What is my IP address? Your IPv4, IPv6, location and connection fingerprint
What this page shows
Your public IP address is the address the rest of the internet sees when you connect, and most networks hand out two of them today: an IPv4 address and an IPv6 address. Both are captured here from the connection your browser opened, together with the location and network operator (ASN) an offline GeoIP database places them in.
The verdict weighs everything the connection revealed: the TCP fingerprint of your operating system, the TLS fingerprint of your browser, the distance implied by the round-trip time, your DNS resolver and the time zone of your device. A VPN, proxy or relay usually trips several of these checks at once; any single one has innocent explanations.
What is my public IP address?
It is the address your router presents to the internet, shown at the top of this page for IPv4 and, if your network has it, IPv6. Devices inside your home share the IPv4 address through NAT, while each device usually has a public IPv6 address of its own. Websites, games and mail servers all see this address, and it changes when your ISP reassigns it or you move to another network.
Why do I see two IP addresses?
Because the internet runs two address systems side by side. IPv4 addresses ran out years ago, so IPv6 was introduced with vastly more of them. A dual-stack connection has both, and your browser picks one for each site it opens. Both are shown here because they can belong to different networks and travel different paths.
Can a website see my location from my IP address?
Roughly. Geolocation databases record which address blocks are used in which region, which gives the country reliably and often the city, but never a street. Mobile networks and VPNs are commonly placed at the operator's hub, far from the actual user. This site also checks whether the measured round-trip time even allows the location the database claims.
What is a browser or TLS fingerprint?
The exact set and order of options your browser puts into its first TLS message, and the way it opens an HTTP/2 connection, are characteristic of the browser engine. Hashes of them, JA3 and JA4, identify the software without cookies and regardless of what the User-Agent string says. Bot detection relies on them, and so does this site's guess at your likely client.
How does the VPN and proxy check work?
There is no single test. The verdict compares independent signals: whether the address belongs to a hosting provider or a published relay range, whether the operating system implied by your TCP packets matches what the browser claims, whether the distance implied by the round trip fits the address's location, your device's time zone, and what WebRTC and your DNS resolver reveal. Each check is listed with the weight it carried.
Is anything stored?
The packet capture behind this page lives in memory for a few seconds and is keyed to your address. Geolocation uses an offline database on our own server, so your address is not sent to a third party, and the calculators run entirely in your browser.
Related terms: Public IP address, Autonomous System Number, IP geolocation, VPN and proxy detection
IP geolocation, ASN and dual-stack
IP geolocation maps an address to a country, region and city using a database of which networks are used where. It is a good guess, not a GPS fix: mobile and VPN addresses are often placed at the operator's hub, and the accuracy radius says how far off it may be. The ASN (autonomous system number) identifies the network that announces your address to the global routing table, usually your ISP or hosting provider.
When IPv4 and IPv6 are both available, the browser races them (Happy Eyeballs) and this view shows which one won, how their paths compare and, for IPv6, how the address was assigned: native or tunnelled, and whether the interface identifier is random or derived from a MAC address.
How accurate is IP geolocation?
The country is right almost always, the city often, the street never. Databases record which address blocks an operator uses where, and the accuracy radius shown next to the location says how far off that may be. Mobile carriers and VPN providers route many users through one hub, so their addresses land at the hub. This page also compares the round-trip time with the distance to the claimed location, which catches placements that are physically impossible.
Why does my IP address show a different city?
Because the database knows where your ISP uses the block, not where your router stands. Large ISPs hand out addresses from regional pools, carrier-grade NAT puts thousands of customers behind one address, and reassigned blocks take months to be updated. None of that is an error on your side.
What is an ASN and why does it matter?
An autonomous system number identifies the network that announces your address to the rest of the internet, usually your ISP, a mobile carrier or a hosting company. It tells websites what kind of network you are on: a residential ISP looks like a person, a hosting ASN looks like a server or a VPN exit, which is why it carries weight in the verdict on the overview.
Do I have IPv6?
