Cypher VPNPublic and Private IP Addresses: The Difference That Actually Matters
Your device has at least two addresses, and only one of them leaves your home. Which is which, why 192.168.x.x shows up on every router, and why the distinction decides what strangers can see.
In short
- A private address identifies a device inside your network. A public address identifies your whole network to the internet.
- Private ranges are reserved and repeat everywhere: 192.168.0.0/16, 10.0.0.0/8 and 172.16.0.0/12. Half the planet has a device on 192.168.1.5.
- Only the public address leaves your home, and it is the one every site records.
- The router translates between them, which is why a dozen devices can share one public address.
- Sites see only the public one. The exception is WebRTC, which can reveal a private address from inside the browser, and our leak test checks exactly that.
Why there are two
There are not enough IPv4 addresses. About 4.3 billion exist, which sounded enormous in the early eighties and ran out in practice years ago.
The fix was to stop giving every device its own public address. Instead, your provider gives your router one, and the router hands out private addresses internally. Your laptop, phone, TV and printer each get something like 192.168.1.x, and all of them reach the internet through that single public address.
The mechanism is called NAT, network address translation. The router keeps a table of which internal device asked for what, and routes the answers back correctly.
How to tell them apart at a glance
Private ranges are reserved by standard and never routed on the public internet:
- 10.0.0.0 to 10.255.255.255
- 172.16.0.0 to 172.31.255.255
- 192.168.0.0 to 192.168.255.255
If the address you are looking at starts with 192.168. or 10., it is internal and means nothing to anyone outside your home.
Anything else is public: 203.0.113.42, 8.8.8.8, and the address that appears when you open our check.
There is one more range worth recognising: 127.0.0.1, which always means «this very device». It never goes anywhere.
Which one sites see
The public one, always.
When you open a page, your request leaves your router carrying the public address. The site has no way to see that the request originally came from 192.168.1.5, and no reason to care.
This is why «hide my IP» always means the public one. The private address is already invisible, not because it is protected, but because it is meaningless outside your own network. There are millions of devices on 192.168.1.5 right now.
The exception worth knowing
One mechanism can expose a private address from inside the browser: WebRTC, the feature behind in-browser calls and screen sharing. To connect two people directly it needs to know the addresses of both, and it can ask the browser for them without the page asking you.
On its own a private address is not sensitive. It becomes useful to a tracker when combined with other signals, and it can suggest you are behind a tunnel when the public address says one thing and WebRTC says another.
Our leak test checks WebRTC alongside the address and the DNS resolver. More detail in the WebRTC leak article.
What a VPN changes here
A VPN replaces the public address that sites see with the exit server’s. Your private network is untouched: your laptop is still 192.168.1.5, the printer is still wherever it was, and the router keeps doing the same translation.
What changes is the step after the router. Instead of going to the site directly, traffic goes encrypted to the exit server and leaves from there. Sites see the server. Your provider sees a connection to one machine and stops seeing the rest.
Our exits are IPv4-only, and the AmneziaWG profile routes IPv6 into the tunnel and drops it there instead of letting it escape around the tunnel. In VLESS apps, TUN mode does the same job.
FAQ
Why is my address different on every site that shows it?
It should not be, unless something is sending traffic by different routes: a proxy in the browser but not the system, a VPN with split tunnelling, or an IPv6 leak where some sites see one address and some another.
Can two people have the same public address?
Yes, and it is common. Mobile operators and some providers put many subscribers behind one public address with carrier-grade NAT. It is one reason address-based blocking catches innocent people.
Is a private address dangerous to show?
Not by itself. It is reserved space that repeats everywhere. It matters as one signal among many for fingerprinting, and as a hint that you are behind a tunnel.
How do I find my private address?
On Windows, ipconfig in the command line. On macOS and Linux, ifconfig or ip addr. On a phone, in the wifi network details. The public one is easier: just open the check.
Does IPv6 still use private addresses?
Differently. IPv6 has enough space to give every device a public address, so NAT is often unnecessary. That is exactly why an IPv6 leak is worse than an IPv4 one: the address can point at a single device rather than a whole household.
One public address, chosen by you
A key instead of an account, both censorship-resistant profiles in every plan, DNS resolved on the exit machine. Free test for an hour, then from $1.99 a week.