Step 1
Install and log in
Run one command. Your browser opens, you approve the code, and this computer is linked to your account.
$ portless login
Opening your browser…
Your code: KQ4M-7TZD
✓ Logged in
Portless gives your computer a real address on the internet, even behind CGNAT. Websites, Minecraft servers and SSH, live in under a minute.
Port forwarding means a router login, a static LAN IP and a settings page your ISP may not even show you.
More ISPs put a whole neighbourhood behind one public IP. With CGNAT there is no port left to forward.
Dynamic DNS, certificates, renewals. And all of it breaks the moment you take your laptop somewhere else.
Portless flips the direction. Your PC dials out, our edge receives the visitors, and their traffic flows straight back down your tunnel. No open ports at home, ever.
Turn mappings on and off, see which tunnels are live and copy addresses. Changes reach the edge in under a second.
Home Wi-Fi, CGNAT, campus networks and phone hotspots all work the same.
Certificates are issued and renewed for every subdomain without you.
The app runs WireGuard in userspace and forwards to localhost.
Add or pause a mapping and the route changes in under a second.
One small app for Windows, macOS and Linux. Install it with a single command.
Run one command. Your browser opens, you approve the code, and this computer is linked to your account.
Pick a name and the local port. Add --minecraft, --ssh, --tcp or --udp for other kinds of servers.
Send it to anyone. HTTPS is already set up, and it keeps working when you change networks.
We read the first packet of every connection, never the rest. That's how thousands of people share 443 and 25565.
Real :443 with automatic certificates.
routed by TLS SNIJava edition on :25565, Forge and Fabric too.
routed by handshakeA dedicated public port for each machine.
pool port → :22Bedrock, Valheim, Terraria and voice chat.
pool port, UDPDatabases, game servers, anything with a port.
pool port, TCPTunnels are isolated from one another.
WireGuardNo. Your PC opens an outbound WireGuard connection to the Portless edge, the same way it opens any website. Visitors connect to the edge, and their traffic flows back down that tunnel. That works behind CGNAT, campus Wi-Fi and mobile hotspots.
Each connection names its destination in its first packet: the TLS SNI, the HTTP Host header or the Minecraft handshake. The edge reads that name without decrypting anything and routes the stream to the right tunnel.
No. Only traffic to the ports you map. The tunnel routes nothing but Portless's own address, and the app forwards straight to localhost.
Protocols that don't carry a hostname get a dedicated public port from a shared pool, forwarded in the kernel. Dedicated IPv6 with every port is on the way.
Yes, while Portless is in beta: 2 devices, 3 subdomains and 6 port mappings with automatic HTTPS.
Check a name right now. It's yours the moment you claim it, and it's free while we're in beta.