IP Address Checker

Overview

Your public IP address is the one thing about your connection you cannot see from inside your own machine. ifconfig shows the private address your router handed you; the address the rest of the internet sees belongs to whatever NAT, CGNAT, VPN or proxy sits between you and it.

This tool reports the address your connection actually presented, plus what Cloudflare’s edge already knows about that connection: the network operator, the autonomous system number, an approximate location, and the negotiated TLS and HTTP details.

There is no input field, because there is nothing to type. The answer is a property of the connection, not of a query.

How to use

Open the page. The lookup runs on load. Use copy IP to take the address.

What the fields mean

ip — the address the request arrived from. Behind a VPN this is the exit node; on a mobile network it is often a carrier gateway shared by thousands of subscribers.

org and asn — the network that announces this address block. The ASN is the stable identifier; the organisation name is what it calls itself. This pair is far more reliable than the geolocation, and it is what actually matters when you are diagnosing “why does this network behave differently”.

city, region, country, postalCode, loc — geolocation derived from the address block’s registration and routing. Treat country as reliable, city as a good guess, and anything finer as decoration.

timezone — inferred from the same data, which is why a browser’s own timezone is the better source when you need to be right.

colo — the Cloudflare data centre that handled the request, as an airport code. Useful for understanding routing: a connection in Osaka served from Singapore explains a latency figure that otherwise looks impossible.

httpProtocol, tlsVersion, tlsCipher — what your client and the edge actually negotiated. This is the quickest way to confirm whether a client really speaks HTTP/2 or TLS 1.3, as opposed to whether it claims to.

clientTcpRtt — the round-trip time measured during the TCP handshake, in milliseconds. It is a lower bound on your latency to the edge that no application-level measurement can beat.

Why geolocation is approximate by construction

An IP address is assigned to a network, and networks are not places. The mapping from address to location comes from registry records and routing data, both of which describe administrative facts rather than physical ones.

The failure modes are systematic rather than random:

• Mobile networks. Traffic exits through a small number of regional gateways, so a phone in one city routinely geolocates to another.
• Carrier-grade NAT. Hundreds or thousands of subscribers share one public address. Nothing about the address distinguishes them.
• VPNs and proxies. The location is the exit node’s, which is the point.
• Corporate networks. A company may route all traffic through one headquarters, so every office appears to be in the same country.
• Recently reassigned blocks. Databases lag reallocation by weeks or months.

Which is why this tool labels the location as approximate and does not draw conclusions from it. If you need to know where a user is, ask them.

What your address actually reveals

Worth being precise about, because the answer is usually overstated in both directions.

An IP address identifies a network endpoint, not a person. On its own it gives an observer your network operator, a rough region, and whether you are on a residential, mobile, datacentre or corporate connection. That is enough to segment you and not enough to name you.

It becomes identifying when combined. Your ISP knows which subscriber held an address at a given moment; a site that already has your account can pin the address to it; and an address that stays stable for months functions as a persistent identifier across every site you visit, without any cookie involved. This is exactly why “we don’t use cookies” is a weaker claim than it sounds — server logs alone are enough to build a history.

Under GDPR, an IP address is personal data. That is not a technicality about identifiability; it is the settled legal position, and it is why this tool does not keep the values it reads.

Two practical implications:

• A VPN moves the observation point, it does not remove it. Your VPN provider sees what your ISP used to see. You have changed who you trust, not how many parties can watch.
• Blocking by IP hurts bystanders. Because CGNAT and corporate egress make addresses shared, banning one address bans everyone behind it. The browser fingerprint tool covers the other half of this problem — what a browser reveals even when the address changes.

Examples

• Confirming a VPN is actually carrying your traffic. Compare the org before and after connecting. If it still names your ISP, the tunnel is not routing what you thought.
• Allowlisting an address. Get the address to give to whoever maintains the list. Check whether it is stable first — residential addresses often are not.
• Diagnosing unexpected latency. Read colo and clientTcpRtt. Routing to a distant data centre is a network-path problem, not an application one.
• Verifying protocol support. httpProtocol and tlsVersion report what was negotiated, which settles arguments that configuration files do not.
• Checking IPv6. If the address shown is IPv6, your connection preferred it. Many “IPv6 is enabled” claims do not survive this check.

Notes

The address is read from the connection’s own headers at the edge, so it cannot be spoofed by sending a different X-Forwarded-For — that header is not consulted for the reported value in production.

Fields with no value are omitted rather than shown as empty or guessed. A connection where Cloudflare has no city produces a result without a city, which is a smaller and more honest answer than an invented one.

Nothing is stored. The values exist for the duration of the response and are not written to a log or database we keep; the privacy policy describes this alongside the other tools that involve a server step.

For what a domain resolves to, rather than what your own connection looks like, use the DNS lookup.