Difference Between Public and Private IP Address: How to Tell Which Is Which

The difference between public and private IP address ranges is not a matter of opinion or analogy. IANA publishes a registry of every reserved address block, and one column in it answers the question outright: Globally Reachable. For 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 that column reads False.

That single word explains everything downstream. A private address cannot be reached from outside your network, so the internet cannot use it to find you, and your traffic has to borrow a different address to get anywhere. Which is why your computer and this website report two different numbers, and why both are telling the truth.

This guide gives you the registry, the RFCs behind it, and the decision rule for looking at any address and saying which kind it is. It also answers the question most pages on this subject quietly dodge: your private address is not in the traffic a website receives, and there is a specification that explains why.

Author: Sarah Thompson Network Intelligence Analyst

My honest position is that this topic is taught badly, and the reason is that almost every explanation reaches for a metaphor instead of the registry. Apartment numbers and street addresses get you to a rough intuition and then leave you stuck the moment you see a 100.64 address, or a 169.254 one, and cannot say which category it belongs to. The registry answers all of those cases in one column.

The honest limit is worth stating too. The address counts you see quoted everywhere — 16,777,216 and so on — have no source, because no RFC and no registry states them. They are arithmetic from the prefix length, and a page that presents them as cited facts is guessing about its own guessing. I would rather show you the calculation and let you check it.

What Is the Difference Between Public and Private IP Address Ranges?

Reach. A public address can be routed to from anywhere on the internet; a private one cannot, by design, and no amount of configuration on your side changes that. Every other difference between public IP and private IP that gets listed — who assigns it, whether it is unique, whether it costs money — follows from that one property.

RFC 1918 is where the private ranges come from. It states that IANA "has reserved the following three blocks of the IP address space for private internets", and lists them as "10.0.0.0 - 10.255.255.255 (10/8 prefix)", "172.16.0.0 - 172.31.255.255 (172.16/12 prefix)" and "192.168.0.0 - 192.168.255.255 (192.168/16 prefix)". On routing it is blunt: "routing information about private networks shall not be propagated on inter-enterprise links, and packets with private source or destination addresses should not be forwarded across such links."

On what that costs you it is blunter still: private hosts "cannot have IP connectivity to any host outside of the enterprise". The very next sentence is the one that matters for the rest of this page, though, because it is the escape hatch: "While not having external (outside of the enterprise) IP connectivity private hosts can still have access to external services via mediating gateways (e.g., application layer gateways)." That mediating gateway is your router.

The cleaner modern answer is a single field. IANA's IPv4 Special-Purpose Address Registry lists every reserved block with a Globally Reachable column, and that column is the whole distinction in one word. Here is what it says about the five blocks people actually run into.

Look at the last row, because that is the real definition. Public is the default; private is the exception carved out of it. An address is public unless it sits in a block someone reserved, which is why the useful skill is knowing the reserved blocks rather than memorizing what a public address looks like.

If the rest of how addressing works is still hazy, our plain-language guide to what an IP address is is the right place to start before coming back here. Now the question this page exists for.

What Is My Private IP Address, and Why Websites Cannot Read It From Your Traffic

Because it never arrives. If you have searched “what is my private IP” and landed on a page showing you a number, check which number it showed you.

When you load a page, the only address the server receives is the one your traffic was carrying when it crossed onto the public internet — and that is not your device's address. Your router replaced it on the way out, so there is no field in an HTTP request where your 192.168 number is hiding.

The mechanism that does this is Network Address Translation, and what it does is translate private IP to public IP on the way out. What it does not do is carry the original along for the server to read. RFC 3022, which defines traditional NAT, states the privacy effect carefully rather than absolutely, and files it under the protocol's limitations in a section titled Privacy and Security: "Traditional NAT can be viewed as providing a privacy mechanism as sessions are uni-directional from private hosts and the actual addresses of the private hosts are not visible to external hosts." Read the hedge in can be viewed as: the RFC is describing a consequence of one-way sessions, not a guarantee being offered to you.

This is why a search for “what is my public IP” and a search for “what is a private IP” return such different kinds of result. The first has dozens of tools that genuinely answer it; the second mostly returns tools showing you the public address anyway, which is a different thing with a different value.

Our own checker is explicit about what it reads: your public IP address, meaning the one the internet sees arriving from your connection. For the private one you have to ask the device itself.

