with the router’s forwarding rule. A changed DHCP address can leave the rule aimed at another device. Confirm that the external port maps to the internal port the application actually uses.
A firewall or upstream network drops traffic
Review the router firewall and the destination device’s firewall. Some internet providers or upstream networks may also affect inbound reachability. A filtered or timed-out result cannot identify which layer is responsible; check the rules and service configuration rather than treating the status as a diagnosis.
Recommended Free Tools
Rank #3
- Multifunctional NOYAFA NF-8508 Network Cable Tester: There are nine features to meet your needs. Continuity Testing, Cable Scan, Port Flash, Length Measurement, POE Power Supply Test, QC testing, Optical Power Meter, VFL and NVC function.It is perfectly suited for various engineering cabling projects, network troubleshooting, network equipment maintenance and testing scenarios. Its precise cable scanning and fault localization capabilities help you effortlessly pinpoint the root cause of issues.
- 7 WAVELENGTHS OPTICAL POWER METER: NF-8508 network cable tester can measure 7 standard wavelengths, 850/1300/1310/1490/1550/1625/1650, power detecting range(dBm): -70 ~ +10. Its power detection range spans from -70 dBm to +10 dBm, supporting FC/SC/ST connectors. It enables precise fiber optic power measurement, helping users efficiently assess fiber signal strength and ensure healthy fiber link operation. It effortlessly detects attenuation issues within fibers, thereby safeguarding fiber network stability.
- High Efficiency Visual Fault Locator: Easy identification of fiber breakpoints, poor connections, bending or cracking. Excellent for finding the right fiber to splice or quickly finding a break. Emmiting Energy: standard wavelenth: 650nm. Fast flashing, slow flashing, high precison.The built-in self-calibration ensures stable long-term performance, and Class IIIa laser (output<5mW) ensures safe daily operation.
- PORT FLASHING:The indicator light on the connection port in the NF-8508 device flashes to help accurately locate the cable. Displays port information, including operating speed, duplex mode, and negotiation settings. Port lights flash on the same screen to show the port's operating speed, making it easy to pinpoint lines and ports.
- PoE Testing and Cable Length Test: PoE testing can check cable mapping polarity and voltage of PoE network switches, withstand 60VDC. Automatically detects and switches between 10M/100M/1000M modes, Includes cable tracking, short circuit test, interruption of circuit test and etc The RJ45 cable tester can quickly measure the length of the cable with a range of 200m. Not only network cables, but also phone lines and BNC cables.
The hostname or public address is wrong
Confirm that the domain resolves to the intended current public address. If you have multiple internet connections, a changing public IP, or a proxy in front of the service, make sure you are testing the address that actually receives inbound traffic.
The protocol does not match
TCP and UDP are different protocols. If an application requires UDP, a TCP-only check cannot establish that its UDP port is reachable. Select the protocol supported by both the application and the checker. A result from one protocol should not be generalized to the other.
Rank #4
- Automatically runs all tests and checks for continuity, open, shorted and crossed wire pairs. Visible LED status display.
- Cable state testing (2-wire): Line DC detecting, anode and cathode determination,Ringing signal detecting open, short and cross circuit testing
- Cable Type: RJ11 Telephone cable and RJ45 LAN cable
- Connectors: Ethernet Cat 5, Ethernet Cat 5e, Ethernet Cat 6, Ethernet Cat 7, RJ11 6P and RJ45 8P
- Power Source: DC9V Battery Required (not included)
How to choose scan scope safely
- One port: use this for a specific game server, remote-access service, or application that is not reachable from the internet.
- Common ports: use a preset or fixed common-port list when you want a quick check for familiar services. A clean result on that list says nothing about untested ports.
- Custom ports: enter the exact ports relevant to your services or authorized review. DNSChecker accepts custom lists and TCP/UDP selection; IPVoid offers common or custom TCP checks.
- Broader scanning: HackerTarget describes paid options for all 65,535 TCP ports, UDP, custom selections, scheduling, reports, IPv6, and API access. Nmap’s documented default behavior is to scan the 1,000 most common TCP ports, not every port.
Only scan systems you own or are explicitly authorized to test. HackerTarget instructs users to obtain permission, and IPVoid’s terms restrict scanning to IP addresses under the user’s control or authorization. The fact that a scanner is publicly accessible does not grant permission to test someone else’s network.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do if you find an unexpected open port
- Identify the application or service listening on the port and whether it needs public access.
- If it is not needed, stop or disable the service and remove the forwarding rule or block inbound access with firewall rules.
- If it is needed, restrict exposure where practical, require authentication, and keep the service patched.
- Retest externally after the change. A port that no longer accepts connections should not be treated as proof that every related exposure is resolved; verify the specific service and configuration you changed.
Or skip the browser setup
ScreenshotNeo is a website screenshot API and MCP server, not a port scanner, so it cannot check whether a network port is open or diagnose forwarding. It is the alternative to try first only if your separate task is capturing web pages: a single GET request can return a PNG, JPEG, WebP, or PDF. Cookie/consent banners are accepted like a visitor and more than 60 known consent platforms, newsletter popups, and chat widgets can be removed before capture; each step can be turned off. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed, with outcomes identified in response headers. Its MCP server offers tools for AI agents to take screenshots, get page information, and capture PDFs. The free plan includes 1,000 screenshots a month with no card; paid plans start at $5 for 3,000. See the ScreenshotNeo website and API documentation.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSign up for ScreenshotNeo’s free plan: 1,000 screenshots a month, no card required.
Best Value
- Multi-Function Network Cable Tester: Supports RJ45 (CAT5, CAT5e, CAT6, CAT6A, CAT7) and RJ11 telephone cables. Quickly detects continuity, short circuits, open wires, miswiring, and cable shielding status, ensuring your LAN or phone lines are correctly wired and ready to use.
- Fast/Slow Mode with LED Indicators: Switch between fast and slow scan speeds to identify wiring issues more precisely. LED lights on both master and remote units show wire order, making it easy to spot errors like open pairs or misaligned pins at a glance.
- Split-Type Design for Long-Distance Testing: Master and remote units can be detached and used separately, allowing you to test both ends of a long cable run, ideal for wall-mounted ports, long runs, or structured cabling. Perfect for home, office, or professional IT setups.
- Compact, Lightweight & Durable: Ergonomically designed with sturdy ABS housing, this pocket-sized tester is ideal for on-the-go network engineers, DIYers, and electricians. It’s your go-to toolkit for cable maintenance, upgrades, or new installations.
- Safe & Easy to Use: Simple one-button operation makes testing quick and hassle-free. LED indicators clearly show wiring status, while the G light instantly identifies shielded (FTP/STP) or unshielded (UTP) cables. Supports safe testing of telephone lines with typical voltages under 48-72V, ideal for both home and professional use.
Frequently Asked Questions
Does an open-port result mean the service is safe?
No. It means the scanner observed an application accepting connections. Whether exposure is appropriate or secure depends on the service and its configuration.
Does a timeout prove that my port is closed?
No. A timeout or filtered result is inconclusive: filtering or the network path may prevent the scanner from determining the port state.
Can an online scanner test a private LAN address?
An external scanner tests from its own network, so private addresses that are not publicly routable are generally not reachable from it. Use a test from the relevant network for internal-only services.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
