Types of IP addresses explained: Complete guide

An Internet Protocol (IP) address is a network identifier that tells systems where to send data. Every device that connects to the internet uses one, but not all IP addresses work the same way. Some are visible to the wider internet, some only work inside your home or office network, some stay fixed, and others change as you reconnect.

The type of IP address you have affects how your connection behaves. It can influence whether a service is reachable from the public internet, whether your approximate location can be identified, whether you run into login challenges, and how easy it is to host or share something online.

In this guide, we’ll look at the main types of IP addresses, why they exist, and when each one is used.

Structure and versions of IP addresses

Two IP addressing formats are used today: IPv4 and IPv6. They serve the same function but follow different structures, mainly to expand the number of available IP addresses as the internet grows.

IPv4 address format

IPv4 is the original version of the Internet Protocol and still forms the backbone of most online communication. An IPv4 address contains 32 bits, divided into four groups of eight, called octets. Each octet represents a number from 0 to 255, because eight bits can represent 256 possible values.

In everyday use, those octets are written as decimal numbers separated by periods, for example, 203.0.113.42. This notation, called dotted-decimal format, makes the binary address easier for humans to read and record.

Together, 32 bits provide about 4.3 billion unique addresses. That seemed abundant when IPv4 was introduced, but the growth of smartphones, Internet of Things (IoT) devices, and cloud services quickly exhausted the space.

IPv6 address format

IPv6 was introduced to overcome the address limitations of IPv4, which could no longer accommodate the rapidly growing number of connected devices. Each IPv6 address uses 128 bits, expanding the available pool from billions to roughly 340 undecillion (3.4 × 10³⁸). In practical terms, IPv6 offers enough unique combinations to support global connectivity for many generations.

IPv6 addresses are written in hexadecimal and separated by colons. For example:

2001:0db8:85a3:0000:0000:8a2e:0370:7334.

To make them easier to read, IPv6 allows shortening rules. Leading zeros in each group can be omitted, and one sequence of all zeros can be replaced with a double colon (::). The same address can therefore appear as 2001:db8:85a3::8a2e:370:7334.

Beyond increasing IP address space, IPv6 improves how networks handle connections and configuration. Devices can configure their own IP addresses automatically, which makes large networks easier to manage. It also replaces the broad, one-to-all messaging used in IPv4 with a more efficient, group-based approach (called multicast) that only reaches the devices that need the data.

Key differences between IPv4 and IPv6

IPv6 expands on IPv4’s design to handle the modern internet more efficiently.

One of the biggest differences between the two protocols is how they deal with address scarcity. Because IPv4 offers only around 4.3 billion unique addresses, most networks rely on Network Address Translation (NAT), a technology that lets multiple devices share a single public IP address. NAT helps preserve IPv4 address space, but it introduces complexity: it breaks end-to-end connectivity, complicates certain applications, like Voice-over-Internet Protocol (VoIP) and peer-to-peer (P2P) services, and requires routers to maintain translation tables.

IPv6 eliminates this problem entirely. Its enormous 128-bit address space provides more than enough public addresses for every device, making NAT unnecessary. In an IPv6 network, each device can have its own globally routable address, restoring straightforward end-to-end communication.

Data delivery is also optimized through multicast. IPv4 treats Internet Protocol Security (IPsec) as an optional add-on for securing traffic between networks. But IPv6 includes IPsec support as part of the protocol specification. This means all IPv6-compatible systems are required to support it, even though using it still depends on network configuration.

Most systems today support both protocols through a setup called dual stack. Devices try IPv6 first and fall back to IPv4 when needed. In most home networks, you’ll still see IPv4 in use, as it remains the most widely supported standard today. Over time, as more services adopt IPv6 exclusively, the older protocol will remain only for backward compatibility.

Types of IP addresses by use case

How IP addresses work depends on whether they’re public or private and whether they stay fixed or change over time.

Public IP address

A public IP address identifies your network to the wider internet. It’s the IP address that websites, apps, and online services see when you connect.