If the IPv6 plate at the top shows an address, IPv6 works end to end: your browser opened a connection to our IPv6-only host and the packets arrived. The dual-stack card also shows which family your browser preferred for the main site, the Happy Eyeballs race, and how the two paths compare in round-trip time.
Is my IPv6 address derived from my MAC address?
The last 64 bits of an IPv6 address, the interface identifier, are either random (privacy extensions, the default on every current operating system) or built from the network card's MAC address in the older EUI-64 scheme, recognisable by ff:fe in the middle. This view names which one you have; a MAC-derived identifier follows the device from network to network.
Why do IPv4 and IPv6 show different locations?
The two addresses can belong to different networks: a tunnelled IPv6 address is placed at the tunnel broker, a mobile carrier may route the families through different hubs, and the two database entries are maintained separately. A large distance between them is worth a second look; a different city in the same region is common.
Related terms: IP geolocation, Autonomous System Number, BGP announced prefix, Happy Eyeballs, Interface identifier
DNS resolver
Detecting which resolver your network uses…
Probing our authoritative name server…
Which DNS resolver you really use
Every website visit starts with a DNS lookup, and the resolver that answers it sees every name you ask for. This view detects the resolver by making your browser look up a one-time name inside a zone we run ourselves, then reading which addresses asked our name server. A public resolver such as Google, Cloudflare or Quad9 answers from a pool of many addresses; an ISP resolver sits in your provider's network.
The checks go beyond a DNS leak test: whether the resolver validates DNSSEC signatures (it has to fetch our key to do so), randomises its source ports against cache poisoning, minimises the names it reveals to each server, sends part of your network as EDNS Client Subnet, and how it handles short TTLs and answers too large for UDP.
What is a DNS leak?
Your VPN carries the traffic, but your device still sends its DNS lookups to the resolver it had before, usually your ISP's. The ISP then sees every name you visit. This view lists the resolvers that asked our name server for your one-time name; if you are on a VPN and your ISP's resolver appears here, the lookups are leaking.
How does this page find my resolver without asking my browser?
The browser is told to fetch a unique name inside a zone whose authoritative name server we run. Nobody has that name cached, so your resolver has to ask our server, and our server records which address asked, over which transport, with which options. The address is the resolver's own, not yours, which is exactly what is being tested.
Why are several resolver addresses listed?
Large public resolvers such as Google, Cloudflare and Quad9 answer from pools of many servers, and a single lookup can fan out to several of them. Each egress address is shown with the network it belongs to. A single address in your ISP's network is the other common shape.
What does DNSSEC validation mean here?
A validating resolver checks signatures on the answers it receives. To do that it fetches our zone's key and sets the DO bit in its queries, both of which our server sees. One of the probe names carries a signature that cannot verify; a validating resolver refuses that answer, a non-validating one passes it on.
What is EDNS Client Subnet?
Some resolvers forward the first part of your address, typically a /24, to authoritative servers so that content networks can answer with a nearby server. It improves routing and gives up part of your address to every zone you query. The view shows whether your resolver sends it and how much of the address it reveals.
Does my resolver honour short TTLs?
One probe answer is valid for two seconds and the page asks for it again after that. A resolver that queries our server a second time honours the TTL; one that answers from its cache enforces a minimum of its own, which is common and only matters when records change quickly.
Related terms: Recursive resolver, DNS leak, DNSSEC validation, QNAME minimisation, Source port randomisation, EDNS Client Subnet
TLS and HTTP fingerprints: JA4, JA3, JA4H
Before any page is requested, your browser sends a TLS ClientHello listing the cipher suites, extensions, key shares and protocols it supports. The order and content of that list is characteristic of the software that produced it: JA3 hashes it, and JA4 encodes it in a readable form that stays stable while browsers shuffle extension order. Neither depends on the User-Agent string, which is why fingerprints are used to tell real browsers from bots and to spot a client claiming to be something it is not.
The HTTP layer adds a second fingerprint: the order of request headers (JA4H) and, over HTTP/2, the SETTINGS frame and priorities the client sent (the Akamai HTTP/2 fingerprint). The likely-client card compares all of them with what the User-Agent claims.
