Skip to content
My IP Address
Addressing and routing

· 4 min read

Public vs private IP addresses

Your phone has at least two IP addresses: one your router gave it, and one the rest of the internet sees. They are different numbers that answer different questions, and mixing them up is the most common source of confusion about IP addresses.

On this page
  1. The difference at a glance
  2. The private ranges
  3. How a private address reaches the internet
  4. How to tell which one you are looking at
  5. Why the distinction matters
  6. Common questions

The difference at a glance#

A public IP address is unique across the whole internet and is how the rest of the world sees your connection. A private IP address is unique only inside one network and is how your router tells your devices apart. Both are real addresses; they simply live in different places.

Public and private addresses compared
PublicPrivate
Assigned byYour ISP, from a block it received from a regional registryYour router, usually through DHCP
UniqueAcross the whole internetOnly inside your own network
Reachable from outsideIn principle, subject to firewallsNot directly
Where you see itOn this site's home page, or in any lookupIn your device's network settings and your router's admin page
Typical example203.0.113.42 (a documentation address)192.168.1.14
What websites seeThis oneNever this one

The private ranges#

Private addresses are not chosen at random. RFC 1918 reserves three IPv4 blocks that will never be assigned to anyone on the public internet, so any network can use them freely, and millions do, at the same time.

Addresses that are not public
RangeAddressesUsed for
10.0.0.0/816,777,216Large organisations, some home routers and most cloud networks
172.16.0.0/121,048,576Mid-size networks; Docker uses part of it by default
192.168.0.0/1665,536Nearly every home router
100.64.0.0/104,194,304Shared address space for carrier-grade NAT (RFC 6598). Not private in the RFC 1918 sense, and not public either
169.254.0.0/1665,536Link-local: what a device gives itself when DHCP fails
127.0.0.0/816,777,216Loopback: the device talking to itself, usually 127.0.0.1
fc00::/7About 2^121IPv6 unique local addresses, in practice fd00::/8
fe80::/10About 2^118IPv6 link-local, present on every IPv6 interface

Anything outside these and the other reserved ranges is a public address.

If you are wondering about the slashes, /8 and /12 are CIDR notation for how many leading bits are fixed. CIDR and subnetting explains it, and the subnet calculator will do the arithmetic.

How a private address reaches the internet#

Network address translationThree devices on a home network have private addresses 192.168.1.10, .11 and .12. The router keeps a table that maps each one to a different port on the single public address 203.0.113.42, so the internet sees one address and the router can send each reply to the right device.Laptop192.168.1.10Phone192.168.1.11TV192.168.1.12RouterNAT table.10 ↔ :40001.11 ↔ :40002.12 ↔ :40003The internet203.0.113.42private addressesone public address
Three private addresses share one public address. The router keeps a table of which port belongs to which device.

Private addresses cannot be routed on the internet, so something has to translate them. Your router does, using network address translation: outbound packets get your public address as their sender and a port number that identifies the device, and replies are matched back through that table. What is NAT walks through the table row by row, including what changes when your ISP adds a second layer of it.

How to tell which one you are looking at#

  • Starts with `10.`, `192.168.`, or `172.16` to `172.31`: private.
  • Starts with `100.64` to `100.127`: shared address space, which means your ISP is doing carrier-grade NAT.
  • Starts with `169.254`: your device could not get an address from the router.
  • Starts with `127.`: the device itself.
  • Anything else, and not on the reserved list: public.

For an address you cannot classify by eye, a lookup reports its scope directly: public, private, loopback, link-local, carrier-grade NAT, multicast or reserved.

Why the distinction matters#

  • Privacy. Websites, ad networks and fraud systems see the public address. The private one never leaves your network, so hiding or changing it does nothing for you. A VPN replaces the public one.
  • Hosting and remote access. To reach something at home from outside you need the public address, or a dynamic DNS name that follows it, and a router that forwards the port. Behind carrier-grade NAT that is not possible without a tunnel.
  • Troubleshooting. "My IP" in a support ticket almost always means the public address. "My IP" in a network setup guide almost always means the private one. Ask which.
  • Security scans. Scanning 192.168.1.14 from the internet finds nothing, because it does not exist there. Scanning your public address finds whatever your router exposes.

Common questions#

Can a private IP address be traced?

Not from the internet. It appears in no request a website receives. Inside your network it identifies one device, and your router can name it.

Why does my phone show a different IP on Wi-Fi and mobile data?

Because it is on a different network each time: a private address from your router on Wi-Fi, and one from your carrier on mobile data, usually behind carrier-grade NAT. The public address the internet sees differs too.

Do IPv6 addresses have a private/public split?

The idea exists but looks different. Devices normally have a globally routable address, and a router firewall decides what may reach it. Unique local addresses (fd00::/8) play the role of 192.168.x.x for traffic that should stay inside the site.

Try it on your own connection

Sources and further reading

Keep reading

Published by My IP Address