In most homes, your internet service provider (ISP) assigns a public IP address to your router. Every device on your network uses that assigned IP address when it reaches the internet, so they all appear to come from a single source.

Private IP address

A private IP address operates within a local network, such as your home Wi-Fi or office local area network (LAN).

Private IP address ranges are reserved blocks that are not routed on the public internet. IPv4 examples are IP addresses that start with 10., 172.16. through 172.31., or 192.168.

Your router gives out private IP addresses to each device that joins. This lets devices on the same network communicate with each other directly. For example, your laptop can send a file to your smart TV or printer over a private IP address without that traffic ever leaving your house.

Private IP addresses are reusable. Devices in separate locations can use the same one since they’re separated by their respective routers. When you connect to the internet, the router translates the request using the network’s public IP address.

Static IP address

A static IP address stays the same unless someone changes it manually. It can be public or private, and the idea behind it is stability.

A static public IP address is assigned by your ISP and always identifies your connection in the same way. Businesses often use a static IP address so customers or remote staff can reach a consistent IP address from outside the network. If a company hosts a website or remote access tool on that IP address, people can return to it again and again without anything changing behind the scenes.

A static private IP address is set inside your home or office network. Administrators often assign one to devices that must always be reachable in the same place, such as a server, a printer, or a camera. If a device keeps the same IP address every day, you do not have to check which IP address it picked up before you try to connect to it.

The main benefit of a static IP address is predictability. A device that never changes its IP address is easier to find, easier to manage, and easier to connect to because nothing shifts from one session to the next.

The tradeoff for static public IP addresses is recognizability. When the same address appears each time you go online, websites can link activity from that IP address over time. They may not know who you are, but the repeated traffic makes the connection itself easier to follow than a dynamic public IP address that rotates periodically.

To learn how to set one up yourself, see our step-by-step guide on configuring a static IP address.

Dynamic IP address

A dynamic IP address changes over time. It’s assigned automatically by the network and can rotate whenever your device reconnects or whenever the provider refreshes it.

A dynamic public IP address is assigned by your ISP and identifies your connection on the internet. Your router receives this IP address when it comes online, and it may stay the same for a while before changing again. The rotation is normal because ISPs reuse public IP addresses across many customers rather than reserving one for every connection.

A dynamic private IP address works inside your home or office network. Your router uses Dynamic Host Configuration Protocol (DHCP) to assign these temporary IP addresses to devices as they join the network. Each time a device reconnects, the router can give it whichever private IP address is available. This lets the router reuse addresses from devices that have gone offline and avoids manual setup.

The convenience of a dynamic IP address comes from automation. The network chooses the IP address for you and updates it as needed, so you never have to configure it yourself. For example, if your router restarts after a power cut, your ISP automatically gives it a new public IP address, and your devices automatically receive new private IP addresses from the router.

The tradeoff is reachability. When the public IP address that identifies your connection changes regularly, services that need to reach your home network directly can become harder to set up. Someone trying to connect to a home server or camera may not know where to find it unless you use a static public IP address or a tool like Dynamic Domain Name System (DDNS).

For a detailed explanation of how static and dynamic IPs work, including when each is used and how they affect privacy, see our guide on static vs. dynamic IP addresses.

Types of IP addresses by hosting

These terms indicate how many users share an address in services like virtual private networks (VPNs), hosting, and email delivery.

Dedicated IP address

A dedicated IP address is assigned to only one customer, server, or service. It remains the same over time and is not shared with anyone else.

A dedicated public IP address is assigned by an ISP or hosting company. Both businesses and individual users can have a dedicated public IP address if their provider offers it as part of a plan. It’s useful when a system needs a fixed IP address, such as a website, mail server, or remote access service. It also helps with access control because organizations can allowlist specific IP addresses so only approved connections can reach internal tools or remote services.

It also makes DNS management more reliable. When a website or mail server uses a dedicated public IP address, its domain always points to the same place. This consistency helps ensure that browsers, email servers, and connected applications reach the correct system instead of being directed to an outdated or incorrect destination.