What is JA4?
JA4 is a TLS client fingerprint defined by FoxIO. It writes down the protocol, TLS version, whether a server name was sent, the number of cipher suites and extensions, and the ALPN, followed by hashes of the sorted cipher suites and extensions. Because the lists are sorted, browsers that shuffle their extension order still produce the same JA4.
What is the difference between JA3 and JA4?
JA3 is an MD5 hash over the cipher suites, extensions, curves and point formats in the order the client sent them. Chrome has randomised its extension order since 2023, so JA3 changes from connection to connection while JA4 stays stable. JA3 is still shown because many bot-detection systems and blocklists key on it.
Can I change my TLS fingerprint?
Not by changing the User-Agent string. The fingerprint comes from the TLS library inside the browser engine, so it changes only with a different browser, a major version that alters its cipher list, or tooling built to imitate a browser. That is what makes it useful for telling a real browser from a script claiming to be one.
What is the HTTP/2 fingerprint?
The first frames of an HTTP/2 connection are also characteristic: the SETTINGS the client announces, the initial window update, any priority frames, and the order of the pseudo-headers :method, :path, :authority and :scheme. The Akamai notation shown here combines them into one line that differs between Chrome, Firefox, Safari and most HTTP libraries.
What is JA4H?
JA4H fingerprints the HTTP request itself: the method, HTTP version, whether cookies and a referer were present, the number of headers, the preferred language, and hashes of the header names in order. It is independent of the TLS layer, so it catches a client that borrowed a browser's TLS stack but builds its requests differently.
Why does the likely client differ from my User-Agent?
Something between your browser and this server changed one of the two. A privacy extension or anti-detect browser rewrites the User-Agent, a corporate proxy or some VPN apps terminate TLS and open their own connection, and automation tools imitate one browser while running another. The verdict on the overview counts a contradiction as a signal, a plausible pairing as normal.
Related terms: TLS fingerprint, ClientHello, JA4, JA3, JA4H, HTTP/2 fingerprint, User-Agent
TCP fingerprint and passive OS detection
The first packet of a TCP connection, the SYN, carries choices the operating system makes on its own: initial TTL, window size, maximum segment size and the order of TCP options. Passive OS fingerprinting (p0f) matches these against known stacks, and JA4T writes them in a comparable form. Nothing is asked of the browser; the guess comes from the packet alone.
The live socket adds what the kernel knows about your connection: round-trip time, congestion window, MSS and path MTU, plus behaviour such as ECN, timestamps and window scaling. The handshake timeline shows each packet of the connection setup as it hit the network card, and the captured packets open as a hex dump.
What is passive OS fingerprinting?
Every operating system fills in the first TCP packet a little differently: the initial TTL, the window size, the maximum segment size, whether it uses window scaling, selective acknowledgements and timestamps, and in which order those options appear. p0f compares your SYN with a database of known stacks. The browser is never asked; the guess comes from the packet alone.
What is JA4T?
JA4T writes the TCP part of that fingerprint in a comparable form: window size, the option order, the maximum segment size and the window scale factor, separated by underscores. Two devices running the same operating system version normally share it, and a VPN or proxy that opens its own TCP connection replaces it with the relay's.
What does the initial TTL reveal?
Operating systems start their packets with a fixed time-to-live: 64 on Linux, macOS, iOS and Android, 128 on Windows, 255 on some network gear. Every router on the way subtracts one, so the value that arrives here gives both the likely family and the number of hops between your device and this server.
Why is the operating system guess wrong?
The SYN was not written by your device. A VPN or proxy terminates your connection and opens a new one from its own server, carrier-grade NAT and some firewalls rewrite TCP options, and a few middleboxes normalise packets deliberately. A guess that contradicts what the browser reports is one of the checks the overview's verdict weighs.
What is TCP_INFO?
