Why is localhost 127.0.0.1? Sixteen million addresses for talking to yourself

Jon Postel, the man who kept the internet's ledger, pointing at a hand-drawn map of it. Photo by Irene Fertik, USC News Service, © 1994 USC, used with attribution.

Every machine you have ever used answers to 127.0.0.1, and the official paper trail for why is one line long. In September 1981, Jon Postel published RFC 790, the assigned-numbers registry of the young internet, and the entry for network 127 reads, in full: 127.rrr.rrr.rrr Reserved [JBP]. JBP is Jon Bruce Postel. He reserved it, he signed it with his own initials, and he never recorded a reason. Forty-five years of computing runs ping 127.0.0.1 on the strength of that table row.

Who reserved 127?

Postel was the internet's numbers czar in the most literal sense: as editor of the assigned-numbers RFCs he personally kept the ledger of which network numbers meant what. RFC 790 hands out the class A networks one per line — 10 to ARPANET, 18 to MIT, and so on — and parks 127 as Reserved with no elaboration. The loopback function got attached to the reservation over the following years, and by 1989 the behaviour was law: RFC 1122, the host-requirements standard, defines { 127, <any> } as the "Internal host loopback address" and adds one of the great absolute sentences in the standards canon: "Addresses of this form MUST NOT appear outside a host."

Note what that says: not just 127.0.0.1 — any address starting with 127. Try it: ping 127.99.44.7 answers on every box you own. The reservation covers the entire 127.0.0.0/8 block, which is 2^24 minus change: about 16.7 million addresses, all of them meaning this machine right here. It is the most extravagant allocation in the protocol: an address space the size of a mid-sized country's population, dedicated to talking to yourself.

Why 127 specifically?

The honest answer is that nobody wrote it down, and anyone who claims certainty is embellishing. The least romantic and most plausible explanation is positional: in the classful addressing of the era, a class A network number fit in 7 bits, so class A ran from network 0 to network 127 — and 127, binary 01111111, is the last one. Postel parked the loopback function at the end of the row, the way you would reserve the last locker. The elegant-sounding alternatives (signed-byte maximum, all-ones magic) are the same observation wearing different hats. The RFCs themselves offer nothing: 127 is reserved because the ledger says so, and the ledger was Postel.

If the address had been assigned a decade later under CIDR¹ rather than classful rules, loopback would probably be a /32 — one address, not sixteen million. The block is a fossil of the era's assumption that address space was effectively infinite. IPv6, designed after that assumption died, reserves exactly one loopback address: ::1. Lesson learned, twenty years and one address exhaustion crisis later.

🔗 Learn more — ¹ What is CIDR?

What loopback actually does

A packet sent to any 127 address never reaches your network card. The kernel's network stack short-circuits it through the loopback interface — lo on Linux — straight back up into the receive path. No cable, no router, no NAT², no other machine involved. That is what makes it the universal test fixture: when you develop against localhost:3000, you get the full TCP/IP machinery — sockets, ports, handshakes — with zero network in the loop. If it fails on loopback, the network was never your problem.

🔗 Learn more — ² What is NAT (and why CGNAT blocks you)?

0.0.0.0 is not localhost

The address most often confused with 127.0.0.1 deserves its own paragraph, because the confusion bites in production. When a server says it is listening on 0.0.0.0:3000, that is not an address you can visit — 0.0.0.0 is a wildcard meaning every interface this machine has: loopback, LAN, whatever else is plugged in. Bind to 127.0.0.1:3000 and only the machine itself can connect; bind to 0.0.0.0:3000 and everyone on your network can. That single word of difference is the classic homelab security surprise: the database you thought was private answering cheerfully to the whole LAN, because the container runtime defaulted to the wildcard. The rule of thumb: 127.0.0.1 is a destination, 0.0.0.0 is a policy.

And since the whole /8 is loopback, the block's sixteen million addresses do have one genuine use: they are all separately bindable. Run one service on 127.0.0.1:8080, another on 127.0.0.2:8080, a third on 127.0.0.3:8080 — same port, no conflict, because each is a distinct address inside the mirror. Test fixtures and local proxies exploit this daily. It is not what Postel was thinking about in 1981, because nothing suggests he was thinking about anything in particular — but it is the closest the other 16,777,213 addresses come to earning their keep.

Before DNS, localhost was a line in a text file

The name localhost predates the domain name system entirely. In the ARPANET era every machine kept a file of name-to-address mappings — the master copy, HOSTS.TXT, was maintained by hand at the Stanford Research Institute's Network Information Center and fetched by every host on the network. The whole internet's phone book was one text file, edited by one office. It scaled exactly as well as you'd imagine, which is why DNS exists. But the file never died: it became /etc/hosts on Unix (and its Windows twin), and to this day it is consulted before DNS on essentially every system, which is why one line —

127.0.0.1    localhost

— ships in every hosts file on Earth. When you edit /etc/hosts to fake a domain during development, you are using the pre-1983 internet's name resolution, still running underneath the modern one, still winning ties. The oldest layer answers first.

The heist that never happened

The block's absurd size has not gone unnoticed. In 2021 the IPv4 Unicast Extensions project proposed the obvious: shrink loopback to 127.0.0.0/16 and release the other ~16.7 million addresses for public use — IPv6 manages with a single loopback address, and almost no software touches anything beyond 127.0.0.1. Arithmetically impeccable. It went nowhere at the IETF, and the reason is the whole moral of this story: after four decades, RFC³ 1122's MUST NOT is baked into every kernel, firewall, and security assumption on the planet. Millions of systems depend on 127-anything never arriving from the wire; un-reserving the block would turn a safety invariant into an attack surface. The reservation nobody justified has become impossible to revoke — the fossil is load-bearing now.

🔗 Learn more — ³ What is an RFC?

Why localhost skips DNS

localhost the name is a separate piece of machinery with its own paper trail. It began as a hosts-file convention and is now a formally reserved name: RFC 6761 lists localhost. as a special-use domain and instructs resolvers that they "SHOULD recognize localhost names as special and SHOULD always return the IP loopback address" — and, pointedly, "SHOULD NOT send queries for localhost names to their configured caching DNS server(s)." Your machine is not supposed to ask the DNS where it lives. The name resolves before the question leaves the building, which is both the correct behaviour and a fitting one: the whole point of the address is that the answer never leaves the building either.

The one-line fossil

The pattern in this lane repeats: grep is a command's syntax frozen into a name, daemon is a physics joke from 1963, and 127.0.0.1 is a single unexplained row in a 1981 ledger that hardened into the most-pinged address on Earth. No committee chose it, no design document defends it, and it cannot be changed now at any price. Infrastructure is just decisions that outlived their reasons — sixteen million addresses of it, all pointing home.

127.0.0.1: reserved by Jon Postel in RFC 790, September 1981, with no recorded rationale; most plausibly chosen as the last class A network. The whole 127.0.0.0/8 block — ~16.7 million addresses — is loopback, mandated by RFC 1122 to never appear on a wire. IPv6 does it with one address: ::1.