A dedicated VPN IP address works differently. Some VPNs (including ExpressVPN) offer an IP address that only one customer can use. When you connect to the VPN, you always appear online under the same exit IP address, and no other VPN users share it. This can reduce login challenges or CAPTCHAs on websites that treat shared IP address ranges as suspicious.

Shared IP address

A shared IP address is used by many customers or many devices at once.

Most consumer VPN connections use shared IP addresses. Dozens or even hundreds of users appear to come from the same public IP address at the same time. That makes it difficult to link specific activity to a single person.

Shared IP addresses also appear in regular web hosting. Many smaller sites can sit behind one IP address, and the web server sorts incoming requests based on the domain name.

The tradeoff is reputation risk. If a user behaves in a way that results in an IP address getting flagged or rate-limited (temporarily restricted so it can send fewer requests), this will affect all users of that IP address. In some cases, you may see extra CAPTCHAs or blocks that you did not personally cause.

Specialized and operational IP address types

These types of IP addresses are functional categories. They describe how data is delivered on a network.

Unicast IP address

Unicast is the standard way data moves between devices on a network. Each unicast IP address identifies a single destination, and the data sent to it is delivered only to that specific device.

When your computer requests a web page, your browser sends packets to the server’s unique IP address, and the server replies directly to your computer’s IP address. This one-to-one exchange is called unicast, and it’s how almost all normal internet traffic operates.

Broadcast IP address

Broadcast communication sends a single message to all devices on a local network segment. It’s typically used for discovery or coordination tasks, like when a new device announces itself or requests configuration details.

A broadcast IP address represents every device within that subnet. When data is sent to this IP address, it’s delivered to all connected systems on the local network (when using IPv4). This allows devices to communicate without needing to know each other’s specific IP addresses.

Broadcast traffic is limited to the local network and isn’t routed across the internet.

Multicast IP address

A multicast IP address identifies a group of devices that have chosen to receive the same data stream. When the sender targets that multicast IP address, every device in the group receives a copy.

For example, a company streaming a live video to hundreds of employees on the same network can send one multicast stream instead of hundreds of separate copies. Only devices that have joined that multicast group receive the data, so it’s targeted rather than fully open like a broadcast.

Multicast improves efficiency because it reduces duplicate traffic while still reaching everyone who needs the information.

Anycast IP address

An anycast IP address is a single address shared by multiple servers in various locations. When data is sent to it, the internet’s routing system automatically directs the request to the nearest or best-performing server in that group.

This is widely used by public DNS resolvers and content delivery networks (CDNs). For example, when you query a global DNS service, your request is handled by the closest operational node even though all nodes share the same IP address.

From the user’s perspective, anycast appears as a single, stable address, but behind the scenes, it provides faster response times and better redundancy.

Loopback address

A loopback address is an IP address that is used by the device to send traffic to itself.

In IPv4, the loopback range begins with 127, and the most common address is 127.0.0.1. In IPv6, the loopback address is ::1.

Loopback is used for testing or for programs that need to communicate within the same machine. For example, when developers run a web server on their own computer, visiting 127.0.0.1 in a browser connects to that local service, not the internet.

Because loopback traffic never leaves the device, it’s isolated and secure by design.

Automatic Private IP Addressing (APIPA)

APIPA is a fallback mechanism used in IPv4 networks when a device can’t get an address from the network automatically, usually because the router or DHCP service didn’t respond.

When this happens, the device assigns itself an IP address in the 169.254.x.x range so it can still detect and communicate with other devices on the same local connection. This allows limited local networking, such as sharing files between two laptops directly linked by cable.

However, an APIPA address has no route beyond the local link. If you see a 169.254 IP address on a computer that should be online, it usually means there’s a problem with the router, Ethernet cable, or Wi-Fi connection.

Default gateway IP address

The default gateway is the IP address of the device that routes traffic from your local network to other networks, such as the internet.

In most homes, this gateway is the router. When your computer sends data to an external website, it forwards it to the gateway, which then decides where to send it next.

