Every request your browser makes carries a return address. The server needs it to send the page back, so there is no way to browse without showing one. That address is your public IP address, and it says less about you than the scarier articles claim and more than most people assume.
You can see yours on the network info page, which shows the IPv4 and IPv6 addresses your connection presents, the provider and network number behind them, and the location and time zone a geolocation database assigns to them. That is roughly the view every website gets.
An address belongs to a connection, not a person
Your internet provider owns blocks of addresses and hands one to your connection. At home, that usually means your router. Everything behind the router (your laptop, your phone, the television, a guest on the wi-fi) shares that one public address. The router keeps track of which device asked for what and passes the replies along. This is network address translation, or NAT.
So a website sees the address of a household, an office, a coffee shop or a phone network. It does not see a name, a street address, an email address or which device in the building made the request. Your provider knows which customer account held an address at a given time, because it has to in order to bill you and route your traffic. A website does not have that record.
What a site can infer
Address blocks are registered publicly, and companies build databases on top of those registrations. From an address alone, a site can usually work out:
- Your provider. The block is registered to an organization, and each network on the internet has a number (an ASN) that identifies who operates it.
- A rough location. Usually the right country, often the right region or metropolitan area, sometimes the right city.
- The kind of connection. Home broadband, mobile carrier, data center, known VPN or Tor exit. Sites use this to decide whether a visitor looks like an ordinary person or an automated script.
- Sometimes an organization. A university, a hospital or a large company may hold its own address block under its own name. Browse from the office network and the site may know where you work.
The IP info tool shows this for any address or hostname you enter: the network number, the organization, the location a database reports, the address blocks that network announces, and the reverse DNS name for IPv4 addresses. Look up your own address and you will see your provider, not yourself.
Why the location is approximate
Nothing in an IP address encodes geography. Geolocation databases are assembled from registration records, routing data, and whatever hints the database maker can collect. They are educated guesses that get updated over time.
The guess can be wrong in several ordinary ways. A provider may register a block at its headquarters and use it in another state. Blocks are moved between regions and the databases lag behind. Mobile traffic often leaves the carrier's network at a gateway far from where the phone is. And when a database knows only the country or region, it tends to report a default point, such as a central city, which looks more precise than it is.
Treat an IP location as “somewhere around here” at best. It is good enough to pick a language, show local prices, or enforce a regional restriction. It is not a pin on your house. When a site knows exactly where you are, it got that from somewhere else: the location permission in your browser or phone, or an address you typed in.
Addresses change, and many are shared
Most home connections get a dynamic address. The provider lends it for a while and may hand out a different one after a router restart, an outage, or simply the passage of time. In practice some dynamic addresses stay the same for months and others change daily. A static address is one the provider promises not to change, usually sold to businesses that run servers.
There are not enough IPv4 addresses for every connection to have its own, so many providers add another layer of sharing called carrier-grade NAT. With it, one public address is shared by many customers at once, and your router gets an address that only works inside the provider's network. Mobile carriers do this routinely. The practical effects:
- Your address may be the same as that of strangers in your area, and you can inherit the consequences of their behavior: a captcha, a rate limit, a block.
- An address is a weak identifier on its own. A site that wants to recognize you leans on cookies, logins and browser fingerprinting instead.
IPv6 changes the picture a little
IPv6 has enough addresses that sharing is unnecessary. A provider typically gives each customer a whole prefix, and every device picks its own address inside it. That means a site may see a different address for your laptop than for your phone, where with IPv4 it saw one for the household.
To stop a device from being followed by the unchanging tail of its address, modern operating systems use privacy addresses: temporary addresses with a randomized device portion that are replaced regularly. The first half of the address, the prefix your provider assigned, still identifies your connection in the same way an IPv4 address does. If the network page shows both an IPv4 and an IPv6 address, sites can see whichever one your browser used to reach them.
What hides it and what doesn't
- A VPN replaces your address with the VPN server's. Sites see the VPN; your provider sees only that you are talking to the VPN. The trade is that the VPN operator can now see what your provider used to, so you are moving trust, not removing it.
- Tor Browser relays your traffic through several volunteer-run servers so that no single one knows both who you are and where you are going. It is slower, and some sites treat Tor visitors with suspicion.
- Mobile data swaps your home address for the carrier's, which is usually shared with many other subscribers. The carrier still knows it is you.
- Private or incognito browsing does nothing to your address. It stops the browser from keeping history and cookies on your device. The sites you visit see the same IP as before.
- Clearing cookies or switching browsers doesn't change it either. The address belongs to the connection, not the software.
This site does not run a VPN and takes no commission for recommending one. The VPN page explains what to look for in a provider and why the provider's trustworthiness is the whole question.
Keeping it in proportion
Hiding your IP address solves one specific problem: it stops a site from learning your provider and approximate location, and stops your provider from seeing which sites you visit. It does not stop tracking by cookies, by fingerprint, or by the account you are logged in to. A site you sign in to knows who you are from any address.
The reverse is also true. Someone who learns your address from a game, a forum or an email cannot look up your name or your front door with it. What they get is your provider and a city-sized guess. Email is a smaller leak than it used to be as well, though opening a message can still tell the sender something; the guide on tracking pixels covers that case.