::1: the IPv6 loopback address

::1 is the IPv6 loopback address, the equivalent of 127.0.0.1. RFC 4291 assigns exactly one address to the purpose, written ::1/128, rather than the whole /8 that IPv4 reserved. Packets sent to it never leave the host.

Reading the notation

::1 is the compressed form of 0000:0000:0000:0000:0000:0000:0000:0001. The double colon replaces one run of consecutive zero groups, and RFC 5952 allows it only once per address so the expansion is unambiguous. Its neighbour :: with nothing after it is the unspecified address, the IPv6 counterpart of 0.0.0.0, and confusing the two is a common source of bugs in configuration files.

RFC 4291 section 2.5.3 defines the loopback address and adds a rule people forget: it must never be assigned to a physical interface, and a packet with ::1 as its source or destination must never be forwarded by a router or sent outside a single node.

When you see it

• In ip -6 addr on Linux, on interface lo, as inet6 ::1/128 scope host.
• In ifconfig lo0 on macOS, alongside 127.0.0.1 and fe80::1%lo0.
• In /etc/hosts, where a second line maps ::1 to localhost on most modern systems.
• In ss -tln output as [::1]:5432 or similar, showing a service bound to IPv6 loopback only.
• In web server access logs on a machine where a health check or reverse proxy connects locally.
• In URLs written as http://[::1]:8080, with the brackets that RFC 3986 requires.

The localhost problem

This is the practical reason ::1 matters to people who otherwise never think about IPv6. The hostname localhost resolves to both 127.0.0.1 and ::1, and the order a program tries them in is not fixed.

Node.js 17 changed its DNS behaviour to stop reordering results, so localhost started resolving to ::1 first on many systems. Applications that connected to a database or an API listening only on 127.0.0.1 began failing with connection refused, and the error message pointed at a port rather than at an address family. The same class of problem has hit MySQL clients, Docker port publishing, and reverse proxy configurations.

Three fixes, in order of preference:

1. Bind the service to both loopback addresses, which most servers support with two listen directives.
2. Use the literal address in the client configuration rather than the name.
3. Reorder or edit /etc/hosts so the name resolves the way you intend, which is the least portable option.

Security, and why binding matters

A service on [::1] is reachable only from the same machine, exactly like one on 127.0.0.1. A service on [::], the IPv6 wildcard, is reachable on every address the machine holds. On a dual stack host, [::] often accepts IPv4 connections too through address mapping, which means a firewall rule written only for IPv4 can leave the IPv6 path open. Check what is really listening with ss -tlnp and confirm from outside with /port-check.

What it is not

::1 is not a range: there is no ::2 loopback and no equivalent of 127.0.0.2 for running several services on the same port. It is not link-local either; fe80::/10 is a different reservation with a different purpose. And it is not evidence of internet IPv6 connectivity. A loopback ping succeeds on a machine with no IPv6 route at all, so test real reachability on /ipv6-test.