Knowing your gateway IP address is useful when signing in to your router’s settings page, changing Wi-Fi configurations, or troubleshooting network connectivity.

IP address allocation and management

IP addresses are organized through systems that decide how they’re grouped, distributed, and reused across networks.

IP address classes (A, B, C, D, E)

When IPv4 was first designed, IP addresses were divided into fixed-size groups called IP address classes. The idea was to make the assignment simple:

• Class A covered huge organizations with millions of hosts.
• Class B handled mid-sized networks.
• Class C was meant for smaller networks.
• Class D was reserved for multicast traffic.
• Class E was set aside for testing and research.

Each class used a predefined number of bits for the network and host portions of the address. This made setup easy but also led to waste: large organizations sometimes received far more addresses than they needed, while smaller ones ran short.

You’ll still see phrases like “Class C range” used informally to describe small address blocks, but modern networks no longer rely on these rigid classes. If you want to see how each class worked in detail, check out our guide on IP address classes.

Classless Inter-Domain Routing (CIDR)

As the internet grew, the class system became inefficient. CIDR replaced it in the 1990s to make better use of limited IPv4 space.

Instead of assigning IP addresses in fixed class sizes, CIDR lets network operators define flexible block sizes using a format like 192.168.1.0/24. The number after the slash indicates how many bits identify the network (in this case, 24 bits), leaving the remaining 8 bits for devices within that network.

CIDR makes routing more efficient and allocation more precise. It allows providers to issue precisely the right number of IP addresses for each customer, reducing waste and keeping the internet’s routing records (the lists routers use to find the right destination) smaller and faster to process.

Subnetting overview

Subnetting divides a larger network into smaller, organized sections called subnets. Each subnet has its own range of IP addresses and usually serves a specific group of devices or purpose.

For example, a company might use one subnet for employee laptops, another for conference rooms, and another for IoT devices. Each subnet has a unique IP address range with distinct security and routing rules.

Subnetting improves performance by keeping broadcast or local traffic contained within its group. It also prevents conflicts, since every device operates within a clearly defined part of the overall network space.

IP address security and privacy concerns

IP addresses are a normal part of how devices communicate, but they can also be used in network attacks when exposed systems are poorly secured. If a server, router, or app behind your public IP address is outdated or misconfigured, it can become a target for disruption or unauthorized access.

Common threats

Spoofing

Spoofing is when an attacker fakes the source of their traffic by using a forged public IP address. This lets them make their traffic look as if it came from somewhere else. Attackers often use spoofing during distributed denial-of-service (DDoS) attacks against websites, game servers, or streaming services. It helps them overwhelm a target or slip past filters that only allow traffic from trusted IP address ranges.

What this can look like:

• Gamers and home users may feel the impact when the service they’re using slows down or goes offline because attackers are flooding it with spoofed traffic.
• Small businesses running a website or exposed service on their public IP address may see outages or forced downtime.

ISPs can help prevent spoofing by implementing Best Current Practice 38 (BCP38), a standard defined in Request for Comments (RFC) 3704, which blocks outgoing traffic with forged source IP addresses.

Hijacking

Hijacking occurs when someone pretends to own another organization’s public IP address range by announcing it through the global routing system. This changes how traffic flows on the internet. Instead of reaching the real network, the traffic for that IP address range is diverted somewhere else.

What this means in practice is that any service tied to the hijacked range (such as a website or email server) may stop responding, load inconsistently, or route through a network that isn’t supposed to handle it. If the traffic isn’t encrypted end-to-end, the detour can also expose it to unwanted inspection or modification.

What this can look like:

• A website or email service becomes unreachable because its public IP address range is being routed to the wrong place.
• Pages load slowly or fail intermittently because the traffic is being sent through a distant or misconfigured network.
• Users trying to reach the service see errors or timeouts even though their own internet connection appears normal.

