Guide

What is my IP address?

What is an IP address?

An IP address is the number that identifies your internet connection. Every website you visit sees it, because that's where the website sends its reply. Your internet provider gives you this public address — it belongs to your connection, not to your device.

IPv4 and IPv6

There are two kinds of IP address. IPv4 addresses look like 203.0.113.42. IPv6 addresses are longer, like 2001:db8::1. Many connections have both; this page shows the one your browser used to reach us.

How accurate is the location?

It's approximate. The location comes from your provider's network, so it usually shows the city where your provider's equipment is — sometimes a nearby city. An IP address can't reveal your street address or who you are.

Why does my IP address change?

Most home and mobile connections get a new address from time to time, for example when your router restarts or you switch between Wi-Fi and mobile data. A VPN or proxy shows websites its own address instead of yours.

Open the tool: My IP

IP WHOIS and ASN lookup

What an IP WHOIS lookup shows

Every public IP address and AS number is assigned through one of five regional internet registries: ARIN (North America), RIPE NCC (Europe, the Middle East and Central Asia), APNIC (Asia-Pacific), LACNIC (Latin America) and AFRINIC (Africa). The lookup shows their record: the network the address belongs to, the organization holding it and where to report abuse.

AS numbers

An autonomous system (AS) is a network that runs its own routing on the internet, such as an internet provider or a large company. Its number, for example AS15169, identifies it to other networks.

Reverse DNS

Many IP addresses have a name pointing back to them (a PTR record). Mail servers check it, and it often shows which provider or service uses the address.

Reporting abuse

If an address sends spam or attacks your systems, write to the abuse contact shown, with the times (including the time zone) and the relevant log lines.

Open the tool: IP WHOIS

WebRTC leak test

What WebRTC is

WebRTC lets browsers make video calls and share files directly with each other. To connect, a web page can ask your browser which addresses it can be reached on, without showing any permission prompt. The browser asks a STUN server, which simply replies with the public address the request came from.

Why it matters with a VPN

Some VPNs only route ordinary web traffic. The browser's STUN request can then leave over your normal connection and reveal the IP address the VPN is meant to hide.

How this test works

Your browser asks Cloudflare's STUN server for its public address, and the test compares the answer with the address our server sees. If they differ, WebRTC reveals a second address. Without a VPN, a difference usually just means one is your IPv4 address and the other your IPv6 address.

Browsers now hide your local network address (such as 192.168.1.20) behind a random name ending in .local. The test shows that too.

If WebRTC leaks your IP

• Turn on WebRTC or leak protection in your VPN app, if it has one.
• Firefox: set media.peerconnection.enabled to false on the about:config page. This also turns off video calls in the browser.
• Brave: in the privacy settings, set the WebRTC IP handling policy to disable non-proxied UDP.
• Chrome and Edge: install Google's WebRTC Network Limiter extension.

Open the tool: WebRTC leak test

Password leak check

Why check a password

Attackers try passwords from old data breaches on other sites, because many people reuse them. A password that has appeared in a breach is unsafe wherever you use it, even if it looks strong.

How your password stays private

Your password never leaves your browser. The browser turns it into a SHA-1 hash, a fixed-length fingerprint, and sends only the first 5 of its 40 characters to the Pwned Passwords service from Have I Been Pwned. The service answers with every leaked hash that starts with those 5 characters, mixed with fake entries, and your browser looks for a match itself. Neither we nor Have I Been Pwned learn your password or its full hash.

If your password was found

• Change it everywhere you use it, starting with your email and bank accounts.
• Use a different password for every site. A password manager makes this easy.
• Turn on two-step verification wherever you can.

If it wasn't found

It isn't in the known breach lists, but that alone doesn't make it strong. A long passphrase of several random words is both strong and easy to remember.

Open the tool: Password leak check

Reverse image search

What reverse image search does

A reverse image search looks for the same or similar pictures across the web. It helps you find where your own photos are used, spot fake profiles that use someone else's pictures, and check where a news photo first appeared.

Which service to use

• Google Lens has the largest index and also recognizes objects, places and text.
• Bing Visual Search is a good second opinion and shows visually similar images.
• TinEye finds exact copies, including cropped and resized ones, and can sort results by date, which helps find the original source.
• Yandex Images often finds results the others miss, especially on Eastern European sites.

Each service has its own index, so trying more than one finds more.

If someone uses your photo

• Report the profile or post on that platform. Most have a form for impersonation or for photos used without permission.
• Ask the site owner to remove it. If you took the photo yourself, you can usually send a copyright removal (DMCA) request.

What this page doesn't do

We don't offer face recognition that looks for a person's other photos or accounts: it can be used to track people and works with biometric data. This page only sends the image you choose to the search service you open.

