Home Assistant Default Port: 8123 (and When to Use 443)

Knowing which port Home Assistant listens on takes a minute to learn and can save you an afternoon of lockouts — or a permanently open door into your smart home. The Home Assistant default port is 8123, serving plain HTTP from the moment the system finishes its first boot. The number most people assume is the default, 443, is not a Home Assistant default at all: it only appears once you deliberately put encryption in front of the dashboard. Get those two straight and you know exactly what to type into a browser, what (if anything) to forward through your router, and which of five remote-access routes actually suits your setup.

This page is about ports, listeners and configuration only. The hardware that runs Home Assistant is a separate question, and nothing below assumes a particular box, board or virtual machine.

Every relevant port at a glance

Port data as of Home Assistant 2026.x. Every value above is drawn from the IANA Service Name and Transport Protocol Port Number Registry, the official Home Assistant http integration documentation, or the vendor documentation named in the row.

The default is 8123 — what that actually means

The web interface is served by Home Assistant’s http integration, and its documented default port is 8123, over plain HTTP. The address quoted in the official onboarding flow — and in almost every getting-started guide — is http://homeassistant.local:8123. Dashboards, Developer Tools, the Settings menus and the panels you open from the sidebar are all served from that single port. Everything else in the table exists for a specific add-on or integration rather than for the core interface.

Two details do most of the work in practice.

It binds to every interface. Home Assistant does not restrict its listener to loopback or to one network card, so port 8123 answers on whatever addresses the machine holds. What keeps it off the internet is your router’s NAT — network address translation — which simply has no inbound rule pointing at it. That distinction matters enormously: the protection is your router’s default behaviour, not something Home Assistant enforces on its own. Add a single port-forwarding rule and you have removed the only thing standing between 8123 and the public internet.

It is not the port you forward. Home Assistant’s own “Securing Home Assistant” documentation discourages publishing 8123 directly. The alternatives, in order of how little you have to expose, are set out further down this page.

Port 443: HTTPS, but never a Home Assistant default

Port 443 is IANA’s registered default for HTTPS, which is why browsers assume it when you type https:// and specify no port number. It becomes relevant to Home Assistant only through one of three deliberate additions: a reverse proxy, a tunnel, or Home Assistant Cloud. A bare Home Assistant instance never listens there.

Traffic on 443 is wrapped in TLS, the encryption protocol whose current specification is RFC 8446; MDN’s HTTPS reference explains the same handshake in plainer language for anyone who wants the short version. Without it — that is, on 8123 over an open connection — your usernames, session tokens and the entire contents of your dashboard travel in cleartext. That is the whole reason the remote-access hierarchy below exists.

The rest of the port map, number by number

Port 80 — Let’s Encrypt HTTP-01 challenges

IANA registers port 80 as the default for plain HTTP. Certificate authorities that validate a domain through the HTTP-01 challenge fetch a token from your server over that port, so in a typical reverse-proxy setup port 80 is kept available for certificate issuance while ordinary requests are redirected to 443. If nothing is listening on 80, HTTP-01 validation cannot complete and the certificate is never issued — which is why a misconfigured firewall produces renewal failures rather than an obviously broken dashboard.

Port 1883 — Mosquitto MQTT broker add-on

IANA registers 1883 for MQTT. If you run the Mosquitto broker add-on, this is where it accepts connections: MQTT is a publish-and-subscribe protocol, so every device that reports a reading, and every integration that listens for one, needs a route to that single port. Because the broker sits in the middle rather than each device talking to each other, one listener on 1883 covers your entire MQTT estate.

Port 6052 — ESPHome dashboard

ESPHome’s own documentation lists 6052 for its dashboard, the web page where firmware is written, compiled and pushed to ESP-based boards. It is a build-and-flash surface rather than the runtime path your devices use to report state, so it is normally accessed from your own network and rarely needs to be reachable from outside.

Port 21063 — HomeKit Bridge (not 51827)

This is the entry most port lists get wrong. Home Assistant’s HomeKit Bridge integration documents 21063 as the port it listens on, while 51827 belongs to the HAP accessory range more generally — it is not the bridge port. The bridge works by presenting your Home Assistant entities to Apple Home as accessories over the HomeKit Accessory Protocol, so if a forum thread or an older blog post tells you to look for 51827 on your Home Assistant host, that is the wrong number to be troubleshooting.

Port 4357 — the Home Assistant OS observer

Home Assistant OS runs an observer service on 4357, documented in the HA OS documentation. It is the most frequently overlooked entry in any Home Assistant port list because it only becomes interesting when the main instance is not answering. Knowing it exists before you need it saves a panicked forum search later.

Port 5353 — mDNS local discovery

IANA registers 5353 for multicast DNS, the mechanism behind the homeassistant.local address that the onboarding wizard hands you. When name resolution for that address fails but the raw IP address still works perfectly, mDNS traffic is usually the explanation: the instance itself is healthy, the discovery layer in front of it is not.