Man-in-the-middle (MITM) attacks

MITM attacks place an attacker in the communication path between two systems. Both sides believe they are talking directly, but the attacker is silently reading or altering the traffic in between. This can happen on unsecured public Wi-Fi, a compromised router, or any network path where interception is possible.

What this means is that information you send or receive can be viewed, changed, or redirected. Traffic tied to your private IP address inside your home network and traffic linked to your public IP address on the wider internet can both be affected, depending on where the interception occurs.

What this can look like:

• Browsing on public Wi-Fi exposes unencrypted information, letting an attacker see or modify what’s being sent.
• A compromised router sends you to a lookalike login page that captures your credentials or injects unwanted content.
• Apps show certificate errors or fail to connect because encrypted traffic is being tampered with.

Public vs. private IP address security

A public IP address doesn’t make a device vulnerable on its own, but it does place that device where anyone on the internet can reach it. Attackers regularly scan public IP address ranges to find systems that respond. If something on your network is exposed through your public IP address and it uses weak credentials, outdated software, or an open remote access tool, it can become an entry point.

A private IP address only works inside your home or office network and cannot be reached directly from the internet. That reduces exposure but does not remove risk. If malware enters your network through another route (such as an infected laptop, a compromised router, or a weak IoT device), it can still move between devices that communicate over private connections.

A reliable way to protect both the device that uses your public IP address and the ones inside your private network is to secure the equipment they rely on. That includes keeping your router’s firmware updated, using strong passwords, disabling unnecessary remote access features, and making sure connected devices use current software.

Dynamic IP vulnerabilities

A dynamic IP address does not introduce direct security vulnerabilities. Changing the public IP address does not make a device easier to attack, expose additional services, or weaken the protections already in place on your network.

Most issues linked to dynamic addressing are operational limitations, not vulnerabilities. These arise because some systems expect an IP address to stay the same and behave differently when it rotates.

Monitoring continuity

Some online services use public IP addresses as one signal to see whether multiple actions come from the same internet connection. When a dynamic IP address changes, that link breaks.

The service may treat the new address as unrelated to earlier activity, which can lead to extra verification prompts for the user or make long-running patterns harder for operators to follow. This affects the accuracy of monitoring systems rather than the security of your device.

Inherited reputation

A newly assigned IP address may carry a reputation from previous use, such as rate limits or CAPTCHA challenges applied by certain services. This can affect how some sites respond to you until their systems update.

This behavior reflects how reputation systems work and does not create a vulnerability in your connection.

Can my IP address be tracked?

Your public IP address is visible to websites and online services you connect to. It can reveal general information about your connection, such as your city or region and which internet provider you use, but not your exact address or identity.

Websites, advertisers, and online services may record IP addresses to manage traffic, detect abuse, or link visits from the same network. On its own, an IP address isn’t enough to identify you personally. Only your ISP can match an IP address to a customer account, and that information isn’t publicly available. It can be disclosed to authorities under a lawful request or, in some countries, retained under data-retention rules.

Tracking becomes easier when your IP address is stable, such as with a static connection, or when it’s combined with other identifiers like cookies, device data, or account logins. A dynamic IP address that changes over time makes long-term tracking less reliable.

How to find your private and public IP addresses

Use these steps to look up your device’s private (local) IP address and your connection’s public IP address.

How to find your private IP address on Windows

To see your private IP address on Windows, open Command Prompt, type ipconfig, and press Enter. Look for the line that says IPv4 Address under the active network adapter. The number next to the IPv4 field is the private IP of your Windows device on your local network.

How to find your private IP address on macOS

To see your private IP on macOS:

1. Open System Settings > Network, then choose Wi-Fi (or Ethernet if you’re on a wired connection).
2. You’ll see your connected network listed; click Details beside it.
3. Under the TCP/IP tab, look for IP address to see your Mac’s private IP on the local network.

This guide shows you how to check your router’s IP address.

How to find your public IP address

You can use ExpressVPN’s IP address checker to see your public IPv4 address.

If you’re using a VPN, the IP address shown will be that of the VPN server, not your original connection.