Open the tool: Reverse image search

Disposable email

When to use it

Use a disposable address when a site wants an email address only to send a verification code or a download link, and you don't want to give out your own or get its newsletters.

When not to use it

• Accounts you want to keep: once the address is deleted, password-reset mail has nowhere to go.
• Banking, government services or anything with personal information.
• Sites that refuse disposable addresses. Use your own address there.

How it works

You get a random address. Mail sent to it appears here as plain text, with links written out; pictures, formatting and attachments are left out. The address works for 1 hour. You can keep it an hour longer at a time, up to 24 hours, or delete it at once. Then the address and every message in it are deleted.

The inbox opens only in the browser that created it, because a secret key stays in that browser. You can't send mail from the address.

What we record

A disposable address can be misused, so this tool keeps a log, unlike the other tools on this site. When you create, extend or delete an address we record your IP address, your browser (user agent) and the time; for every mail the address receives we record its sender, subject and time. The log is encrypted, only the site owner can open it, for example to answer a lawful request from the authorities, and each entry is deleted after 1 year. The messages themselves are still deleted with the address. No address is ever given to a second person.

Open the tool: Disposable email

WHOIS lookup

What a WHOIS lookup shows

Every domain name is registered through a company called a registrar, and the registry for its extension keeps the official record. A lookup shows that record: the registrar, when the domain was registered and when it expires, its status codes and its name servers.

Owner contact details are usually hidden. Privacy rules such as the GDPR mean most registries no longer publish them.

Expiry warnings

We highlight domains that expire soon: within 90 days in amber and within 30 days in red. When a domain isn't renewed, most registries give the owner a grace period before the name is released for anyone to register.

Common status codes

• clientTransferProhibited — the domain is locked against transfers to another registrar. This is normal and protects the owner.
• redemptionPeriod — the domain has expired and was deleted, but the owner can still restore it for a fee.
• pendingDelete — the domain is about to be released.

Which extensions work?

We use RDAP, the registries' official lookup service, and fall back to classic WHOIS for extensions that don't offer it yet. That covers .com, .net, .org, country extensions like .tr, .de and .uk, and hundreds of others. A few registries don't allow public lookups at all; we'll tell you when that happens.

Open the tool: WHOIS

DNS lookup

What DNS records do

DNS is the internet's address book. When you type a domain name, DNS records tell your device which server to connect to, where to deliver email and more. Changes can take a few minutes to several hours to reach everyone.

Record types

• A / AAAA — the IPv4 / IPv6 address of the website.
• CNAME — an alias that points this name at another name.
• MX — the mail servers that receive email for the domain.
• NS — the name servers in charge of the domain's records.
• TXT — text notes, often used to verify ownership and protect email (SPF, DKIM, DMARC).
• SOA — technical details about the domain's DNS zone.
• CAA — which certificate authorities may issue SSL certificates for the domain.
• SRV — where a service runs, for names like _sip._tcp.example.com.
• DS / DNSKEY — the keys behind DNSSEC, which protects answers from tampering.
• PTR — the name of an IP address (reverse DNS). Type an IP address to look it up.

We ask Cloudflare's public resolver (1.1.1.1), so you see the same answers most of the internet sees.

Open the tool: DNS

DNS propagation check

What propagation means

When you change a DNS record, resolvers around the world keep the old answer until its TTL (time to live) runs out. Until then, some visitors reach the old server and some the new one. This check asks resolvers in 20 countries at once, so you can see where the change has arrived.

Reading the map

• Green: the location got an answer. Compare the answers in the list: once they all show the new value, the change is everywhere.
• Red: no answer (the name doesn't exist there yet, or the lookup failed).

Large sites often answer with different addresses in different countries on purpose (geo-DNS), so different answers aren't always a problem.

The lookups run on the free Globalping network, like the traceroute tool; results there are public for up to six months.

Open the tool: DNS propagation

Is this domain available?

How the check works

Type a name without the extension and pick the groups of extensions to search. Your browser asks the DNS whether the name exists in each one; all of them take about half a minute. "Looks available" means the name isn't in the DNS. A few extensions answer for every name, so there the quick check shows "Unclear".

A name can be registered without being in the DNS, and some names are reserved or sold at a premium price. Press Verify to ask the registry itself; it also shows when a taken name expires. The final word comes from a registrar when you try to buy the name.

The groups of extensions

• Classic: .com, .net, .org, .info, .biz, .name and .pro.
• Country codes: one for each country and territory, such as .tr, .de and .uk.
• Local scripts: extensions in other alphabets, such as .рф, .中国 and .ελ.
• Sponsored: extensions run for a community, such as .gov, .edu, .museum and .travel.
• Cities and regions: .istanbul, .berlin, .london, .nyc, .tokyo and more.
• New generic: hundreds of newer words, such as .app, .shop and .online.
• Official second levels: government, military, police, university and school spaces under country codes, such as .gov.tr, .k12.tr, .ac.uk and .gouv.fr.
• Brands: extensions companies run for themselves, such as .google and .bmw. Nobody else can register under them.