Why most add-on interfaces have no port of their own

This is the nugget that clears up a lot of confusion. Most add-on web interfaces are not exposed on ports of their own — they route through ingress on 8123, under paths beginning /hassio/ingress/…. That is why you will not find a tidy port number for each add-on panel you use: everything is proxied through the same 8123 listener that serves your dashboard. It also explains why changing that port has knock-on effects, which brings us to the next section.

How to change the Home Assistant port

The port is set by the http integration in your configuration.yaml file, using the server_port key. A minimal change looks like this:

http:
  server_port: 8080

The official Home Assistant http integration documentation is the source for this key and its syntax. Save the file and restart Home Assistant, and the interface comes back up on the number you chose. Three things then break, and it is worth checking all three rather than discovering them one at a time:

1. Saved bookmarks. Every link you have stored ending in :8123 — including any you have saved on phones, tablets and wall-mounted dashboards — stops resolving until the port is corrected.
2. Add-on ingress links. Ingress paths are generated from the host and port the interface is served on, so bookmarked ingress URLs and any shortcuts pointing at add-on panels need updating to match the new port.
3. Local firewall and router rules. Any rule that references 8123 must be edited too. A stale rule either blocks the new port outright or, worse, leaves a rule pointing at a port you no longer consider part of your setup.

Remote access: the security hierarchy

Start with the warning, because it is the one thing worth being blunt about: forwarding 8123 or 443 directly through your router is discouraged by Home Assistant’s “Securing Home Assistant” documentation. It is the route that exposes an unencrypted management interface to the internet. Everything below is ordered cheapest-first, and the first three options require no inbound ports at all.

1. Tailscale add-on. Free, WireGuard-based, and available in the Home Assistant add-on store. It establishes an encrypted peer-to-peer network between your devices and your instance, so there are zero inbound ports on your router and nothing new for an attacker to find.

2. Cloudflare Tunnel. The free tier works by making outbound-only connections from your network to Cloudflare’s edge, which means no forwarded ports. You get a public hostname without opening anything inbound.

3. Home Assistant Cloud (Nabu Casa). This uses an outbound connection, so it needs zero inbound ports on your router. According to the Nabu Casa billing page it is priced at approximately $6.50 per month, or around $75 per year, billed in US dollars — figures quoted in USD rather than converted to sterling.

4. Reverse proxy (NGINX or Caddy add-on). This is the point where 443 and port 80 enter your setup. You own the certificate and you own the exposure, which means the security of the arrangement is entirely down to how carefully you configure it. It also means port 80 usually has to stay reachable for HTTP-01 certificate challenges, as described above.

5. Direct port-forward. The last resort, and explicitly flagged as risky in Home Assistant’s security documentation. If you go this route you are depending on TLS, strong authentication and constant patching to protect a management interface that was designed for a trusted local network.

Frequently asked questions

Is port 8123 safe to expose to the internet? No. Home Assistant’s security documentation advises against publishing 8123 directly, because the port serves plain HTTP: credentials, session tokens and your dashboard contents travel unencrypted. What keeps the port private today is your router’s NAT rule set, not any protection built into Home Assistant. If you need remote access, use one of the outbound or tunnelled options above instead.

How do I change the Home Assistant port? Add a server_port value under the http: key in configuration.yaml — for example server_port: 8080 — then restart Home Assistant. The syntax is documented on the official http integration page. Afterwards, update your saved bookmarks, any add-on ingress links and every local firewall or router rule that referenced 8123.

Does Home Assistant support HTTPS natively? Not out of the box. A default installation listens on 8123 over plain HTTP only. To serve the interface over HTTPS you need one of three additions: Home Assistant Cloud, a tunnel such as the Tailscale or Cloudflare options, or a reverse proxy with a certificate you obtain and renew yourself. Each of those is what brings port 443 into the picture.

What port does Home Assistant Cloud use? None inbound. Home Assistant Cloud works over an outbound connection initiated by your instance, which is precisely why it needs zero inbound ports opened on your router. That is the practical advantage over a reverse proxy, where you are responsible for ports 80 and 443 yourself.

Why is my Home Assistant on a different port? Two causes account for almost every case. The first is a previous server_port setting left in configuration.yaml, which silently carries over after a migration or a restored backup. The second is Docker port remapping via the -p flag — for instance -p 8080:8123 serves the interface on 8080 while the container itself still listens internally on 8123. Check the config file first, then the container’s port mapping.

The one-line takeaway

Home Assistant listens on 8123 out of the box, on every interface, and it is your router’s NAT rather than Home Assistant itself that keeps that port off the internet. Port 443 appears only when you add a reverse proxy, a tunnel or Home Assistant Cloud — and when you do reach for remote access, the Tailscale, Cloudflare Tunnel and Home Assistant Cloud routes all avoid opening an inbound port at all.