diff --git a/tornado/httpclient.py b/tornado/httpclient.py
index 488fe6de0..e3023baea 100644
--- a/tornado/httpclient.py
+++ b/tornado/httpclient.py
@@ -176,7 +176,7 @@ async def f():
 
     """
 
-    _instance_cache = None  # type: Dict[IOLoop, AsyncHTTPClient]
+    _instance_cache: Dict[IOLoop, "AsyncHTTPClient"]
 
     @classmethod
     def configurable_base(cls) -> Type[Configurable]:
@@ -339,7 +339,7 @@ def configure(
 class HTTPRequest:
     """HTTP client request object."""
 
-    _headers = None  # type: Union[Dict[str, str], httputil.HTTPHeaders]
+    _headers: Union[Dict[str, str], httputil.HTTPHeaders]
 
     # Default values for HTTPRequest parameters.
     # Merged with the values on the request object by AsyncHTTPClient
@@ -626,7 +626,7 @@ class HTTPResponse:
     # I'm not sure why these don't get type-inferred from the references in __init__.
     error = None  # type: Optional[BaseException]
     _error_is_response_code = False
-    request = None  # type: HTTPRequest
+    request: HTTPRequest
 
     def __init__(
         self,
diff --git a/tornado/httputil.py b/tornado/httputil.py
index 44f86ea39..a2b44e1bb 100644
--- a/tornado/httputil.py
+++ b/tornado/httputil.py
@@ -475,11 +475,11 @@ class HTTPServerRequest:
        temporarily restored in 6.5.2.
     """
 
-    path = None  # type: str
-    query = None  # type: str
+    path: str
+    query: str
 
     # HACK: Used for stream_request_body
-    _body_future = None  # type: Future[None]
+    _body_future: "Future[None]"
 
     def __init__(
         self,
diff --git a/tornado/iostream.py b/tornado/iostream.py
index dd2111e3b..44e96cd50 100644
--- a/tornado/iostream.py
+++ b/tornado/iostream.py
@@ -1324,7 +1324,7 @@ class SSLIOStream(IOStream):
     wrapped when `IOStream.connect` is finished.
     """
 
-    socket = None  # type: ssl.SSLSocket
+    socket: ssl.SSLSocket
 
     def __init__(self, *args: Any, **kwargs: Any) -> None:
         """The ``ssl_options`` keyword argument may either be an
diff --git a/tornado/netutil.py b/tornado/netutil.py
index 3ec76af77..a426c346c 100644
--- a/tornado/netutil.py
+++ b/tornado/netutil.py
@@ -515,8 +515,8 @@ class ThreadedResolver(ExecutorResolver):
        of this class.
     """
 
-    _threadpool = None  # type: ignore
-    _threadpool_pid = None  # type: int
+    _threadpool: Optional[concurrent.futures.ThreadPoolExecutor] = None
+    _threadpool_pid: Optional[int] = None
 
     def initialize(self, num_threads: int = 10) -> None:  # type: ignore
         threadpool = ThreadedResolver._create_threadpool(num_threads)
diff --git a/tornado/test/web_test.py b/tornado/test/web_test.py
index 27df3f7a8..f41ae5a1d 100644
--- a/tornado/test/web_test.py
+++ b/tornado/test/web_test.py
@@ -221,7 +221,7 @@ def test_key_version_invalidate_version(self):
 
 
 class FinalReturnTest(WebTestCase):
-    final_return = None  # type: Future
+    final_return: Future
 
     def get_handlers(self):
         test = self
diff --git a/tornado/util.py b/tornado/util.py
index 19df49132..ee721b2e0 100644
--- a/tornado/util.py
+++ b/tornado/util.py
@@ -236,8 +236,8 @@ class Configurable:
     # There may be a clever way to use generics here to get more
     # precise types (i.e. for a particular Configurable subclass T,
     # all the types are subclasses of T, not just Configurable).
-    __impl_class = None  # type: Optional[Type[Configurable]]
-    __impl_kwargs = None  # type: Dict[str, Any]
+    __impl_class: Optional[Type["Configurable"]] = None
+    __impl_kwargs: Optional[Dict[str, Any]] = None
 
     def __new__(cls, *args: Any, **kwargs: Any) -> Any:
         base = cls.configurable_base()
@@ -324,13 +324,13 @@ def configured_class(cls):
 
     @classmethod
     def _save_configuration(cls):
-        # type: () -> Tuple[Optional[Type[Configurable]], Dict[str, Any]]
+        # type: () -> Tuple[Optional[Type[Configurable]], Optional[Dict[str, Any]]]
         base = cls.configurable_base()
         return (base.__impl_class, base.__impl_kwargs)
 
     @classmethod
     def _restore_configuration(cls, saved):
-        # type: (Tuple[Optional[Type[Configurable]], Dict[str, Any]]) -> None
+        # type: (Tuple[Optional[Type[Configurable]], Optional[Dict[str, Any]]]) -> None
         base = cls.configurable_base()
         base.__impl_class = saved[0]
         base.__impl_kwargs = saved[1]
diff --git a/tornado/web.py b/tornado/web.py
index 2351afdbe..f506ad906 100644
--- a/tornado/web.py
+++ b/tornado/web.py
@@ -205,9 +205,9 @@ class RequestHandler:
     _stream_request_body = False
 
     # Will be set in _execute.
-    _transforms = None  # type: List[OutputTransform]
-    path_args = None  # type: List[str]
-    path_kwargs = None  # type: Dict[str, str]
+    _transforms: List["OutputTransform"]
+    path_args: List[str]
+    path_kwargs: Dict[str, str]
 
     def __init__(
         self,
diff --git a/tornado/websocket.py b/tornado/websocket.py
index ab9b76f5e..4e5843cb1 100644
--- a/tornado/websocket.py
+++ b/tornado/websocket.py
@@ -834,7 +834,7 @@ class WebSocketProtocol13(WebSocketProtocol):
     RSV_MASK = RSV1 | RSV2 | RSV3
     OPCODE_MASK = 0x0F
 
-    stream = None  # type: IOStream
+    stream: IOStream
 
     def __init__(
         self,
@@ -1396,7 +1396,7 @@ class WebSocketClientConnection(simple_httpclient._HTTPConnection):
     `websocket_connect` function instead.
     """
 
-    protocol = None  # type: WebSocketProtocol
+    protocol: Optional[WebSocketProtocol] = None
 
     def __init__(
         self,
@@ -1620,6 +1620,7 @@ def selected_subprotocol(self) -> Optional[str]:
 
         .. versionadded:: 5.1
         """
+        assert self.protocol is not None
         return self.protocol.selected_subprotocol
 
     def log_exception(