A packet sent here never reaches a cable. The kernel turns it around before it touches the network card. It is the most-used address on Earth and the only one guaranteed to mean you. This is a field guide to it — where the number came from, why IPv4 burned 16.7 million addresses on a job that needed one, and every strange way to spell it.
127.1, 2130706433 and 0x7f000001 are all the same address.
That's inet_aton(): when you give it fewer than four parts, the last one
absorbs all the remaining bytes — and every part may be decimal, octal (leading zero)
or hex (0x). Type anything below and watch it resolve. This is the real
algorithm, not a lookup table.
A special-use domain name (RFC 6761, 2013). Resolvers are supposed to answer it locally and never send it to a DNS server.
It can resolve to ::1 before 127.0.0.1. If your server
bound only to IPv4, localhost fails while 127.0.0.1 works.
That's the classic "connection refused" that makes no sense.
One specific IPv4 loopback address out of 16,777,216. No name resolution involved, no ambiguity, IPv4 only.
Routers must drop any packet with a 127/8 address that appears on a real network (RFC 1122). It cannot travel.
Not a destination. When a server binds it, it means "every interface I have" — which is why your dev server is suddenly reachable from the coffee shop wifi.
In Aug 2024 Oligo Security showed browsers would let a public website POST to 0.0.0.0 and land on your localhost services. An 18-year-old hole. Windows was immune — it blocks it at the OS.
IPv4 has about 4.3 billion addresses and we ran out. One in every 256 of them is
reserved for talking to yourself. IPv6 looked at this and assigned exactly one:
::1/128. There is an active IETF draft to claw most of 127/8 back for
normal unicast use.
Every cell is 65,536 addresses. The lit one is
127.0.0.1. On Linux the whole block already answers — try it.
—
Jon Postel lists network 127 as "reserved" — and doesn't say what for.
His habit was to hold back the first and last network of every class. Class A ran 0–127,
so 127 was simply the last one on the shelf. No technical reason. No plan.
Bill Joy and Sam Leffler wire 127.0.0.1 into the loopback code.
4.2BSD spreads everywhere, and the convention becomes fact by shipping — the way most
standards actually happen.
Postel and Joyce Reynolds write down what the code has already been doing for three years. The documentation catches up with the implementation.
The rule gets teeth: 127.0.0.0/8 is the internal host loopback
address, and it must never appear on a network outside the host. A whole Class A,
locked, forever.
Learning from the waste, IPv6 assigns loopback exactly one address out of 340 undecillion. Sixteen million down to one.
"localhost" becomes an official special-use domain name. Resolvers should answer it themselves and never leak it to a DNS server — which, in practice, they sometimes still do.
Oligo Security discloses that Chrome, Firefox and Safari all let public
websites reach services on your machine through 0.0.0.0, sidestepping CORS
and Private Network Access. The bug was roughly 18 years old.
An IETF draft proposes returning most of 127/8 to ordinary use, keeping only what's actually needed. Forty years on, someone is finally trying to tidy up.
| address | what's listening | # note |
|---|---|---|
| 127.0.0.1:3000 | a Node app | # the default default |
| 127.0.0.1:5173 | Vite | # the new 3000 |
| 127.0.0.1:8080 | something in Java, probably | # or a proxy you forgot |
| 127.0.0.1:5432 | PostgreSQL | # still running from last year |
| 127.0.0.1:6379 | Redis | # do not expose this one. ever. |
| 127.0.0.1:631 | CUPS | # your printer has a web server. it has opinions. |
| 127.0.0.53:53 | systemd-resolved | # yes, that's a different loopback address |
| 127.0.0.1:11434 | Ollama | # the GPU is warm for a reason |
Browsers treat http://localhost, 127.0.0.0/8 and ::1/128
as potentially trustworthy origins. That's why service workers, getUserMedia
and the other HTTPS-only APIs work on your dev server without a certificate. The reasoning is
simple: the bytes never left your machine, so there was nothing to intercept.
type help · ↑ for history · everything runs in your browser and touches nothing