Skip to main content
protocols.pageprotocols.page
8384

Port 8384 – Syncthing

TCP

Port 8384 is the Syncthing web GUI port for managing file synchronization between devices. Syncthing's web interface on port 8384 allows adding devices, configuring folder shares, and viewing sync status. Defaults to HTTPS on localhost only. The file sync protocol itself uses port 22000.

Port Number

8384

Protocol

TCP

Service

Syncthing Web GUI

Range

IANA Registered (1024–49151)

Description

Syncthing serves its web administration interface on port 8384 (HTTPS by default, localhost only). Through this interface, users add remote devices (via device IDs), configure which folders to share, set file versioning, and monitor synchronization progress. Syncthing's security model is strong by default – the GUI binds to 127.0.0.1:8384, uses HTTPS with an auto-generated certificate, and requires authentication after first setup. The actual file synchronization happens on port 22000 using the Block Exchange Protocol with TLS mutual authentication. If you need remote GUI access, set a strong password and consider SSH tunneling rather than exposing port 8384 directly.

Security risks

  • 1GUI access = full file management: the Syncthing web interface on port 8384 controls which folders are shared, with which devices, and can browse/delete synchronized files. Unauthorized access means full read/write to all synced data across all connected devices.
  • 2CVE-2022-46165: Syncthing GUI cross-site scripting via device name – attacker sets a malicious device name containing JavaScript that executes when the victim views connections in the GUI (fixed 1.22.2).
  • 3No authentication on first run: Syncthing prompts to set a password on first access but does not enforce it. Instances left without a password on non-localhost interfaces are fully accessible to the network.
  • 4Remote GUI binding: changing gui.address from 127.0.0.1:8384 to 0.0.0.0:8384 exposes the management interface to the entire network. Combined with no password, this is a common misconfiguration in Docker deployments (docker run -p 8384:8384).

Firewall guidance

Keep port 8384 bound to 127.0.0.1 (the default). For remote management, use SSH tunneling: ssh -L 8384:localhost:8384 remote-host. If you must bind to a network interface, set a strong GUI password and enable HTTPS (default since Syncthing 0.14). The sync protocol (port 22000) is designed to be public and uses TLS mutual authentication – it's safe to expose.

Diagnosis commands

Check if Syncthing GUI is running and responding

shell
curl -sk https://localhost:8384/rest/system/status | jq '{myID, startTime}'

Verify GUI bind address (should be 127.0.0.1:8384)

shell
curl -sk https://localhost:8384/rest/system/config | jq '.gui.address'

Check which process and bind address owns port 8384

shell
ss -tnlp sport = :8384

Usage examples

Port 8384 – Syncthing
shell
syncthing --gui-address=127.0.0.1:8384
curl -k https://localhost:8384/rest/system/status
ssh -L 8384:localhost:8384 remote-host

Common services on this port

SyncthingSyncthing-Fork (Android)SyncTrayzor (Windows tray wrapper)

Related ports

22000

Syncthing Block Exchange Protocol (file sync)

21027

Syncthing local discovery (UDP broadcast)

443

Syncthing relay servers (global discovery)

History

Syncthing was created by Jakob Borg in 2013 as an open-source alternative to BitTorrent Sync (now Resilio Sync). Port 8384 was chosen for the web GUI because 8080/8443 were too commonly taken. Syncthing uses the Block Exchange Protocol (BEP) on port 22000 with TLS and device-ID-based authentication – no central server has access to your files. The web GUI on 8384 defaults to HTTPS with an auto-generated certificate since version 0.14 (2016).

FAQ

How do I access Syncthing remotely without exposing port 8384?

SSH tunnel: ssh -L 8384:localhost:8384 remote-host, then open https://localhost:8384 in your browser. Alternatively, set up a reverse proxy (Nginx/Caddy) with authentication on port 443 that proxies to localhost:8384. Never bind Syncthing GUI to 0.0.0.0 without a password.

Port 8384 vs port 22000 – which needs to be open?

Port 22000 (sync protocol): open this for file synchronization to work between devices. It uses TLS with device-ID authentication – safe to expose publicly. Port 8384 (web GUI): keep on localhost. It's the management interface – opening it to the network is like exposing an admin panel. Only port 22000 needs to traverse firewalls for Syncthing to function.