Port 8888 – Jupyter Notebook

TCP

Port 8888 is the default Jupyter Notebook and JupyterLab port. Jupyter runs a local web server that serves notebooks via the browser. The server generates a random token on startup for authentication. Port 8888 should never be publicly exposed – Jupyter notebooks execute arbitrary code on the host machine. Use SSH tunneling for remote access.

Port Number

8888

Protocol

TCP

Service

Jupyter Notebook / JupyterLab

Range

IANA Registered (1024–49151)

Description

Jupyter spawns an HTTP server on port 8888 by default. Notebooks are served via browser and can execute Python, R, Julia, or any language with a kernel. The authentication token appears in the terminal on startup. Remote Jupyter access should always use SSH tunneling: ssh -L 8888:localhost:8888 user@server, then open localhost:8888 locally.

Security risks

1Arbitrary code execution: Jupyter is designed to execute code. Anyone with access to port 8888 (even with just the token) can run os.system('rm -rf /'), read files, install packages, and pivot to other systems. It is a remote shell with a pretty interface.
2Token in URL: Jupyter's auth token is passed as a query parameter (?token=...). Browser history, access logs, and referer headers all leak the token. Set a password instead: jupyter notebook password.
3Kernel persistence: even after a notebook tab is closed, the kernel remains running. Malicious code started in a notebook continues executing. Check running kernels: jupyter notebook list.
4Shared environments: on multi-user JupyterHub, one user's kernel can access other users' files if filesystem permissions are wrong. Use containerized spawners (DockerSpawner, KubeSpawner) for isolation.

Firewall guidance

Never expose port 8888 to any network. Bind to 127.0.0.1 only (jupyter notebook --ip=127.0.0.1). For remote access: SSH tunnel (ssh -L 8888:localhost:8888) or use JupyterHub with proper authentication (OAuth, LDAP). Cloud GPU instances (AWS, GCP) must use IAM-gated proxy or VPN – never open security group port 8888.

Diagnosis commands

Show running Jupyter servers with their URLs and tokens

shell

jupyter notebook list

Check what process owns port 8888 and its bind address

shell

ss -tnlp sport = :8888

Count active kernels (running code environments)

shell

curl -s http://localhost:8888/api/kernels -H 'Authorization: token TOKEN' | jq length

Usage examples

Port 8888 – Jupyter Notebook

shell

jupyter notebook --port 8888
jupyter lab --no-browser --port 8888
ssh -L 8888:localhost:8888 user@gpu-server

Common services on this port

Jupyter NotebookJupyterLabJupyterHubGoogle Colab (backend)Databricks NotebooksVS Code Jupyter ExtensionSageMaker Notebook Instances

Related ports

8080

HTTP alternate (similar usage)

8000

JupyterHub proxy

SSH (tunneling for remote access)

History

IPython Notebook was created by Fernando Perez in 2011. It was renamed Jupyter (Julia + Python + R) in 2014 as it became language-agnostic. JupyterLab (2018) provided a full IDE-like interface. Port 8888 was the arbitrary default chosen because 8080 was too commonly taken.

FAQ

Is JupyterHub safer than Jupyter Notebook?

JupyterHub adds multi-user authentication (OAuth, LDAP, PAM), per-user process isolation, and centralized management. Single-user Jupyter Notebook relies only on a token. For any team or classroom setting, use JupyterHub with containerized spawners.

How do I access Jupyter on a remote GPU server?

SSH tunnel: ssh -L 8888:localhost:8888 user@gpu-server, then open http://localhost:8888 in your local browser. The traffic travels encrypted through SSH. Never open port 8888 in the cloud firewall.