The list follows the official IANA root zone, and the official second levels come from the Public Suffix List.

Tips for choosing a domain

• Keep it short and easy to say out loud. Numbers and hyphens get misheard.
• Check for existing businesses with a similar name before you buy.
• Look at the renewal price, not just the first-year offer.

Open the tool: Domain check

SSL certificate check

Where the data comes from

Every publicly trusted certificate must be published in Certificate Transparency logs. We read those logs through the free Cert Spotter service by SSLMate, so you see every currently valid certificate issued for a name, newest first. The newest one is usually the certificate the site serves; if the site hasn't installed it yet, it may still use an older one from the list.

Expiry warnings

Certificates now last a few months at most, so renewal has to be automatic. We mark certificates that expire within 30 days in red and within 90 days in amber. An expired certificate makes browsers show a full-page warning to every visitor.

Open the tool: SSL certificate

HTTP headers and redirects

Status codes

• 200: the page answered normally.
• 301 / 308: moved permanently. Search engines pass the old address's ranking to the new one.
• 302 / 307: moved temporarily.
• 403 / 404: forbidden / not found. 5xx: a server error.

Redirect chains

Every extra redirect costs the visitor time. Ideally an old address reaches the final page in one step, for example http://example.com straight to https://www.example.com.

Security headers

HSTS keeps browsers on HTTPS, Content-Security-Policy limits which scripts may run, X-Frame-Options or a CSP frame-ancestors rule stops others embedding your pages, and X-Content-Type-Options, Referrer-Policy and Permissions-Policy close smaller gaps.

The check runs from Cloudflare's network, so sites that block automated visitors may answer differently than they do to your browser.

Open the tool: HTTP headers

Email security check

Why these records matter

Anyone can put your domain in the From line of an email. SPF, DKIM and DMARC let receiving servers check that a message really comes from you. Without them, your mail is more likely to land in spam, and scammers can impersonate you more easily. Gmail and Yahoo require them from bulk senders.

• SPF lists the servers allowed to send mail for your domain. It ends with -all (reject the rest) or ~all (mark the rest as suspicious), and may use at most 10 DNS lookups.
• DKIM signs each message with a key; the public half sits in DNS under a "selector". We try common selectors; enter yours if it isn't found.
• DMARC tells receivers what to do when SPF and DKIM fail: p=none only reports, quarantine sends to spam, reject blocks. Start with none, read the reports, then tighten.
• MX records name the servers that receive your domain's mail.

Open the tool: Email security

Email header analyzer

What email headers show

Every server that handles an email adds a Received line to the top of its headers, so reading them from the bottom up shows the path the message took. The receiving server also records whether the sender passed the SPF, DKIM and DMARC checks.

How to copy the headers

• Gmail: open the email, choose "Show original" from the ⋮ menu, then "Copy to clipboard".
• Outlook on the web: in the ⋯ menu, choose View, then "View message source".
• Outlook for Windows: open the message, then File, Properties. The headers are in the "Internet headers" box.
• Apple Mail: View, Message, All Headers.
• Thunderbird: press Ctrl+U to open the message source.

Reading the result

• A DMARC pass means the sender's domain vouches for the message. If a message claiming to be from your bank fails DMARC, it's very likely fake.
• A Reply-To on a different domain sends your answer to someone other than the sender you see, a common phishing trick.
• A long delay between two servers usually means one of them was busy or retrying. It isn't a problem with the message itself.

The analysis runs in your browser. The headers you paste aren't sent anywhere.

Open the tool: Email header analyzer

Blacklist check

What a DNS blacklist is

Mail servers check every sender's IP address against blacklists (DNSBLs). A listing usually means spam was sent from that address, for example by an infected computer or a hacked website on the same network. Listed servers find their mail rejected or sent to spam.

If you're listed

• Find and fix the cause first: an infected device, an open relay, a hacked form or a compromised email account.
• Then ask for removal on the list's website. Most lists also drop an address on their own after a while without spam.
• On a home connection, your provider's addresses may be listed as "dynamic" ranges. That's normal and only matters if you run a mail server.

Spamhaus

Spamhaus, the most widely used list, doesn't answer lookups made through public DNS services, so it isn't in this check. Use Spamhaus's own checker.

Open the tool: Blacklist check

Internet speed test

What the numbers mean

• Download — how fast data reaches you: loading pages, streaming, downloads.
• Upload — how fast you send data: video calls, uploading photos and files.
• Ping — how long a tiny message takes to go there and back. Lower is better for calls and games.
• Jitter — how much the ping varies. A low, steady number means a smooth connection.

