Internet How the web works under the address bar
What your IP address reveals, and what it does not
What an IP address is, what somebody can actually learn from one, why yours changes, and the difference between the address on your device and the one the world sees.
The short answer
- An IP address is the return address on your traffic, and on its own it reveals your internet provider, your rough region and nothing else.
- You have two addresses that do different jobs: a private one your router gives your device, and one public address shared by everything in the building.
- Geolocation from an address is reliable at country level, often right at city level, and a guess below that, so the pin on a map is not where you are sitting.
- An address identifies a connection at a point in time, not a person, and only your provider holds the record that links the two.
- Mobile connections and many home lines now share one public address between hundreds of subscribers, which breaks port forwarding and weakens the address as an identifier.
- Every way of hiding your address swaps who sees it rather than removing it, and none of them touch the accounts and cookies that actually name you.
An IP address is the number your traffic is addressed to, the way a house number is what mail is addressed to. It tells the internet where to send the reply to whatever you just asked for. What it reveals is narrow: which network you are on, who runs it, and roughly where in the world it sits. People either overestimate it, imagining it points at a front door, or forget it exists. The truth is in between, and depends on which of your two addresses you mean.
What an address is, and why you have two
An address exists so answers can find their way back. Your request carries a return address, and without one the answer has nowhere to go. There is no such thing as browsing with no address: you can only change which one the other end sees.
The address is not what you type. You type a name, and DNS turns that name into an address before anything connects. The name is for you, the number is for the machines, and they are matched afresh on every connection, so a site can move without you noticing.
Inside your home the router hands each device a private address, usually starting 192.168, or 10., or a number between 172.16 and 172.31. Those ranges are reserved for local use and cannot be routed across the internet. The same 192.168.1.4 exists in millions of homes at once, which is why posting yours gives nothing away.
Outside, your provider gives the router a single public address, and that is the one the world sees. Network address translation, usually shortened to NAT, joins the two: on the way out the router swaps your private address for the public one and notes which device the reply belongs to, then reverses the swap on the way back. Everything in the house therefore shares one public identity. Your laptop, your phone, the console and the doorbell camera all look like the same address to any site they contact.
Two things follow. Nothing outside can open a connection to a device inside unless a rule says where to send it, which is why port forwarding exists and why NAT acts as a crude firewall by accident. And any site judging you by your address is judging your household, guests included.
IPv4 ran out, so IPv6 exists
The familiar form, four numbers between 0 and 255, is IPv4. It is a 32 bit number, so there are about 4.3 billion possible values in total, a ceiling set when the internet was a research network. The unallocated pool ran dry years ago, and NAT is the workaround that stretched the supply.
IPv6 is the fix. Its addresses are 128 bits, written as groups of hexadecimal digits separated by colons, and the supply is effectively unlimited. Most connections now run both versions side by side, called dual stack, and your device uses whichever the destination supports.
The privacy effect runs opposite to what people expect. With IPv6 every device can hold its own public address, so a household no longer hides behind one shared number. Operating systems compensate with temporary addresses, regenerating the device portion periodically so outgoing connections are not stamped with one permanent identifier. The network prefix, which identifies your connection rather than your device, does not rotate.
Why your address changes, and when it does not
Home connections normally get a dynamic address, leased from the provider with a renewal timer. In practice it often stays the same for weeks, because each renewal hands back the same value. It changes when the router is off long enough for the lease to expire, when the line drops, or when the provider reorganizes.
A static address never changes and is usually a paid business option, needed when a server has to be reachable at a fixed number. For ordinary use it buys nothing and costs one thing: a permanent label on your traffic.
Mobile networks use carrier grade NAT, the same translation at operator scale, so hundreds or thousands of subscribers share one public address at once. Many fixed line providers now do this too. If port forwarding has never worked for you, this is usually why: compare the address on your router status page with the one a what is my address page reports, and if they differ, no router setting will help.
What a website actually learns
The site you connect to necessarily sees your public address, because the page has to be sent somewhere. Encryption does not hide it: HTTPS protects the contents of the conversation, not the envelope, since every router on the path reads the address to move the packet.
From the address alone a site can look up two things. Public registries say which organization holds that block: usually an internet provider, sometimes an employer, a university, a hosting company or a VPN operator, which is exactly how sites recognize and refuse VPN traffic. A geolocation database then offers a guess at where the block is used.
Be precise about that guess. Country is right nearly all the time, region and city often but not always, and anything finer is an estimate presented as a fact. Databases fall back to the center of a city or a country when they cannot narrow it down, which is how a few unlucky properties near the geographic middle of a country end up fielding complaints meant for strangers. Mobile addresses often map to the operator gateway.