IP address behavior when using a VPN

A VPN creates an encrypted tunnel from your device to a VPN server. Once connected, your internet traffic passes through that server before reaching websites or apps. To the website, the VPN server becomes the apparent source of traffic.

Does a VPN mask my IP address?

Yes. When you connect to a VPN, websites and apps see the IP address of the VPN server instead of the public IP address assigned by your ISP. This masks your general location and prevents direct exposure of your connection.

However, masking your IP address does not stop other tracking methods such as cookies, account logins, or browser-based identifiers that can recognize your device. Those signals continue to work even when your IP address changes. A VPN also can’t hide your IP address from your ISP. (You can read more about what your ISP can and can’t see when you use a VPN here.)

Can I get a static IP with a VPN?

Some VPN services offer a static (fixed) IP option. In that setup, you connect through the same exit IP address each time, rather than one that might rotate between sessions.

Certain online banking portals, work networks, or remote access systems may treat frequent IP address changes as suspicious. Using a fixed IP address can prevent unnecessary login challenges or blocks.

What happens to my IP when I switch VPN servers?

When you change locations in your VPN app, your visible IP address changes to that server’s address. If you pick a server in another country, websites will treat that country as your connection point.

Users may switch servers to troubleshoot connectivity problems, avoid temporary IP address reputation problems (such as excessive CAPTCHA tests), or test how sites behave from different regional settings like language and currency.

Is a shared or dedicated IP better for privacy?

Shared IP addresses generally offer stronger privacy because multiple users appear to come from the same IP address. This blends your traffic with others and helps reduce direct attribution of activity to a single connection.

That said, ExpressVPN’s dedicated IP service is designed differently from typical dedicated IP setups. Although the address is unique to you, the assignment system is built so ExpressVPN has no way to link your identity to the dedicated IP you receive, preserving strong privacy protections while giving you the stability benefits of a dedicated address.

Can I be tracked with a VPN IP address?

A VPN masks your original public IP address from the sites you visit. That protection limits how easily your network activity can be linked to your physical connection.

However, a VPN does not make you untraceable. As mentioned earlier, sites and apps can still identify you through logins, browser data, or other identifiers that stay the same even when your IP address changes.

Changing or masking your IP address

There are several ways to change or hide the IP address that websites and services see. Each method works differently and offers a different level of privacy.

VPN

A VPN is one of the simplest and most reliable ways to mask your IP address. When you connect, the VPN replaces your visible public IP address with the IP address of the VPN server and encrypts your traffic on the way there. As a result, websites and apps see the server’s address instead of your own.

You can use a VPN on most devices, including Windows and Mac computers, iPhones, Android phones, tablets, and smart TVs. A VPN can also run on certain routers. When it’s installed on the router instead of a single device, every phone, laptop, console, or smart gadget connected to that router uses the VPN’s encrypted tunnel and shares the VPN server’s IP address automatically.

Once the app (or router setup) is complete, you log in and choose a server location. Your connection then appears to come from that server.

Other ways to change your IP address

If you don’t want to use a VPN, there are a few other ways to appear under a different IP address. These methods work differently and offer varying levels of privacy and convenience.

Mobile hotspot

Using your phone’s mobile data hotspot gives you the IP address assigned by your mobile carrier instead of the IP address from your home router. This changes your visible IP address, but it doesn’t add meaningful privacy. Your mobile carrier can still see which domains your device connects to and when you’re online, even though it can’t view the contents of encrypted (HTTPS) sites.

Public Wi-Fi

Connecting through public Wi-Fi replaces your device’s visible IP address with the IP address of that public network. This hides your home IP address from websites you visit, but the network operator can still see your traffic unless you use encrypted connections. Public Wi-Fi also comes with its own security risks, like potential snooping on unsecured connections.

The Tor network

Tor routes your traffic through multiple volunteer-run relays so that no single point sees both who you are and the destination you’re connecting to. Tor is useful for privacy, but it’s not ideal for activities like streaming, gaming, or everyday browsing because Tor can noticeably slow down your connection.