That is how to get your private IP on any machine you can open a terminal on. Read the IPv4 Address line for the adapter you are actually using, because ipconfig prints a block for every adapter, virtual ones included. The Default Gateway on that same block is your router's private address, which is the number a good many people are really after when they go looking for this.

Two honest caveats. On macOS, en0 is usually Wi-Fi on laptops and Ethernet on desktops, so if it returns nothing try en1. And on Android and iOS there is no command line: the address sits on the Wi-Fi network's details screen, and I am not giving you the exact taps, because I could not reach a current Google or Apple page documenting them and I will not describe a screen I have not seen.

A third caveat matters more than either, and it is the one exception to everything above. Some sites do try to read your private address using WebRTC, a browser feature for peer-to-peer connections, and it sometimes works. That is your browser handing the address over through a separate channel, not the site reading it out of your traffic, and it is unreliable and getting less reliable as browsers close it.

So a site that manages it has not shown you the address was public all along. It has shown you a browser feature doing something most people would switch off if asked. Which brings us to the rule for telling the two apart.

How to Tell If an IP Address Is Public or Private

Test it against the private IP ranges, in order, and stop at the first match. That is the whole method, and the stop-at-the-first-match part is borrowed from how an ordered firewall chain evaluates a rule list. There is no pattern to eyeball and no rule of thumb that survives contact with 100.64 or 169.254 — those two are exactly where guessing fails.

If you would rather not do that by hand, our CIDR range checker takes a column of addresses against a column of blocks and reports which block matches first — first match specifically, because that is the only rule an ordered firewall chain ever runs. It ships with nothing pre-loaded, so copy the five blocks out of the table above into the blocks side, and paste whatever addresses you are unsure about on the other.

One more case worth naming, because it trips people up in both directions: 127.0.0.1 is neither public nor private in the sense used here. IANA lists 127.0.0.0/8 under the name Loopback, citing RFC 1122, with Forwardable and Globally Reachable both False and Reserved-by-Protocol True — the same shape as link-local rather than the private blocks. If a diagnostic is showing you 127.0.0.1, you are looking at the machine talking to itself. Next, where each of your real addresses actually comes from.

Who Assigns Each Address, and What Each One Reveals

Two different parties, on two different schedules, for two different jobs. Your private address is handed out inside your own network, usually by the router, and nobody outside needs to agree to it. Your public address comes from your provider, out of a block a regional registry allocated to them, and it has to be globally coordinated, which is why it arrives as a registry allocation rather than a number your router picked.

RFC 1918 makes the asymmetry explicit for the private side: an organization using this space "can do so without any coordination with IANA or an Internet registry." On what that freedom costs, the same section is equally direct: "Addresses within this private address space will only be unique within the enterprise, or the set of enterprises which choose to cooperate over this space so they may communicate with each other in their own private internet." Unlimited supply, guaranteed only inside your own walls. Here is the full comparison.

The private side is assigned by a protocol rather than a person in almost every home, and how DHCP assigns IP addresses — handing your device one and taking it back when the lease ends — is worth understanding if you have ever wondered why the number changed on its own. But there is a case where the address your router shows is neither private in the ordinary sense nor the public one either.

When Your Public IP Is Not Really Yours: 100.64 and CGNAT

If your router's own external address starts with 100.64 through 100.127, you do not have a public address at all. Your provider does, and you are sharing it with other subscribers. That block exists precisely for this: RFC 6598 states that "the Shared Address Space address range is 100.64.0.0/10", and IANA's registry marks it Globally Reachable: False alongside the RFC 1918 ranges.

This is the case that breaks every rule-of-thumb explanation of public versus private, because the address is in neither of the two buckets most articles describe. It also has consequences you can feel: inbound connections and port forwarding stop working the way the manual says, and a site that blocks the shared address blocks every subscriber behind it at once.

One warning about that test, because it is the mistake I see most. A WAN address in 10, 172.16 or 192.168 does not prove carrier translation — those are ordinary private ranges and the usual cause is a second router or a modem in routed mode on your own side of the line. Only 100.64 to 100.127 is specific to the carrier. And there is one more address family that belongs in neither column.

The Address That Is Neither: What 169.254 Means

On a home network it means assignment failed and the device configured something itself so the interface would not sit empty. RFC 3927 describes the mechanism and names the range: "The IPv4 prefix 169.254/16 is registered with the IANA for this purpose", the purpose being an address a host can configure for itself with no server involved. It is not only a failure state, though: the same RFC says link-local addresses "should therefore only be used where stable, routable addresses are not available (such as on ad hoc or isolated networks) or in controlled situations where these limitations and their impact on applications are understood and accepted."

