Your public IP address, checked against the IANA special-purpose registries so a private or shared address is named rather than called public, with the location shown as the estimate it is.
Initializing in your browser…
Every fact about an IPv4 or IPv6 block, plus splitting, merging, range to CIDR, and which special-purpose range an address falls in
An upper bound on how strong a password is, from the patterns that actually make one guessable, with the model and its limits stated in full.
Work and break cycles on a monotonic clock, so a session is not ended by the system clock changing, with the running session and today figures kept if you reload.
A colleague says your office traffic is being geolocated to the wrong city and you need to see exactly what a server sees about your connection.
What you do
Open the page, no input required.
Connection readout (example)
Public IPv4: 203.0.113.47 Public IPv6: 2001:db8:4860::8a2e ISP / ASN: Example Telecom (AS64500) Approx. city: Munich, DE Browser: Chrome 120 on Windows 10 Timezone: Europe/Berlin (from your browser)
Your public IP is the address the rest of the internet replies to, it belongs to your ISP/NAT gateway, not your device. The approximate city comes from a geo-IP lookup of that address (often off by tens of kilometres and why VPNs change it). The browser and timezone lines come from your own client, so you can see at a glance what every site you visit can infer without any permissions.
Your public IP address, checked against the IANA special-purpose registries so a private or shared address is named rather than called public, with the location shown as the estimate it is. Two services are asked in turn and the page says which answered.
**The answer is untrusted input.** The address comes from a third party, and a cast is not a check. The version that shipped before September 2026 wrote `data.ip as string` and then called `.includes()` on it during render. Measured on 2026-09-04 over twelve responses served from a test harness, **four took the whole tool off the page** with a `TypeError`, and one of the four is the body ipapi.co free tier actually returns when its daily limit is reached: `{"error": true, "reason": "RateLimited"}` under an HTTP 200 rather than an error status. So an ordinary, documented upstream condition produced a blank page. Every field is checked here, and the address is checked by PARSING it, which is the only way to know it is one. When the first service cannot be used the second is asked, and the page lists what each one said.
**Not every address is a public address.** The shipped page displayed 192.168.1.5 and 127.0.0.1 under the heading "Your Public IP Address" without comment. Here the address is looked up in the IANA IPv4 and IPv6 Special-Purpose Address Registries, through the same module the subnet calculator uses, which has 290 assertions against Python ipaddress behind it. A private, loopback, link-local, shared CGNAT or documentation address is named with its block and its RFC and is not presented as your address on the Internet.
**The city is a guess and was presented as a fact.** IP geolocation works from the registry record of who was allocated the block, refined by a commercial database built from measurements and self-reported data. The country is usually right. The city often is not: a mobile connection is commonly placed at the operator gateway, which can be hundreds of kilometres away, and a VPN, a corporate proxy or carrier-grade NAT shows the exit point, which is the entire purpose of a VPN. The coordinates are the centre of whatever area the database has, and a country with no better data gets a single point, which for the United States is a field in Kansas. All of that is on the page now, next to the estimate.
Smaller things the same run found. The Organization card **could never appear at all**: the ISP and the organisation were filled from the same field and the card was shown only when the two differed. A three letter country code such as `USA` produced a flag of three regional indicator symbols, because nothing checked the code against ISO 3166-1, and Unicode TR51 builds a flag from exactly two. `lat && lon` hid the coordinates whenever either was ZERO, which is the Greenwich meridian, running through Accra and through Britain, France and Spain, and the equator, running through Pontianak and Quito. And there was no timeout of any kind, so a service that accepts the connection and never answers left the page saying "Detecting your IP address..." for ever; measured at nine seconds and still going. Every request now gives up after eight seconds and moves on, and the page says which service timed out.
One thing that was already right and is worth recording: markup in a service answer is rendered as text, never as markup, because React escapes it. A city name of `<img src=x onerror=alert(1)>` appears as those characters and creates no element.
ipapi.co answers HTTP 200 with an error body. The page reads the body, says the service refused the request and why, asks api.ipify.org instead, and shows the address with a note that only the address is available from that service.
The address a server gets is your router or your provider, not your device, and this is that address.
Refresh with the VPN on and off. If the address does not change, it is not carrying your traffic.
A 100.64.x.x address means your provider is using carrier-grade NAT; the page names the block and the RFC rather than leaving you to look it up.
Often not. The country is usually right, because it comes from the registry record of who was allocated the block. The city comes from a commercial database and is usually the location of the network rather than of you: a mobile connection is commonly placed at the operator gateway, and a VPN or a corporate proxy shows the exit point. The page says this next to the estimate rather than after you have believed it.
Because it is, by RFC 1918 or one of the other IANA special-purpose registrations, and the public Internet does not carry it. If that turns up here, something between your browser and the lookup service rewrote the answer, or the request never left your network. The page names the exact block and the RFC that defines it.
Your router has a private address on your network and a public one facing your provider. This page shows what a server on the Internet sees, which is the public one, and behind carrier-grade NAT that can be shared with other subscribers.
No. The lookup runs in your browser against ipapi.co and, if that does not answer, api.ipify.org. Those services necessarily see your address in order to answer. Nothing is sent to this site.
Because the fallback service returns the address and nothing else. The page says so rather than leaving the cards silently missing.
This tool queries ipapi.co (falling back to ipify.org) to look up your public IP, so those services necessarily receive your IP address. This site does not store or log it.