Port 3000 – Development Server (HTTP)

TCP

Port 3000 is the most common development server port used by Node.js/Express, React (Create React App), Grafana, Gitea, and many other tools. It is unofficial – there is no IANA registration for a single service. Port 3000 is safe for local development but should never be exposed publicly without authentication. Grafana's default port 3000 is particularly commonly misconfigured.

Port Number

3000

Protocol

TCP

Service

Generic Development HTTP Server

Range

Unofficial

Description

Port 3000 became a convention for Node.js and JavaScript development servers. Create React App, Express, Fastify, NestJS, and Next.js (older versions) all default to 3000. Grafana also defaults to port 3000 for its web UI – many publicly exposed Grafana instances on port 3000 have leaked internal metrics. Always bind development servers to 127.0.0.1, not 0.0.0.0.

Security risks

1Grafana default credentials: Grafana on port 3000 ships with admin/admin login. Thousands of internet-facing Grafana instances have never changed this. Attackers read infrastructure metrics, Prometheus targets (revealing internal IPs), and datasource credentials stored in Grafana.
2React dev server source map exposure: Create React App on port 3000 serves source maps by default. An attacker reads your full unminified source code including hardcoded API keys and business logic.
3Hot Module Replacement (HMR) WebSocket: dev servers expose WebSocket endpoints for live reload. In some frameworks, HMR accepts arbitrary module imports – potential RCE if accessible from untrusted networks.
40.0.0.0 binding: many dev servers default to binding all interfaces. On a coffee shop WiFi, your React dev server is accessible to everyone on the network. Always pass --host 127.0.0.1 or equivalent.

Firewall guidance

Never expose port 3000 to the internet in any context. For Grafana specifically: change default credentials on first login, enable OAuth/LDAP auth, and reverse proxy through Nginx on 443 with TLS. For dev servers: bind to 127.0.0.1 explicitly. In Docker: do NOT use -p 3000:3000 (binds all interfaces) – use -p 127.0.0.1:3000:3000.

Diagnosis commands

Check what process owns port 3000 and its bind address

shell

ss -tnlp sport = :3000

Grafana health check (if Grafana is running)

shell

curl -s http://localhost:3000/api/health

Find the process using port 3000 (macOS/Linux)

shell

lsof -i :3000

Usage examples

Port 3000 – Development Server (HTTP)

shell

npm start  # React: http://localhost:3000
node app.js  # Express default
grafana-server --port 3000

Common services on this port

Express.jsCreate React AppNext.js (dev)GrafanaGiteaNestJSFastifyRuby on RailsSvelteKit

Related ports

8080

HTTP alternate (similar usage)

5000

Flask dev (similar usage)

443

HTTPS (production)

History

Port 3000 became a JavaScript convention from Express.js (2010) which used it as the default in documentation examples. Create React App (2016) cemented it for frontend development. Grafana (2014) independently chose port 3000. The collision means 'port 3000' requires context to identify the service.

FAQ

Why do so many tools use port 3000?

Express.js tutorials used 3000 in examples, and the JavaScript ecosystem copied it. It is above 1024 (no root needed), below 10000 (easy to type), and was rarely used when Node.js emerged. Now it is the most overloaded dev port – check what is actually running before assuming.

How do I fix 'port 3000 already in use'?

Find what is using it: lsof -i :3000 (macOS/Linux) or netstat -ano | findstr :3000 (Windows). Common culprits: Grafana service, a backgrounded npm start, or macOS AirPlay (port 5000, not 3000 – but related confusion). Kill the process or use a different port: PORT=3001 npm start.