Where we measure to

The test exchanges data with the nearest Cloudflare data center, so it measures your connection to the wider internet. Results vary from moment to moment and server to server.

Getting an accurate result

Pause downloads and video on your network, and test close to your router or over a cable. Wi-Fi is usually slower than a wired connection.

Open the tool: Speed test

Ping and MTR

Ping

Ping sends a few small packets and times the replies. Running it from 13 countries at once shows how fast a server answers around the world, and whether it answers at all. Some servers block ping, so "no reply" doesn't always mean a site is down.

MTR

MTR combines traceroute and ping: it sends packets to every router on the path several times and shows the loss and delay at each hop. Loss that starts at one hop and continues to the end points to a real problem; loss at a single hop in the middle is usually just that router ignoring test packets.

Tests run on the free Globalping network; results there are public for up to six months.

Open the tool: Ping & MTR

Traceroute

What a traceroute shows

Data crosses many routers on its way to a website. A traceroute lists them in order, with how long each one took to answer, so you can see where a connection slows down or stops.

Where the trace starts

Browsers can't run a traceroute from your own computer, so the trace runs from a measurement point in the country you pick, using the free Globalping network. To trace from your own computer, run tracert example.com on Windows or traceroute example.com on macOS and Linux.

Reading the results

• Each line is one router (a "hop"). Times are in milliseconds.
• A hop with no reply is common: many routers don't answer traceroute requests but still pass traffic on.
• A sudden jump in time that stays high on the following hops shows where the delay starts.

Globalping keeps measurements public for up to six months, so don't trace addresses you want to keep private.

Open the tool: Traceroute

Open port checker

What a port is

An IP address identifies a connection; a port number identifies a service on it. A website answers on port 443, Windows Remote Desktop on 3389. Port numbers run from 1 to 65535.

Open or closed: what's safe?

Most home routers block incoming connections, so seeing every port closed is normal and safe. A port is open when your router forwards it to a device, for example for a game server, a camera or remote access. Keep open only what you need, and never expose services like Remote Desktop (3389), file sharing (445) or databases directly to the internet.

How the check works

Our server tries to connect to each port on your public IP address. It only ever checks your own address, and only TCP ports. On mobile data and some home connections your public IP is shared with other customers (carrier-grade NAT), and ports can't be opened at all.

Open the tool: Ports

Subnet calculator

What a subnet is

A subnet is a block of IP addresses. The prefix (for example /24) says how many of the 32 bits of an IPv4 address are fixed: a /24 holds 256 addresses, a /25 half as many, a /16 holds 65,536.

What each line means

• Network address: the first address. It names the subnet and isn't given to a device.
• Broadcast: the last address. A message sent to it reaches every device in the subnet.
• Usable range: the addresses you can give to devices, the router included.
• Mask and wildcard: the same prefix written two other ways; routers and firewalls ask for one or the other.

Splitting a network

Pick a longer prefix under "Split into" to see the smaller subnets a block divides into, for example a /24 into four /26 subnets of 64 addresses. For a whole office or several sites, the network planner does this for you.

Open the tool: Subnet calculator

MAC vendor lookup

What a MAC address is

Every network interface, such as Wi-Fi, Ethernet or Bluetooth, has a MAC address: six bytes usually written like 00:1A:2B:3C:4D:5E. It's only used inside your local network. Websites never see it.

How the vendor is found

Manufacturers buy blocks of addresses from the IEEE. The first six hex digits of the address (sometimes seven or nine) identify the block, and so the company that bought it. This tool looks the block up in a copy of the public IEEE registry.

Random (private) addresses

Phones and computers now often make up a different MAC address for each Wi-Fi network so they can't be tracked. These addresses have the "locally administered" bit set: the second hex digit is 2, 6, A or E. They don't belong to any vendor.

Where to find a MAC address

• Windows: run ipconfig /all in Command Prompt and look for "Physical Address".
• macOS and Linux: run ifconfig or ip link in Terminal.
• Other devices on your network: your router's list of connected devices, or arp -a.

Open the tool: MAC vendor lookup

Network planner

What the planner does

Describe your network and the planner works out the addresses: which address the router gets, which range the DHCP server hands out and which devices get fixed addresses. It draws the result as a diagram you can rearrange, download and share.

Basic or advanced?

• Basic is for a home or small office with one network.
• Advanced splits a larger address block into subnets of the right size for each department or VLAN (VLSM), connects several sites with small link networks and writes example Cisco and MikroTik configurations.

Good to know

• Internal networks use the private ranges 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.
• Every subnet loses two addresses (network and broadcast), and the gateway takes one more.
• Leave room to grow: plan for more devices than you have today.
• The configuration examples are a starting point. Check interface names and security settings before using them on real equipment.

The planner runs entirely in your browser; your plan isn't sent anywhere. A share link carries the plan inside the link itself.

Open the tool: Network planner