IPv4 vs IPv6: the differences that matter

IPv4 and IPv6 are 2 versions of the same thing: the addressing scheme that moves packets across the internet. They coexist on most connections, your browser switches between them without telling you, and the difference is invisible until something relies on it. The 2 cases where it matters most are running a server and hiding your real address behind a VPN or proxy, and the second one is where people get caught out.

The short version

	IPv4	IPv6
Introduced	1981	1998 (standardized as RFC 2460, updated by RFC 8200)
Address size	32 bits	128 bits
Written as	4 decimal numbers: 203.0.113.17	8 hexadecimal groups, zeros compressed: 2001:db8::1
Usable addresses	About 4.3 billion	About 340 undecillion
Address sharing	Needed; NAT is everywhere	Not needed; every device can have a public address
Configuration	DHCP or manual	Automatic (SLAAC), DHCPv6 or manual
Header	Variable length with checksum	Fixed 40-byte header, no checksum, extension headers
Broadcast	Yes	No; multicast and anycast instead
Security	IPsec optional	IPsec defined as part of the standard, still optional in practice
Typical home allocation	1 address	A /64 or /56 prefix, trillions of addresses

Why both exist

IPv4 was designed for a research network and its 4.3 billion addresses looked unlimited. By the early 1990s it was clear they would run out, and IPv6 was designed with an address space so large that exhaustion is not a practical concern. The global pool of fresh IPv4 blocks was emptied in 2011, and the regional registries followed over the rest of that decade. Today an IPv4 address is a scarce asset that gets bought, leased and shared.

IPv6 did not replace IPv4 because the 2 are not compatible: an IPv6-only device cannot reach an IPv4-only server without a translator in between. So the internet runs both, side by side, and every site that wants to be reachable by everyone keeps an IPv4 address. Adoption grew mainly where IPv4 scarcity hurt most, which is mobile networks and large consumer providers. Many of them are now IPv6-first internally and reach the IPv4 internet through translation gateways.

For you, as a user, "both exist" means your connection may be one of 3 things:

• IPv4 only. Common on older home routers, corporate networks and many VPNs.
• Dual-stack. One address of each kind. The browser prefers IPv6 when the site supports it and falls back within milliseconds if it does not.
• IPv6 with translated IPv4. Typical for mobile carriers. You still see an IPv4 address on websites, but it belongs to the carrier's translation gateway and is shared.

The differences that change how things work

NAT disappears

Because IPv4 addresses are scarce, almost every home and mobile connection sits behind NAT: devices get private addresses and the router rewrites them into 1 public one. IPv6 gives every device its own public address, so there is nothing to translate. Peer-to-peer connections, home servers and remote access become simpler. The flip side is that your firewall, not NAT, is the only thing stopping inbound connections, which is why routers block incoming IPv6 by default.

Addresses are structured differently

An IPv4 home connection gets a single address. An IPv6 home connection gets a prefix, usually a /64 or /56, and the devices inside generate their own addresses within it. The last 64 bits are chosen by the device, either from its hardware address or, on modern systems, at random and rotated daily (privacy extensions, RFC 8981). The prefix identifies your connection the way an IPv4 address does; the device part does not stay constant. The subnet calculator shows how large any prefix is and what range it covers.

The protocol is leaner

IPv6 removed the header checksum, fixed the header length and moved rarely used options into extension headers, so routers can forward packets with less work. Fragmentation is done only by the sender. None of this makes IPv6 noticeably faster on a good connection, but on networks where IPv4 passes through carrier-grade NAT, IPv6 traffic skips the translation step and can have slightly lower latency.

Geolocation is coarser

IPv6 blocks are allocated in enormous pieces and providers reassign them internally less often than IPv4 ranges, so city-level location data for IPv6 is generally less precise than for IPv4. Country is still reliable.

How to tell which one you are using

The quickest check is the IPv6 test: it reports whether your browser reached the page over IPv4 or IPv6 and then contacts an IPv6-only host to find out whether you have a working IPv6 route at all. Both addresses are shown so you can compare their locations.

