A public IP address is globally unique and reachable on the internet, while a private IP address is reserved for use inside a local network and is never routed on the internet. Your router connects the two, usually through Network Address Translation (NAT).
The difference in one picture
Picture an office building. The building has one street address that the postal service uses to deliver mail: that is the public IP address. Inside, every desk has an internal extension or room number that only makes sense within the building: those are private IP addresses. The reception desk (your router) receives everything addressed to the building and passes it to the right desk.
| Public IP address | Private IP address | |
|---|---|---|
| Scope | Unique across the whole internet | Unique only within one local network |
| Assigned by | Your ISP (from blocks issued by a Regional Internet Registry) | Your router, usually via DHCP, or set manually |
| Reachable from the internet | Yes, subject to firewalls | No, not directly |
| Example | 203.0.113.42 | 192.168.1.23 |
| Who sees it | Every website and service you connect to | Only devices on the same network |
| Cost | Included with your internet service; static ones may cost extra | Free to use |
The private IP address ranges
RFC 1918 sets aside three IPv4 ranges for private networks. Anyone may use them without asking permission, and routers on the public internet are expected to drop traffic addressed to them.
| Range | CIDR block | Number of addresses | Typical use |
|---|---|---|---|
10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | 16,777,216 | Large corporate and cloud networks; some home routers |
172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | 1,048,576 | Business networks, Docker and other container defaults |
192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | 65,536 | Most home and small-office routers |
Note that only 172.16.x.x through 172.31.x.x are private. An address such as 172.32.0.1 or 172.15.0.1 is a normal public address. If you need to check exactly which addresses fall inside a block, the subnet calculator shows the first and last address of any CIDR range.
Other non-public ranges you may see
100.64.0.0/10is shared address space defined in RFC 6598 for carrier-grade NAT. If your router's WAN address is in this range, your ISP is sharing a public address between multiple customers.169.254.0.0/16is link-local. A device gives itself one of these addresses when it cannot reach a DHCP server, which usually signals a connection problem.127.0.0.0/8is loopback, used by a device to talk to itself. See What Is Localhost?
What about IPv6?
IPv6 has Unique Local Addresses (ULAs) in fc00::/7, in practice almost always starting with fd, which play a similar role to RFC 1918 space. However, because IPv6 has so many addresses, most home devices also receive a global IPv6 address that is publicly routable. Instead of hiding behind NAT, they are protected by the router's firewall, which blocks unsolicited inbound connections by default. Every IPv6 interface also has a link-local address beginning with fe80::.
How NAT connects private and public addresses
Because private addresses cannot travel across the internet, your router performs Network Address Translation (more precisely, port address translation) for outgoing IPv4 traffic:
- Your laptop at
192.168.1.23opens a connection from local port 51515 to a web server. - The router replaces the source address with its public address, say
203.0.113.42, and picks a free source port, say 40001. It records the mapping in its NAT table. - The web server sees a connection from
203.0.113.42:40001and replies there. - The router looks up port 40001 in its table, rewrites the destination back to
192.168.1.23:51515, and forwards the reply to your laptop.
This lets dozens of devices share one public IPv4 address. A side effect is that unsolicited inbound connections have nowhere to go: the router has no table entry telling it which device should receive them. That is why hosting a game server, camera or remote desktop at home requires port forwarding, a manual rule that sends a given public port to a specific private address. You can confirm whether a forwarded port is reachable with the open port checker.
Carrier-grade NAT (CGNAT)
Some ISPs, especially mobile networks, do not give your router a public address at all. Instead they assign an address from 100.64.0.0/10 or another private range and perform a second layer of NAT in their own network. Many customers then share one public IP address. CGNAT makes port forwarding impossible from your side, can cause problems with some online games and peer-to-peer apps, and means the public IP you see may also be used by strangers.
How to find your public and private IP
Your public IP
Your public IP is the address the rest of the internet sees, so the easiest way to find it is to ask an external service. The ToolsForAnyone home page shows it immediately, along with your ISP and approximate location. Every device on the same home network will normally show the same public IPv4 address.
Your private IP
Your private IP is configured on the device itself, so you look it up in the device's network settings or with a command:
- Windows: open Command Prompt and run
ipconfig; look for "IPv4 Address". - macOS: run
ipconfig getifaddr en0in Terminal, or open System Settings > Network. - Linux: run
hostname -Iorip addr. - iPhone and Android: open the details for your Wi-Fi network in Settings.
Full step-by-step instructions for every platform are in How to Find Your IP Address on Any Device.
Checking whether you are behind CGNAT
Log in to your router (see the router login guide) and find the WAN or Internet IP address on its status page. Compare it with the public IP shown on our home page. If they match, your router has a real public address. If the router shows an address in 100.64.0.0/10 or an RFC 1918 range, your ISP is using CGNAT.
Security and privacy implications
Your private IP reveals almost nothing useful to outsiders: millions of homes use 192.168.1.x. Your public IP is more informative. It shows which ISP you use and an approximate location, and it is the address that attackers would scan for open ports. Practical steps include keeping router firmware updated, disabling UPnP if you do not need it, and closing port forwards you no longer use. If you want websites to see a different public address, a VPN or similar service will do that; our guide on hiding your IP address compares the options.
Frequently asked questions
Why do my phone and laptop show the same public IP?
Because both are behind the same router, which translates their private addresses to a single public address. If your phone switches to mobile data, it will show a different public IP belonging to your mobile carrier.
Can someone hack me if they know my private IP?
Not from the internet. Private addresses are not routable, so an outsider cannot send traffic to them directly. Someone already on your local network, such as a guest on your Wi-Fi, could, which is why a strong Wi-Fi password and a separate guest network are worthwhile.
Is 192.168.1.1 a public or private address?
It is private. It is also one of the most common default addresses for home routers, alongside 192.168.0.1 and 10.0.0.1.
Can I choose my own private IP address?
Yes. You can set a static address on the device or, more conveniently, create a DHCP reservation in your router so the same device always receives the same private address. If you set the address manually on the device, pick one inside your router's subnet but outside its DHCP pool to avoid conflicts.