NETWORK
localhost and 127.0.0.1The loopback address
127.0.0.1 is the IPv4 loopback address: traffic sent to it never leaves the computer and is delivered back to a service on the same machine. localhost is the hostname that resolves to it (and to ::1 for IPv6). Developers use it to run and test servers privately, and services bound to 127.0.0.1 are unreachable from the network.
What loopback does
Every TCP/IP stack has a virtual interface that hands packets straight back to itself. Sending to 127.0.0.1 exercises the full network stack, ports, sockets and firewall rules included, without any cable or Wi-Fi. That makes it the standard way to:
- Run a development web server and open it in a browser (
http://localhost:3000/). - Let an application talk to a database on the same machine without exposing the database to the network.
- Test that a service is listening before troubleshooting the network path.
- Address the machine itself in configuration files.
localhost versus 127.0.0.1
localhost is a name. RFC 6761 reserves it, and operating systems resolve it internally to 127.0.0.1 and ::1 without consulting DNS. Windows still ships a hosts file (C:\Windows\System32\drivers\etc\hosts) containing the mapping as a comment; the resolver handles the name itself.
Because localhost may resolve to IPv6 first, a service bound only to 127.0.0.1 can produce "connection refused" when accessed by name. Use the address explicitly, or make the service listen on both families.
Binding and exposure
| Bind address | Reachable from |
|---|---|
| 127.0.0.1 | This machine only |
| ::1 | This machine only (IPv6) |
| 192.168.1.50 (a specific interface) | That network only |
| 0.0.0.0 or :: | Every interface, including public ones |
Development servers on ports such as 8000, 3000 and 8080 should bind to loopback unless sharing is intended. Docker's -p 8080:8080 binds to 0.0.0.0; use -p 127.0.0.1:8080:8080 for local-only.
Checking
ping 127.0.0.1
netstat -ano | findstr 127.0.0.1A failed loopback ping means the TCP/IP stack itself is damaged, which is rare; netsh int ip reset repairs it. The netstat line shows every service that is listening on loopback only, useful for confirming that a database is not exposed.
Security notes
- A service on loopback is safe from the network but not from other users or malware on the same machine.
- Browsers treat
localhostas a secure context, so features that require HTTPS (service workers, some APIs) work over plain HTTP there. - Some malware edits the hosts file to redirect security-vendor domains to 127.0.0.1; a hosts file with unexpected entries is worth investigating.
Frequently asked questions
What is the difference between 127.0.0.1 and 0.0.0.0?
As a listening address, 127.0.0.1 accepts connections only from the same machine; 0.0.0.0 accepts connections on every interface, including from the network. As a destination, 0.0.0.0 is not valid.
Why does localhost resolve to ::1 sometimes?
Modern systems resolve localhost to both ::1 and 127.0.0.1 and may try IPv6 first. A server listening only on 127.0.0.1 can then appear unreachable via the name; connect to 127.0.0.1 explicitly or bind the server to both.
Can I use 127.0.0.2?
Yes. The entire 127.0.0.0/8 range loops back on Windows and Linux, which lets you run several services on the same port on different loopback addresses. macOS only configures 127.0.0.1 by default.