Street level location does not come from the address at all. When a site knows exactly where you are, you granted the browser location permission and it used satellite positioning and nearby wifi names: different mechanism, different off switch. The address is in any case coarse and shared, which is why the industry leans far harder on the cookies, pixels and device fingerprints that follow you between sites.
The myth that an address identifies a person
Turning an address into a person needs a record only the provider holds: which subscriber account had that address at that moment. Reaching it takes legal process, and the rules differ by country. In the United States that generally means a subpoena or a court order, with the standard depending on the type of case. In the EU and the UK an address is treated as personal data in most circumstances, while retention periods and access rules are set nationally and vary. This is general information, not advice about a specific situation.
Even with that record, the answer is a household, not a person, which is why a threatening message quoting your address is a bluff. Any site you visit collects it, as does any image loaded in an email and any link that logs visitors before redirecting. Treat it like every other message engineered to make you panic.
The real exposure is direct connections. Some voice chat, peer to peer file sharing and older game lobbies link players to each other, so each end sees the other address. That is the route behind targeted network floods in gaming, and it is not a concern for ordinary browsing.
When hiding your address helps
| Method | What the site sees | What it hides | What it does not do |
|---|---|---|---|
| Restart the router until the lease expires | A different address, same provider | Almost nothing useful | Change provider, city or household |
| Consumer VPN | The VPN operator address | Your provider and region from the site, your destinations from the local network | Hide logins, cookies or fingerprints |
| Mobile data instead of home wifi | A carrier address shared with many subscribers | The link to your home line | Hide anything you signed into |
| Browser level proxy or relay | A relay address, for browser traffic only | Your home address from that site | Cover other apps on the device |
| Change the private address on your device | No change at all | Nothing | Anything outside your network |
The pattern repeats down every row: each option swaps who sees the address rather than removing it, and none touch the identifiers that name you. That is the honest frame for what a consumer VPN can and cannot do. It earns its place on a network you do not control, the subject of what is still risky on shared wifi, and it is pointless against a site you are signed into.
What to do today
- Find both addresses once. The router status page shows the public one, network settings on a phone or laptop show the private one. Knowing which is which saves confusion the next time something needs configuring.
- Before you try to host anything, a camera or remote access, check for carrier grade NAT by comparing those two numbers. If you are behind it, ask the provider for a routable address instead of fighting the router.
- Leave port forwarding and automatic port opening off unless a device needs it. Each rule holds a door open on a machine that may not be patched.
- If a service insists you are in the wrong city, the correction belongs with the geolocation databases, several of which accept requests, not with your provider.
- Do not buy a VPN purely to hide your address during everyday browsing. Keep one for untrusted networks and for when you need a different region.
- In the EU and the UK an address counts as personal data, so it sits inside the scope of a request for what a company holds on you.
Common questions
Can someone find my home address from my IP address?
No, not from the address by itself. A public lookup returns your internet provider and a geolocation estimate that is usually accurate to a region or a city. Your street address exists only in your provider billing records, and reaching those takes a court order or the equivalent legal process where you live. Anyone claiming otherwise in a message is trying to frighten you.
How do I change my IP address?
For the public one, leave the router powered off long enough for the lease to expire, which on many providers means a few hours rather than a few seconds, and you may still get the same number back. A VPN or mobile data changes what sites see instantly. If you need a permanent change, ask the provider. The private address inside your home can be changed in the router settings, but nothing outside will notice.
Why does a website think I am in the wrong city?
Because it is reading a geolocation database, and the database has your provider block mapped to the wrong place. This happens most on mobile networks, on business lines, and after a provider reassigns a block of addresses. It is common and harmless in itself, though it can trigger extra security checks on banking and shopping sites, which see an unfamiliar location.
Is it dangerous if someone knows my IP address?
For normal home use, not really. Without an open port there is nothing for an outsider to connect to, and your router blocks unsolicited connections by default. The realistic risks are being flooded with traffic, which mainly affects people who play competitive games in lobbies that connect players directly, and being fed a location guess that is often wrong anyway.
What is the difference between IPv4 and IPv6?
Length, mostly. IPv4 uses 32 bits, written as four numbers, and the supply ran out. IPv6 uses 128 bits, written as groups of hexadecimal digits, and has room for every device to hold its own public address. Both work for ordinary browsing, and most connections run both at once, so you rarely need to care which one a particular connection used.