How to Use This Tool
Paste one address or a list. Each is classified, with what the classification means in practice rather than just its name.
The three private ranges
RFC 1918 reserves three blocks that will never be routed on the public internet:
10.0.0.0/8— 16.7 million addresses. Used by anything large.172.16.0.0/12— a million addresses, and note it runs to 172.31, not 172.16 only. This catches people writing firewall rules.192.168.0.0/16— 65,536 addresses, the home router default.
The one that surprises people: 100.64.0.0/10
This is carrier-grade NAT space, and it is neither private nor public. Your ISP uses it to give customers addresses when it does not have enough public ones, which means your traffic is translated twice — once by your router and again by theirs.
The practical consequences are worth knowing before you spend an evening on them:
- Port forwarding does nothing. Your rule works on your own router, and inbound connections never reach it, because they stop at the ISP's NAT which has no rule for you.
- Hosting anything from home is not possible without a relay, a VPN with a public endpoint, or a tunnelling service.
- Some peer-to-peer and gaming connections degrade, because hole punching through two layers of NAT is much less reliable than through one.
If your router's WAN address is in this range, that is the explanation. Most ISPs will move you to a public address on request, sometimes for a fee.
The others worth recognising
- 169.254.0.0/16 — link-local. A machine assigns itself one of these when DHCP does not answer. It is a symptom: check the cable, the switch port, or whether the DHCP pool is exhausted.
- 127.0.0.0/8 — loopback, and it is the entire /8. 127.1.2.3 is also your own machine, which occasionally surprises people writing validation.
- 224.0.0.0/4 — multicast. Not a host address, so finding one where a host should be means something is misconfigured.
- 240.0.0.0/4 — reserved since 1981 and still reserved. Proposals to release it resurface periodically and none has succeeded, largely because too much equipment rejects it outright.
Private does not mean secure
A private address is not routable from the internet, which is a routing property rather than a security one. Anything already inside your network reaches it freely, and a compromised device, a guest laptop or a phone on the same Wi-Fi is inside.
Treating "it is on a private IP" as protection is how internal services end up with no authentication at all — and then someone connects a VPN, or a container network bridges two segments, and the assumption quietly stops holding.
