Public vs Private IP: What’s the Difference?

A public IP address is the address the rest of the internet sees, assigned to your router by your ISP. A private IP address works only inside your local network: your router hands out addresses like 192.168.1.10 to each device. Nearly every device online uses both at once.

What is a public IP address?

A public IP address is reachable from anywhere on the internet and is globally unique: no two networks on the public internet use the same one at the same time. That uniqueness is enforced by a chain of registries: IANA allocates blocks to five regional registries, which allocate to ISPs, which assign one address to your home. Every website you visit sees this address; it is how responses find their way back to your network, and it is the address that geolocation databases map to a city (see how accurate IP geolocation is). The IP shown on our What Is My IP Address tool is your public IP. New to the topic? Start with what an IP address is.

What is a private IP address?

A private IP address is used only inside your local network (your home or office). Your router assigns one to every connected device (phone, laptop, smart TV, printer) using DHCP. Private addresses are not routable on the public internet: internet routers are required to drop packets addressed to them. That is exactly why the same ranges can be reused in millions of homes without conflict: your 192.168.1.10 and your neighbor's never meet. Devices reach the outside world through your router, which translates private addresses to your single public IP using NAT (Network Address Translation).

Public vs private IP at a glance

The core differences side by side:

Private IP address ranges

Three blocks of IPv4 addresses are reserved for private use, defined in 1996 by RFC 1918. If an address falls in one of these ranges, it is a private IP and cannot appear on the public internet:

• 10.0.0.0 – 10.255.255.255 (10.0.0.0/8): about 16.8 million addresses, common in businesses
• 172.16.0.0 – 172.31.255.255 (172.16.0.0/12): about 1 million addresses, often used by virtual machines and containers
• 192.168.0.0 – 192.168.255.255 (192.168.0.0/16): about 65,000 addresses, the block most home routers use (hence 192.168.1.1)

One lookalike worth knowing: an address starting with 169.254. is not a private IP but a link-local address a device gives itself when it cannot reach a DHCP server. Seeing one usually means "my connection to the router is broken", not "I have a working private IP". You can explore any range's size and boundaries with our subnet calculator.

How NAT connects the two

NAT is bookkeeping, done per connection. When your laptop at 192.168.1.10 opens a connection from its port 51500, the router rewrites the packet so it appears to come from your public IP and some free port (say 203.0.113.42:62001) and records that mapping in a translation table. When the reply arrives on port 62001, the router looks up the entry and forwards it back to 192.168.1.10:51500. Dozens of devices can share one public address this way because each connection gets its own port mapping. It also explains why unsolicited traffic from the internet goes nowhere: with no table entry, the router has no idea which device it is for. The exception is a permanent entry you create yourself, which is all port forwarding is.

CGNAT: a public IP that isn't yours

Because IPv4 addresses are scarce, many ISPs now run Carrier-Grade NAT (CGNAT): the same trick your router performs, repeated at the ISP level, so that hundreds of households share one genuinely public address. For this middle layer, RFC 6598 reserves a dedicated range, 100.64.0.0/10. The surprise is that the "public" address your router receives may itself be private to the carrier: if your router's WAN address falls between 100.64.0.0 and 100.127.255.255, you are behind CGNAT. Browsing works normally, but port forwarding and hosting anything from home generally do not, because the address the internet sees belongs to the ISP's translator, not to you. Mobile networks work this way almost universally.

What changes with IPv6

IPv6 has so many addresses that the public/private split works differently: there is no NAT. Each device typically holds several addresses at once: a global unicast address (from 2000::/3) that is publicly routable, a link-local address (fe80::/10) used only on the local network segment, and optionally a unique local address (fd00::/8, defined in RFC 4193) that plays the role RFC 1918 plays in IPv4. Protection from unwanted inbound traffic comes from the router's firewall rather than from address translation. For the full story of how the two protocols differ, see IPv4 vs IPv6.

Why do I have two IP addresses?

Because your network has two layers. Inside your home, each device has its own private IP so your router can tell them apart. Outside, your whole network shares one public IP from your ISP. When you load a website, your router swaps the private source address for the public one on the way out, and reverses it on the way back. That is why a quick IP check shows a different number than your computer's network settings. On a dual-stack connection you may have an IPv6 address on top, so "two" is really a minimum.

How to find your public and private IP

Your public IP is the fastest to find. It is shown at the top of our What Is My IP Address tool, along with your location and ISP. We never log or store it. To find a device's private IP, check its network settings: on Windows run ipconfig, on macOS open System Settings › Network, and on phones tap the connected Wi-Fi network. It will usually start with 192.168 or 10.. Your router's own address is covered in how to find your router's IP. And remember it is only the public address that websites and trackers ever see. If you want to change what they see, that is a job for a VPN, proxy or Tor.

Related guides

• What is an IP address? The complete beginner's guide
• IPv4 vs IPv6: what's the difference?
• Static vs dynamic IP: which do you have?
• Subnet calculator: network, mask & host range