🌐Validators

IP Validator (v4 and v6)

Validate IPv4 and IPv6 addresses with auto-detection. Shows class (A/B/C/D/E), private vs public, loopback, multicast and canonical format. Everything in your browser.

—

IP address validation: IPv4, IPv6 and why it matters

An IP address is the numerical label assigned to every device that talks on a network. Two formats coexist on the modern Internet: IPv4, the 32-bit format introduced in 1981 (RFC 791), and IPv6, the 128-bit successor standardised in 1998 (RFC 2460, updated by RFC 8200). Validating an address means confirming it is syntactically well-formed before using it in firewall rules, allowlists, geolocation lookups, log parsers or security audits.

Validation is not the same as reachability or ownership. A string can be a perfectly valid IP and still belong to a private range, a reserved block or a non-existent host. A robust application combines syntax validation with semantic checks (is it routable? is it on my allowlist? is it inside a CIDR block?).

IPv4 anatomy

IPv4 uses four octets separated by dots. Each octet is a decimal number from 0 to 255, occupying 8 bits — a total of 32 bits, giving roughly 4.29 billion theoretical addresses. The 2011 IANA pool exhaustion forced the regional registries (RIRs) to gradually allocate the last blocks, and IPv4 transfers became a paid market.

A naive regex such as ^(\d{1,3}\.){3}\d{1,3}$ catches the shape but accepts 999.999.999.999. A proper validator also confirms each octet is in 0-255. Be aware of unusual representations: leading zeros (192.168.001.001) can be interpreted as octal by libc; hexadecimal and shorthand notation (0xC0.0xA8.1.1 or 192.168.257) are accepted by inet_aton but rejected by stricter parsers — historically a source of SSRF bypasses.

IPv6 anatomy and shorthand

IPv6 uses eight groups of four hexadecimal digits (0000-FFFF) separated by colons, 128 bits total — 2^128 addresses, about 340 undecillion. Two compression rules are allowed: leading zeros inside a group may be omitted (2001:db8:0:0:0:0:0:1 -> 2001:db8:0:0:0:0:0:1), and one run of consecutive all-zero groups may be replaced by a double colon :: (so the example becomes 2001:db8::1). The :: can appear only once per address to keep parsing unambiguous.

A complete IPv6 regex is notoriously hard to write because of the compression rules; in production prefer a library. In Node.js use net.isIP(addr) which returns 0 for invalid, 4 for IPv4 and 6 for IPv6. Other handy libraries are ip-regex, is-ip, ipaddr.js and the Python ipaddress stdlib module.

Reserved and special ranges

Knowing the reserved blocks is essential to avoid SSRF, to write meaningful firewall rules and to interpret logs:

Private (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
CGNAT (RFC 6598): 100.64.0.0/10 — used by carriers between subscriber and public Internet.
Loopback: 127.0.0.0/8 (IPv4) and ::1/128 (IPv6).
Link-local: 169.254.0.0/16 (IPv4 APIPA) and fe80::/10 (IPv6).
Multicast: 224.0.0.0/4 (IPv4) and ff00::/8 (IPv6).
Broadcast: 255.255.255.255 (no equivalent in IPv6 — replaced by multicast).
Documentation: 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, 2001:db8::/32.

CIDR, dual-stack and tooling

CIDR (Classless Inter-Domain Routing) notation appends a slash and prefix length to express a block: 192.168.1.0/24 covers 256 addresses, 2001:db8::/32 covers an enormous IPv6 block. Most modern networks run dual-stack, exposing both an IPv4 and an IPv6 address on the same interface. Useful tools: ipinfo.io and ipapi.co for geolocation, whois and rdap.org for ownership, nslookup / dig for DNS lookups, Wireshark for packet inspection.

FAQ

Are IPv4 and IPv6 the same family?

No. They are distinct address families with different sizes, syntax and routing semantics. A device on a dual-stack network has one of each and they are not interchangeable in firewall rules or allowlists.

Is CIDR notation accepted as a valid IP?

CIDR (192.168.1.0/24) is a block, not a single host. A strict IP validator rejects it; a CIDR-aware validator accepts the form and exposes the network address and prefix separately.

Is `0.0.0.0` a valid IP?

Syntactically yes. Semantically it is a wildcard meaning "all interfaces" when binding a server and "no specific destination" when used as a source — most validators accept it, most allowlists do not.

Why should I reject private IPs server-side?

If your backend fetches user-supplied URLs (webhooks, image proxies, link previews), allowing private IPs lets an attacker target your internal services — the classic SSRF vector. Always validate, resolve and re-check the resolved address against the reserved-range list.

Validate IPv4 and IPv6 addresses

An IP address in the wrong format brings down a network setting, a firewall rule or a server entry. This validator checks whether the address is valid, works out on its own whether it's IPv4 or IPv6, and reveals several of its properties on top of that.

For IPv4, it points out the class (A, B, C, D or E), whether the address is private or public, loopback or multicast, and shows the canonical format as well. It's the kind of information that helps you understand an address's role in a network (whether it's internal, reserved or routable on the internet) without having to consult any tables.

Validation runs entirely in the browser, with nothing going out. It serves as a practical reference for network administrators, developers and anyone studying networking.

Frequently asked questions

What does the class A, B or C in the result mean?

That is the pre-CIDR classification, worked out from the first octet alone: up to 127 is class A, 128 to 191 is B, 192 to 223 is C, 224 to 239 is multicast (D) and whatever is left counts as reserved (E). Modern routing dropped the scheme long ago, since network size comes from the CIDR prefix, but the naming survives in certification exams, teaching material and old gear — hence its place in the result.

Why is 100.64.0.1 flagged as public?

Because the private label only covers the three RFC 1918 ranges: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. The 100.64.0.0/10 block that carriers use for CGNAT between subscriber and internet falls outside that check and comes out labelled public, even though it never routes on the open internet. Documentation blocks such as 192.0.2.0/24 behave the same way, and so does 0.0.0.0. If a firewall rule depends on this, fill the list in by hand.

Does the tool look up who owns the IP or where it is?

No. The check covers format and range, runs entirely in the browser and makes no outside request: no WHOIS, no RDAP, no geolocation database. Typing an address here fires no ping and tests nothing about the host at the other end, meaning an address can pass as valid with absolutely nothing answering on it. An address carrying a mask, in the 192.168.1.0/24 form, gets rejected, since validation here covers single hosts.

Related Tools

🖧

MAC Address Validator

Validate MAC addresses in colon (xx:xx:xx:xx:xx:xx), hyphen, Cisco (xxxx.xxxx.xxxx) or no-separator formats. Identifies unicast/multicast and local/universal. Everything in your browser.

✅

Credit Card Validator

Validate credit card numbers using the Luhn algorithm. Identifies the card brand and verifies the check digit, no data sent to servers.

🔗

UTM Parameters Validator

Validate URL with UTM params (utm_source, medium, campaign, content, term). Checks presence, format (lowercase), no spaces.

📱

Country-aware Cellphone Validator

Validate mobile phone number for chosen country (BR, US, PT, ES, AR, MX). Country-specific rules.

✅

Brazilian Voter ID Validator

Validate Brazilian voter ID (Título de Eleitor) numbers using the official TSE algorithm. No data sent to servers.

🔌

TCP/UDP Port Validator

Validate TCP/UDP port number and classify range.