A public IP address is reachable on the internet and is the one websites see. A private IP address is used inside a local network, such as your home Wi-Fi, and cannot be reached directly from outside. Your router translates between the two.
The private address ranges
Three blocks of IPv4 addresses are reserved for private use (RFC 1918). Anyone can use them inside their own network, which is why millions of homes all have a device at 192.168.1.10.
| Range | Typical use |
|---|---|
10.0.0.0 to 10.255.255.255 | Large corporate networks, some routers |
172.16.0.0 to 172.31.255.255 | Mid-size networks, Docker and cloud networks |
192.168.0.0 to 192.168.255.255 | Most home routers |
Two other ranges you may meet: 169.254.x.x (link-local, assigned automatically when no DHCP server answers) and 100.64.0.0/10 (shared space used by internet providers, see CGNAT).
How NAT connects them
Network Address Translation (NAT) lets many private devices share one public address. When your laptop requests a page, your router rewrites the request so it appears to come from the router's public address and remembers which device asked. When the answer returns, it forwards it to the right device. A side effect is useful: unsolicited incoming connections have nowhere to go, which acts as a basic shield for your devices.
Which one are you looking at?
- The address in your router's admin page labelled "WAN" or "Internet" is your router's outward-facing address. If it is a normal public address it will match what this site shows.
- If your router shows a private or
100.64.x.xaddress but websites see a different one, your provider is doing a second layer of NAT. - Addresses in your device's Wi-Fi settings, like 192.168.1.23, are private. Websites never see them, apart from the WebRTC leak described in our WebRTC test.
Why it matters for privacy and security
Your public address is what tracks you and what scanners probe. Your private addresses cannot be reached from the internet unless you configure port forwarding or UPnP opens a path, so check that no unexpected doors are open with the port checker. Private addresses are also not unique, so they are poor identifiers on their own, but they add detail to a fingerprint.
IPv6 changes the picture. Devices often get globally routable addresses with no NAT, protected only by the router's firewall. See IPv4 vs IPv6.