The Linux kernel keeps statistics for every socket, and this page reads them for the connection your browser opened: round-trip time and its minimum, the congestion window, MSS and path MTU, retransmissions, the peer's receive window, delivery and pacing rate, and whether ECN marks were seen. They describe your actual connection, not a synthetic test.
What does the handshake timeline show?
Every packet of the connection setup as it reached the network card, with the time between them: SYN, SYN-ACK, ACK, the TLS ClientHello and the server's reply. The gaps are round trips on the wire, so the timeline shows where the time went before the first byte of the page, and whether your stack sends data early.
Related terms: Passive OS fingerprinting, TCP handshake, JA4T, Maximum segment size, Congestion window, TCP_INFO
NAT, path MTU, HTTP/3 and the route back
A NAT router rewrites the addresses and ports of your traffic, and how it maps them decides whether peer-to-peer connections, calls and games work behind it. STUN binding requests to two ports of our own responder reveal the mapping and filtering behaviour, the public address seen over UDP and the source port on the wire.
The path itself is probed too: the largest packet that reaches you (path MTU), whether IPv6 extension headers survive the trip, whether HTTP/3 over QUIC gets through, and a reverse traceroute from this server back to your address, hop by hop, with the operators along the way.
What NAT type do I have?
Your browser sends STUN requests to two ports of our responder, and the reply tells you which public address and port each one was seen from. If both use the same mapping, the NAT is endpoint-independent, the friendly kind for peer-to-peer connections, calls and games. If the port changes with the destination, the NAT is address- or port-dependent, and connections have to be relayed more often.
What is path MTU?
The largest packet that reaches you without being fragmented. Plain Ethernet allows 1500 bytes, PPPoE lines 1492, and VPNs and tunnels take more off. The probe sends packets of decreasing size and reports the largest that arrived, for the TCP connection and separately for UDP, where QUIC has to live within it.
Does HTTP/3 work on my connection?
HTTP/3 runs on QUIC over UDP port 443, and some networks block or throttle UDP entirely. The page tries an HTTP/3 request to our server; if it succeeds, the QUIC transport parameters your browser sent, its HTTP/3 settings and the round-trip time QUIC measured appear next to the TCP figures.
What is a reverse traceroute?
A traceroute run from this server back to your address, hop by hop, with the operator of each router. An ordinary traceroute stops at your router because it drops unsolicited probes; here the probes travel inside the TCP connection your browser already holds open, shaped like the keepalives every stack sends, so the router forwards them to your device. It runs only when you start it and is rate-limited.
Why do IPv6 extension headers matter?
IPv6 puts options such as fragmentation and routing information into extension headers between the IP header and the payload. A share of networks drop any packet that carries one, which silently breaks fragmentation and some protocols. The test sends packets with extension headers and reports which of them got through.
Does ECN survive my path?
Explicit Congestion Notification lets routers mark packets instead of dropping them when a queue fills. Some middleboxes clear the bits or drop marked packets, which forces endpoints to fall back. The view shows whether ECN was negotiated on the TCP connection and whether the marks survive the UDP path that QUIC uses.
Related terms: NAT, NAT mapping behaviour, STUN, Path MTU, IPv6 extension headers, HTTP/3, Traceroute
Browser & device
Reported by your browser via JavaScript.
Display & locale
Browser fingerprint and TLS policy
Browser fingerprinting combines what a browser reports about itself and its device: user agent, languages, platform, CPU cores, memory, screen size, colour depth, time zone, GPU and canvas rendering. Individually these are ordinary; together they are often unique enough to recognise a browser without cookies. This view shows the same values a tracker would collect.
The TLS policy test asks what your browser refuses rather than what it offers: a server that only speaks TLS 1.2, one that only accepts a post-quantum key exchange, and one that requires Encrypted Client Hello. A refused handshake is the answer. WebRTC and the Network Information API round out the picture.
What is browser fingerprinting?
Collecting attributes a browser hands out freely, such as the user agent, languages, platform, screen size, time zone, installed fonts, GPU and how it renders a canvas, and combining them into an identifier. Each value is shared by many people; the combination is often unique to one browser, which lets a site recognise you again without a cookie.
