Network

IP address basics

Learn what IP addresses can reveal, why hiding an IP is not enough for anonymity, and how IP relates to logs, cookies, accounts, and time.

An IP address is important information for finding the other side of a communication on the internet.

However, it is dangerous to judge anonymity from an IP address alone. An IP address is a strong clue, but it is only one part of anonymity. Cookies, login state, browser information, post content, time, and past accounts must also be checked at the same time.

This article explains the basics of IP addresses and why they matter for anonymity. A more introductory explanation of how IP addresses work is also covered in "What is an IP address?"

What is an IP address?

An IP address is information like an address used for IP communication.

When devices and servers communicate, a source IP address and destination IP address are used. Packets move across the network toward the destination IP address.

Information	Meaning	Anonymity caution
Source IP address	The side sending the communication	Can become a clue to the network it came from
Destination IP address	The side receiving the communication	Shows which server the communication is going to
Public IP	An IP used on the internet	Easy for websites to see
Private IP	An IP used inside a home or organization	Not always directly visible to external sites
NAT	Matches internal and external communication	The IP shown on the device and the IP visible from outside differ

The IP address shown on a device and the IP address visible to a website are not always the same.

At home or at work, multiple devices may share the same external IP through NAT.

What can be learned from an IP address?

An IP address does not always reveal a personal name or exact address.

However, it can provide material for inferring the ISP, region, organization, and type of source connection. Access from a company or school network may become a clue to affiliation.

Information inferred	Explanation	Caution
ISP	Which connection is being used	Separate from subscriber information
Rough region	State, province, prefecture, or metropolitan area	Not always accurate
Organization	Company, school, public institution	Can be a strong clue on fixed lines
VPN use	IP of the VPN server	The VPN provider may be visible
Tor use	Tor exit node	To the destination, it appears as a Tor exit

An IP address may not directly indicate an individual by itself.

Even so, when it combines with access time, cookies, login state, and post content, it becomes a strong clue.

Hiding the IP does not necessarily mean anonymity

When you use a VPN or Tor, the IP address visible to the destination changes.

However, even if you change the IP, logging in to the same account connects the activity to you. If the same cookie is sent, you are treated as the same browser. If you write about your workplace or routine places in post content, it can be inferred from there.

Clues other than IP	Why they remain	Example
Cookie	The browser sends stored information	A repeat visit is identified
Login state	The service processes activity in connection with an account	Logging in to a real-name social account
Post content	You publish it yourself	Writing about a region or workplace
Browser characteristics	Device and settings are visible	Fingerprinting
Posting time	Behavior patterns appear	Posting right after being at the site

IP addresses are important.

However, anonymity is not determined by IP addresses alone.

Websites and ISPs see different things

The meaning of an IP address changes depending on who is looking at it.

A website may keep the IP address visible as the access source in its logs. An ISP manages which IP was assigned to which subscriber line. A home router matches internal private IPs with external communication.

Who is looking	IP visible	Meaning for anonymity
Device	Private IP	Address inside the home or workplace
Router	Internal and external IPs	Matches communication through NAT
Website	External IP	Recorded as the access source
ISP	Subscriber line and assigned IP	Related to time and subscriber information
Destination when using a VPN	VPN server IP	The home IP is less directly visible

The meaning of an IP address changes depending on who sees it.

For anonymity, think separately about the website, ISP, VPN provider, and home router.

Cautions when checking

The IP address shown on an IP check site is the IP as seen from an external site.

It may differ from the private IP shown in the device's network settings. Also, when you use a VPN or Tor, the displayed IP belongs to the relay destination.

Where to check	What you learn	Caution
Device settings	Inside IP	Not necessarily the IP visible to websites
Router admin screen	External IP	With CGNAT, it may differ from the website side
IP check site	IP visible from outside	Cookies and login state are separate issues
VPN app	Destination server	Also check actual DNS and leaks
Tor Browser	Tor exit IP	Communication from apps outside Tor is separate

IP addresses and logs

IP addresses gain meaning together with access logs.

On the website side, source IP, time, URL, User-Agent, and cookies may remain. On the ISP side, records may remain of which IP was assigned to which subscriber line at a given time.

Log	Relationship to IP	Caution
Web access log	Which IP accessed the site	Connects with cookies and URLs
Authentication log	Source of login attempts	Connects with accounts
ISP record	Assigned IP and time	Not something ordinary users can freely see
VPN log	Depends on the VPN provider's policy	The trust model is important
Internal organization log	Workplace or school communication	Connects with affiliation

An IP address becomes more meaningful when handled together with time.

When it takes the form not only of "there was access from this IP," but "this account was logged in to from this IP at this time," it becomes easier to compare with other records.

For anonymity, look at time, accounts, and cookies at the same time as IP.

Checking the IP address is the starting point for an anonymity check.

However, do not stop there. Also check the cookies sent at the same timing, login state, User-Agent, and post content. If you feel reassured by looking only at the IP, you miss other correlations.

IP is the entrance, not the conclusion.

For anonymity, after checking the IP, also check cookies, login state, post content, and time.

Summary

An IP address is information used to find the other side of a communication on the network.

Understanding the differences between source IP address, destination IP address, public IP, private IP, and NAT helps explain why the IP shown on a device can differ from the IP visible to a website.

For anonymity, an IP address becomes a strong clue.

However, hiding an IP does not make you anonymous. Cookies, login state, post content, browser characteristics, time, and past information also remain.

An IP address matters, but it should be treated as one part of anonymity as a whole.

Related tools

Public IP Check

WhatIsMyIP

An external resource related to this article. Open it only when it fits your situation and threat model.