On the device itself:

• Windows: open Settings > Network & internet > Wi-Fi or Ethernet, click the connection and look for an IPv6 address that does not start with fe80. In a terminal, ipconfig lists both "IPv6 Address" and "Link-local IPv6 Address"; only the first one is global.
• macOS: System Settings > Network > your connection > Details… > TCP/IP. "Configure IPv6" shows the mode and the global address appears below it.
• Linux: ip -6 addr show lists addresses; the global one has scope "global", the fe80 one has scope "link".
• iPhone and Android: the Wi-Fi details screen lists IPv6 addresses under the IPv4 one when the network provides them.

An address beginning with fe80 is link-local: every IPv6 device has one, it only works on the local network and it does not mean you have IPv6 internet access. An address beginning with 2 or 3 is global and routable.

Which one your browser picks

When a site has both kinds of address, browsers use the "happy eyeballs" procedure: start a connection over IPv6, start one over IPv4 a fraction of a second later, keep whichever answers first and drop the other. In practice this means IPv6 wins whenever it works, which is why a dual-stack site sees your IPv6 address even if you never think about it. A site that only has IPv4 sees only your IPv4 address, and a site that only has IPv6 is unreachable from an IPv4-only connection.

What "IPv6 leak" means for VPN and proxy users

This is the part that catches people out. A VPN or proxy only hides the traffic it carries. If your connection is dual-stack and the tunnel carries IPv4 only, your IPv6 traffic still goes out the normal way, through your real provider, with your real address on it. A website that has an IPv6 address will therefore see your real network, while a website that is IPv4-only sees the tunnel. From your side everything looks fine, because the "what is my IP" page you tested with may have been one of the IPv4-only ones.

The 3 common ways this happens:

Setup	What goes through the tunnel	What leaks
VPN app with no IPv6 support	IPv4 only	All IPv6 traffic, including DNS over IPv6
HTTP or SOCKS proxy in the browser	Connections the browser sends to the proxy	Anything the browser resolves to an IPv6 address and connects to directly, plus WebRTC over IPv6
VPN that assigns an IPv6 address but the local firewall or route table is wrong	Most traffic	Specific destinations that match a more specific local route

The effect on a strict website is a contradiction: the IPv4 address says one country and the IPv6 address says another, or the IPv6 address belongs to a home provider while the IPv4 address belongs to a datacenter. The glossary entry on IPv6 leak covers the detection side; the combined IP leak test shows the IPv4, IPv6, WebRTC and DNS results next to each other so the contradiction is visible at a glance.

Fixing an IPv6 leak

Pick the first option that applies to you.

1. Use a tunnel that handles IPv6. The clean fix. A VPN that either assigns you an IPv6 address inside the tunnel or deliberately blocks all IPv6 while connected leaves nothing to leak. Check the client's settings for an IPv6 option and turn it on, then re-run the test.
2. Disable IPv6 on the operating system while you use an IPv4-only tunnel or proxy:
   • Windows: Settings > Network & internet > Advanced network settings > More network adapter options, right-click the adapter, Properties, untick "Internet Protocol Version 6 (TCP/IPv6)".
   • macOS: System Settings > Network > your connection > Details… > TCP/IP, set "Configure IPv6" to "Link-local only".
   • Linux: sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1 for the current session; add the same line to /etc/sysctl.d/ to make it permanent.
   • Phones: there is no user-facing switch on iOS or stock Android. Use a VPN app that tunnels IPv6, or a mobile profile that does.
3. In antidetect or multi-profile browsers, set the profile's IPv6 behavior to disabled or to the proxy's address, if the browser offers that option, and run the test again from inside the profile.

Disabling IPv6 has a cost: some carriers and sites are IPv6-first and will be slower or unreachable through the translation path, and a device with IPv6 off is slightly unusual, which itself is a small fingerprint signal. Prefer option 1 whenever the tunnel supports it.

Which one should you care about?

For browsing, neither. Dual-stack just works, and the only visible effect is that the address a site records depends on whether that site supports IPv6. For hosting, run both so that everyone can reach you. For privacy and multi-account work, treat IPv6 as a second front door: whatever you do to hide your IPv4 address has to be done for IPv6 too, or turned off, and the only way to know which is to test from a dual-stack page.