Databases exposed on 3306 are a common source of data breaches: automated scanners find them quickly and try default or weak passwords. For local development, binding to 127.0.0.1 keeps the database invisible to the network; Docker's -p 3306:3306 publishes it on all interfaces unless you write -p 127.0.0.1:3306:3306.
Facts
- Port
- 3306
- Protocols
- TCP
- Service
- MySQL
What uses port 3306
MySQL and MariaDB clients connecting to the database server. Admin tools like TablePlus, Sequel Ace and MySQL Workbench use it too.
On a Mac
On a Mac, 3306 usually belongs to a MySQL installed with Homebrew (brew services) or a Docker container publishing the port. The process may show as mysqld or as Docker's backend (com.docker.backend).
sudo lsof -nP -iTCP:3306Security
Never expose 3306 to the internet. Bind MySQL to 127.0.0.1 for local development, and use SSH tunnels or private networks to reach remote databases.
Frequently asked questions
What uses port 3306?
MySQL and MariaDB servers. On a Mac it's usually a Homebrew MySQL service or a Docker container.
How do I free port 3306 on a Mac?
Find the owner with lsof -nP -iTCP:3306 -sTCP:LISTEN, then stop it: brew services stop mysql or docker stop the container.
Should port 3306 be open on my server?
Only to the application servers that need it, ideally on a private network. Never to the whole internet.