What is a canvas fingerprint?
A script draws text and shapes onto an invisible canvas element and hashes the resulting pixels. Small differences in GPU, driver, font rendering and anti-aliasing make the hash differ between machines, so it is one of the strongest single fingerprinting signals. The value shown here is the same one a tracker would compute.
Does WebRTC leak my IP address?
WebRTC gathers the addresses it could use for a call, and a page can read them. Depending on the browser and settings that can include your local network address and, behind some VPNs, the real public address rather than the VPN's. The view shows what WebRTC exposed and whether it matches the address this connection came from.
What does the TLS policy test check?
Three extra servers each accept only one thing: TLS 1.2 without 1.3, a post-quantum key exchange based on ML-KEM, or a connection that uses Encrypted Client Hello. Your browser either completes the handshake or refuses, and the refusal is the answer: it shows which policies your browser or its administrator has set beyond the defaults.
What are Client Hints?
A structured replacement for the details that used to live in the User-Agent string: platform version, CPU architecture, bitness, device model and the full browser version list. A browser sends them only when the server asks, which this page does. What arrived here is what any site that asks can see.
Can I make my browser less unique?
Browsers built for it, such as Tor Browser, make every user look alike, and Firefox's resist-fingerprinting setting rounds off the values that vary most. Blocking single signals in an ordinary browser usually has the opposite effect, since a missing canvas or an unusual screen size is itself rare. The verdict on the overview only uses the signals that indicate a relay, not the fingerprint as a whole.
Related terms: Browser fingerprint, Canvas fingerprint, WebGL renderer, Post-quantum key exchange, Encrypted Client Hello, WebRTC
Connection test
Measures latency, jitter and bufferbloat — and streams live kernel TCP stats off your socket. Transfers ~5 MB.
Latency, jitter and bufferbloat
Latency is the round trip between you and this server; jitter is how much it wobbles. Bufferbloat is the latency added while the connection is under load, when oversized queues in a router or modem fill up. It is what makes a video call stutter while something else downloads, and it is graded from A to F here.
The test streams live kernel TCP statistics from your own socket while it runs: congestion window, retransmissions and the receive window, plus how your stack acknowledges data and paces its uploads. It does not measure download speed; a few megabytes from a single server say nothing reliable about a fast line.
What is bufferbloat?
Latency that appears only when the line is busy. Routers and modems hold more packets in their queues than they can send in a reasonable time, so while one device downloads, everyone's packets wait behind the queue and a video call stutters. The grade compares the round trip under load with the idle one. The fix is smart queue management such as fq_codel or cake on the router.
What is a good latency?
It depends on distance. Under 20 ms is typical to a server in your own country over fibre or cable, 30 to 60 ms across a continent, above 100 ms across an ocean, and satellite links add much more. For calls and games the jitter matters as much as the average: a few milliseconds of variation is fine, tens of milliseconds are noticeable.
Why does this page not measure download speed?
A few megabytes from one server say nothing reliable about a fast line: the transfer ends before TCP has ramped up, and a single path can be slow while the line is fine. The test uses the download only to put the line under load; for a throughput figure use a test that opens several connections to servers near you.
How is the test run?
It measures the round trip while the connection is idle, then keeps measuring while a download loads the line, and reports how much the latency grew. While it runs, the kernel's statistics for your socket are streamed live, so you can watch the congestion window, retransmissions and receive window react.
What do retransmissions mean?
A packet was lost and sent again. A handful early in a transfer is normal, since TCP probes for the available bandwidth until something drops. Retransmissions that keep coming during the test point to loss on the path, a full queue, or a wireless link with interference.
What does the receive window show?
How much data your device tells the server it can accept before acknowledging. Throughput can never exceed the window divided by the round-trip time, so a small window on a long path caps the speed regardless of the line. Modern stacks scale the window automatically; the value shown is what yours advertised.
Related terms: Latency, Jitter, Bufferbloat, Receive window, Delayed acknowledgement, Pacing