Port 443: HTTPS
Port 443 is HTTPS, and the honest answer to whether it is TCP or UDP is both. HTTP/1.1 and HTTP/2 use TCP 443; HTTP/3 uses QUIC over UDP 443. IANA assigns the https service on TCP, UDP and SCTP at port 443.
| Port number | 443 |
|---|---|
| Service | HTTP over TLS |
| Protocol | TCP/UDP |
| Category | Web |
| Default encryption | Yes (TLS/SSH) |
| IANA service name | https |
| IANA transports | TCP, UDP, SCTP |
| Used in practice | TCP, UDP |
Why does port 443 now carry both TCP and UDP traffic?
For most of the web's history it was TCP only. A browser opened a TCP connection to port 443, performed a TLS handshake, and sent HTTP inside it. That is how HTTP/1.1 and HTTP/2 work and it is still the majority of traffic.
HTTP/3, standardised as RFC 9114 in 2022, changed the transport. It runs over QUIC, which is built on UDP, and it uses the same port number: UDP 443. QUIC moves loss recovery, congestion control and the TLS 1.3 handshake into userspace on top of UDP, which removes a round trip and stops one lost packet from stalling every stream in a connection.
In practice both are live at once. A server advertises HTTP/3 with an Alt-Svc header or an HTTPS DNS record, and a browser that supports it switches to UDP 443 for subsequent requests. So a firewall rule for a modern web service should allow TCP 443 and, if you want HTTP/3, UDP 443 as well. Blocking UDP 443 does not break anything visibly; clients simply fall back to HTTP/2, which is why the misconfiguration so often goes unnoticed.
Can HTTPS run on a port other than 443?
Yes. 443 is only the default, which means it is the port a browser assumes when a URL has no port in it. Nothing stops HTTPS from running elsewhere, and https://example.com:8443 is perfectly valid.
Non-default ports show up constantly in practice: 8443 for admin consoles and Java application servers, 9443 for various enterprise tools, and arbitrary high ports in development. What makes something HTTPS is the TLS handshake, not the port number.
The reverse is also true and matters more for security: something answering on port 443 is not necessarily HTTPS. Because 443 is the one port almost never blocked, tunnels, VPNs and command-and-control channels deliberately use it to blend in with ordinary web traffic.
Why is port 443 the number it is?
There is no technical significance to 443. It was simply the next suitable free number in the well-known range when Netscape needed a registered port for HTTP over SSL in the mid-1990s, and IANA recorded it as https, described in the registry as http protocol over TLS/SSL.
That is worth knowing mainly because it dispels the common assumption that these numbers encode something. Port 80 for HTTP, 443 for HTTPS and 22 for SSH are administrative allocations, not derived values.
Which ports are related to port 443?
The port a reader usually needs next is the encrypted or plaintext twin of this one, so those are listed first rather than buried in a generic list.
| Port | Relationship | Why it matters |
|---|---|---|
| 80 | plaintext | Plain HTTP. Usually kept open only to redirect to 443 and to answer ACME certificate challenges. |
| 8443 | alternate | The conventional unprivileged HTTPS port for admin consoles and app servers. IANA actually registers 8443 to pcsync-https. |
| 853 | companion | DNS over TLS. DNS over HTTPS deliberately shares port 443 instead, so it is indistinguishable from web traffic. |
What commonly listens on port 443?
- nginx, Apache httpd, Caddy, IIS and every other web server
- Cloud load balancers and CDN edges terminating TLS
- APIs, gRPC services and WebSocket endpoints
- VPNs and tunnels deliberately using 443 because it is the one port that is never blocked
How do I check whether port 443 is open?
Port 443 carries TCP, so a connection either completes its handshake or it does not, which makes the check definitive.
| Question | Command | What to know |
|---|---|---|
| Is it open on a remote host? | nc -vz example.com 443 | A TCP handshake either completes or it does not, so netcat gives a definitive answer in one line. |
| Same check on Windows | Test-NetConnection example.com -Port 443 | Built into PowerShell. TcpTestSucceeded in the output is the answer; telnet is not installed by default on modern Windows. |
| What is listening locally? | ss -tlnp | grep ':443 ' | Lists the process bound to port 443 on Linux. On macOS use lsof -nP -iTCP:443 -sTCP:LISTEN, on Windows netstat -ano | findstr :443 |
| Is it open on a remote host? | sudo nmap -sU -p 443 example.com | UDP has no handshake, so there is nothing to complete. nmap infers the state from whether an ICMP port-unreachable comes back, needs root, and is slow and easy to misread. A silent port may be open, filtered, or simply not replying to a probe it does not recognise. |
| What is listening locally? | ss -ulnp | grep ':443 ' | Shows the UDP socket bound to port 443. This is the reliable way to answer the question, because you are asking the host itself rather than guessing from outside. |
Replace example.com with the host you are testing. A blocked port and a port with nothing listening on it look identical from the outside, so if a service should be running, check locally before blaming the firewall.
Frequently asked questions
Is port 443 TCP or UDP?
Both. HTTP/1.1 and HTTP/2 use TCP 443, and HTTP/3 uses QUIC over UDP 443. IANA assigns the https service on TCP, UDP and SCTP at port 443. For a modern web service allow TCP 443, and also UDP 443 if you want HTTP/3; blocking UDP 443 silently downgrades clients to HTTP/2 rather than breaking them.
Is HTTPS always on port 443?
No. 443 is only the default a browser assumes when the URL contains no port. HTTPS runs perfectly well on other ports, commonly 8443 for admin interfaces and application servers. What makes a connection HTTPS is the TLS handshake, not the port number.
What is the difference between port 443 and port 80?
Both carry HTTP, but port 443 wraps it in TLS so the request, the response and the URL path are encrypted, while port 80 sends everything in clear text. Modern sites keep port 80 open only to redirect visitors to 443 and to answer certificate-renewal challenges.
Does port 443 need to be open for HTTP/3?
UDP 443 does. HTTP/3 runs over QUIC, which is a UDP protocol using the same port number as HTTPS. If your firewall permits only TCP 443, HTTP/3 negotiation fails and clients fall back to HTTP/2 over TCP.
What is port 443 used for?
Port 443 is HTTPS, and the honest answer to whether it is TCP or UDP is both. HTTP/1.1 and HTTP/2 use TCP 443; HTTP/3 uses QUIC over UDP 443. IANA assigns the https service on TCP, UDP and SCTP at port 443.
Is port 443 secure?
Yes. Port 443 carries encrypted traffic by default, so data in transit is protected.
Should I open port 443 on my firewall?
Only if you specifically need HTTPS. Expose it to the smallest set of trusted sources, and never open database or Windows-service ports to the whole internet.