Your IP address is the return address on every request your device makes. A website cannot send you a page without one, which is why every site you have ever visited has had it, and why no setting exists to simply switch it off.
Our IP lookup will show you yours. The more useful question, and the one this page answers, is what it actually discloses — because the popular answers run in both wrong directions at once.
What it reveals
An IP address identifies a connection, not a person, but it reliably reveals three things.
Roughly where you are. Country, almost always. City, often, and often wrong by some distance — geolocation databases map addresses to wherever the block was registered, which can be a different city or an entire country away from you.
Who your provider is. The network operator is a matter of public record. On a home connection that names your ISP; on a corporate network it can name your employer, which is a good deal more identifying than most people expect.
That it is the same you as last time. This is the part that matters for tracking. A single visit tells a site very little. The same address returning across weeks lets a site link those visits together without a cookie, without consent, and without anything you can clear.
What it does not reveal
An IP address is not your name or your street address. It will not give a website your postal address, and a residential IP usually cannot be resolved to a specific household by anyone outside the ISP without a legal order.
It also moves. Most home connections get a dynamic address that changes periodically, and mobile connections change constantly. That is why "my IP is exposed" is a weaker statement than it sounds — and also why "my IP changed, so I am anonymous" is weaker still.
Who is accountable for it, and for what
Under the PDPA in Singapore and the GDPR in the EU, an IP address is treated as personal data when it can be combined with other information to single out an individual. That is the operative test, and it is not a technical one. The same address that is anonymous in a server log becomes personal data the moment it sits next to an account, an order, or a session that identifies someone.
For anyone running a site, this means "we only store IP addresses" is not a defence. It is a processing activity, and it needs a lawful basis, a retention period, and an answer to the question of who can read it. A regulator does not ask whether you thought the field was harmless.
What this site keeps, since we are asking you to trust one
It is easy to write that paragraph and awkward to be measured against it, so here are our own records, counted rather than described.
Our analytics table held 325,309 page views when this was written, spanning 65 days from June to August 2026, across 190 countries. Of those rows, the number storing a raw IP address is 0.
Instead, we store a SHA-256 hash of the address combined with a server-side secret. This fixed 64-character string cannot be reversed into an address without that secret. It is enough to count returning visitors and useless for identifying one. Across the whole table there were 6,000 distinct hashes, and 1,730 rows flagged as bots rather than silently discarded.
The browser and operating system are recorded, but the string they came from is not. Our middleware reads your user agent, classifies it into coarse labels, and throws the original away; the raw string appears in 0 of the 325,309 rows. A full user agent is close to a fingerprint; "Safari" and "macOS" are not.
The whole table is deleted at 90 days by a scheduled job. Not archived somewhere colder — deleted.
None of that makes us special, and it is not offered as a boast. It is offered because a page telling you what your IP address discloses should be willing to say what it does with yours.
If you want to show less
A VPN or a proxy replaces the address a site sees with one belonging to the provider. This changes what a site can infer about your location and network, but it only moves the disclosure — the provider now sees what the site used to. The question becomes which of the two you would rather trust, which is a judgement about the operator and not about the technology.
Encrypted DNS is a separate and smaller matter often confused with this one: it hides which sites you look up from your network, not your address from the sites themselves. Our guide on DNS over HTTPS and DNS over TLS covers where that boundary actually sits.
And nothing here is affected by private browsing, which clears what your own device stores and changes nothing about what leaves it.
An IP address is not an identity, and it is not nothing. It reveals your country reliably, your provider exactly, and — the part that matters — that today's visitor is the same one as last month. Under PDPA and GDPR it becomes personal data the moment it can be combined with anything that singles you out, which means the site holding it owes you a lawful basis and a retention period, not a shrug. If you want a site to see less, a VPN moves the disclosure to the VPN operator rather than removing it. Ask which of the two you would rather be trusting.
Looking at your own
Our IP lookup shows the address a site sees when you connect, along with the country and network it maps to — which is a good way to check how wrong the city guess is for you. If you are trying to work out which addresses belong to your own network rather than the public internet, the subnet calculator does that arithmetic, and the user agent parser shows what the other half of a request discloses about your browser and device.
- The figures about this site are aggregate counts run against our own analytics table on 9 August 2026, alongside a reading of the middleware that writes it. No individual visitor record was read or reported — every number is a count over the whole table.
- ⚠️ The first run of those queries reused a single query builder, so each filter silently carried into the counts that followed. It produced a correct-looking "0 stored user agents" for entirely the wrong reason. The numbers here are from a re-run with a fresh query per figure, which is also why the method is described rather than just the result.
- The claim that an IP address is personal data "when combined with other information" is the operative test in both Singapore's PDPA and the GDPR, and it is deliberately worded as a test rather than a classification: the same value can be personal data in one system and not in another.
- ⚠️ Geolocation accuracy is not something we measured. City-level mapping is widely known to be unreliable, and the honest statement is that it is often wrong by a large distance rather than any specific error figure we could stand behind.
This describes what an IP address discloses in ordinary web browsing. It is not legal advice, and whether a particular processing activity is lawful depends on facts this page cannot know.
View author profile → · Editorial policy
