Public vs Private IP Address: What's the Difference?

The Two-Tier IP Address System

The internet uses a two-tier addressing system: public IP addresses that are globally unique and routable across the internet, and private IP addresses that are used only within local networks and are never directly accessible from the internet.

This design emerged as a practical solution to IPv4 address exhaustion. With only ~4.3 billion possible IPv4 addresses and billions of connected devices worldwide, there simply aren't enough public IPs for every device. The solution: give each household or business one public IP, and let them use private addresses internally for as many devices as they need.

Your public IP is what websites see when you connect to them. You can check it right now using our IP address tool. Your private IP is what your router assigns to your laptop, phone, smart TV, and every other device on your local network — and these are invisible to the outside world.

Private IP Address Ranges (RFC 1918)

The Internet Engineering Task Force (IETF) reserved three IP address ranges specifically for private use in RFC 1918 (1996). These ranges are:

• 10.0.0.0 – 10.255.255.255 (10.0.0.0/8): The largest block — over 16 million addresses. Common in large enterprises and cloud platforms (AWS VPCs, for example, often use 10.x.x.x).
• 172.16.0.0 – 172.31.255.255 (172.16.0.0/12): Roughly 1 million addresses. Less common in home networks but used by some ISPs and corporate environments.
• 192.168.0.0 – 192.168.255.255 (192.168.0.0/16): About 65,000 addresses. The most familiar range — virtually every home router defaults to assigning addresses like 192.168.0.x or 192.168.1.x.

These addresses are non-routable on the public internet. If a router receives a packet destined for 192.168.1.5, it knows this is a local address and will not forward it to the internet. This provides a natural security boundary.

See our IP address classes guide for more on how address ranges are structured and classified.

How NAT Bridges Public and Private Addresses

So how do devices with private IP addresses access the public internet? The answer is NAT — Network Address Translation. Your router performs NAT automatically, acting as the gateway between your private network and the internet.

Here's how it works step by step:

1. Your laptop (private IP: 192.168.1.5) sends a request to load example.com
2. Your router receives the request and replaces the source IP 192.168.1.5 with your public IP (e.g., 203.0.113.47)
3. The router records this translation in its NAT table
4. The request goes out to the internet with your public IP as the source
5. The server responds to 203.0.113.47
6. Your router receives the response, checks its NAT table, and forwards the data to 192.168.1.5

This process is seamless and happens thousands of times per second on a busy home network. Read our full explanation in the NAT guide.

Security Implications: Public vs Private

The distinction between public and private IPs has major security implications:

Private IPs are not directly reachable from the internet. This provides a free layer of security by default. A malicious actor on the internet cannot directly connect to your laptop's private IP 192.168.1.5 — they can only reach your router's public IP. Your router's firewall and NAT effectively shield your internal devices.

Public IPs can be scanned and probed. Your router's public IP is visible and can be targeted by port scanners and attack tools. Use our port checker to see which ports are open on your public IP and exposed to the internet.

Services that need to be publicly accessible (like a home web server) require special configuration — either port forwarding (mapping a public port to a private IP:port) or a reverse proxy. This intentionally punches a hole through the NAT security layer.

To verify what your public IP exposes, run a DNS leak test and check your open ports regularly — especially after changing router configurations.

IPv6 and the Future of Private Addressing

IPv6 changes the private vs public IP equation significantly. With 340 undecillion available addresses, IPv6 was designed so that every device could have a globally unique public address — eliminating the need for NAT in theory.

In practice, IPv6 still uses address ranges that behave like private addresses:

• Link-Local addresses (fe80::/10): Auto-configured on every IPv6 interface, usable only within the local link (not routed)
• Unique Local Addresses (ULA) (fc00::/7): Similar to RFC 1918 private ranges — used within an organization but not globally routed
• Global Unicast Addresses (the rest): Globally routable, typically assigned by ISPs from their allocated blocks

Many ISPs now provide both an IPv4 public address and an IPv6 prefix to home customers in a "dual-stack" configuration. If your ISP supports IPv6, your devices may be getting globally routable IPv6 addresses without any NAT at all — which has its own security implications worth understanding.

Frequently Asked Questions