What makes it different from the private blocks is worth seeing in the registry rather than being told. For 10, 172.16 and 192.168, IANA records Forwardable: True — a router inside your network may pass those packets along. For 169.254 it records Forwardable: False, and RFC 3927 backs it with a hard requirement: "A router MUST NOT forward a packet with an IPv4 Link-Local source or destination address, irrespective of the router's default route configuration or routes obtained from dynamic routing protocols."

So a 169.254 address is not a private address that happens to be unlucky. It is a category of its own, and it will not cross a router even inside your own house. It is also not something anyone configured, and RFC 3927 is explicit about that: addresses in the prefix "SHOULD NOT be configured manually or by a DHCP server". Windows calls this APIPA, and our guide to APIPA and 169.254 addresses carries the fix, not this page — which leaves one number everybody quotes and no RFC or registry states.

How Many Addresses Does Each Private Block Hold?

Sixteen million, one million and sixty-five thousand, roughly — and here is the part other pages leave out. No RFC and no registry states those figures. RFC 1918 gives the blocks and their prefixes and nothing else; IANA's registry gives names, RFCs and reachability flags and nothing else. The numbers are arithmetic from the prefix length, which means you can check them yourself rather than trusting anybody.

The calculation is 2 raised to the number of host bits, and the host bits are 32 minus the prefix. RFC 1918 even gives you the shorthand: it says: "We will refer to the first block as '24-bit block', the second as '20-bit block', and to the third as '16-bit' block."

Those are total addresses in each block, not addresses you can hand to devices. On any individual subnet carved out of them you lose the network address and the broadcast address, so a /24 inside 192.168 gives you 254 usable hosts rather than 256. The slash number is CIDR notation for a subnet mask, and what a subnet mask decides, bit by bit, is where that arithmetic comes from. With the mechanics settled, the question people ask next is which one they should want.

Should Your IP Address Be Public or Private?

You do not choose, and that is the honest answer. If you are asking “should my IP address be public or private”, the setting you are looking for does not exist: your device gets a private address because your network hands it one, and your connection gets a public address because your provider assigns it. Neither is a setting you toggle. What you can sometimes choose is whether the public one is fixed or changes, and whether you have one of your own at all.

The question people usually mean is different: do I need an address the outside world can reach? That has a real answer, and it depends entirely on whether anything needs to connect in to you.

There is a privacy angle worth naming plainly, because it cuts the other way from what people expect. Being behind a shared or translated address is not a privacy feature you should rely on, and RFC 3022 names the cost in the same breath as the benefit: "The same characteristic that enhances privacy potentially makes debugging problems (including security violations) more difficult." Read that from the other side and it is why a shared address gets a whole neighborhood blocked for one person's behavior.

A permanent, fixed public address is still more identifying over time than one that rotates. If that trade-off matters to you, decide it deliberately rather than by default.

What Your Public IP Address Reveals, and What It Does Not

Your public address is the only one of the two that says anything about you, and it says less than people fear. It identifies a network, not a person and not a street. A site that logs it can look up which provider owns it, which autonomous system announces it, roughly which region it is registered to, and whether any public list currently names it — but not your name, and its guess at your location is a database lookup rather than a measurement.

what a website can see from your IP goes through each of those layers, where the readings come from, and their error rates. What matters here is the contrast with the other number.

Confusing the two leads people to hide a number nobody can see, or to troubleshoot a public problem by changing a private setting. Both waste an afternoon.

The Short Version

The difference between public and private IP address ranges is reachability, and IANA states it in one column. For 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and 100.64.0.0/10 the registry records Globally Reachable: False. Everything else is public unless some other block reserved it. That is the test, and it beats any analogy.

Two things to take away that most pages on this subject get wrong. No website is reading your private address out of your traffic — RFC 3022 says the actual addresses of private hosts "are not visible to external hosts", so read it off the device with a command instead. And the address counts everyone quotes have no citation; they are 2 raised to the host bits, and you can check them yourself.

If your next question is whether your public address stays the same, our guide to static IP or dynamic IP covers both sides of that. And if you would rather the internet saw a different address entirely, how to hide your IP address for free is the honest survey of what each method costs you. Start by reading both of your numbers, though — most of the confusion on this topic dissolves the moment you know which is which.