The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
JavaScript running in a normal web page cannot directly read a visitor’s public IP address. If you control the site, have the browser call an endpoint on your server; the server can return the public source address it observed for that request. Treat that value as network metadata, not as a permanent identity or a guaranteed measure of the visitor’s physical location.
Can JavaScript get a user’s public IP address?
There is no standard browser property such as navigator.ip that gives page JavaScript the visitor’s public IP address. A browser does make HTTP requests, however, and the server receiving a request can observe the source address associated with that connection. Your page can ask your own server for the address the server observed, then use the response in client-side code.
This distinction matters: the browser does not discover the address by reading its own network configuration. It displays information returned by a server. A visitor’s network may use a VPN, proxy, carrier-grade NAT, corporate gateway, or other routing arrangement, so the address your server sees may belong to that intermediary rather than identify the visitor’s device or ISP connection directly.
The recommended method: return the server-observed address
Use a same-origin endpoint on a server or trusted edge layer that you control. The endpoint should determine the address from the incoming connection, apply only the proxy rules your infrastructure actually trusts, and return a small response such as JSON. The page can then handle the response and any network or server errors.
#1 Best Overall
- Request a same-origin endpoint. For example, the page at
https://example.comcan request/api/client-ipfrom that same site. - Determine the address at the server boundary. Use the connection information supplied by the server platform, or a forwarding header only when it was added by a reverse proxy that you operate and explicitly trust.
- Return a minimal response. A JSON object such as
{"ip":"203.0.113.10"}is sufficient for a simple display. - Read the response in the browser. Check the HTTP status, parse the JSON, and present a useful error if the endpoint cannot be reached or does not return the expected data.
Browser-side JavaScript
Once your server provides /api/client-ip, the browser code can be as small as this:
async function showVisitorIp() {
const output = document.querySelector('#visitor-ip');
output.textContent = 'Loading…';
try {
const response = await fetch('/api/client-ip', {
headers: { Accept: 'application/json' }
});
if (!response.ok) {
throw new Error(`IP endpoint returned HTTP ${response.status}`);
}
const data = await response.json();
if (typeof data.ip !== 'string' || data.ip.length === 0) {
throw new Error('IP endpoint returned no address');
}
output.textContent = data.ip;
} catch (error) {
console.error('Could not retrieve the server-observed address:', error);
output.textContent = 'Address unavailable';
}
}
showVisitorIp();Put an element such as <span id="visitor-ip"></span> in the page. This client code assumes the endpoint returns JSON with a string-valued ip property. It does not decide what address is trustworthy; that responsibility belongs to the server and its proxy configuration.
Server-side responsibilities
The exact server code depends on your runtime, hosting platform, and reverse-proxy topology. The important rule is not to accept a visitor-supplied forwarding header as proof of their address. Headers such as X-Forwarded-For can contain values supplied or modified by clients unless a trusted proxy at your network boundary sanitizes and sets them. Configure your framework or edge platform to trust only the proxy hops you operate, and follow its documented client-address handling. The relevant standard distinguishes ordinary HTTP address visibility from WebRTC address gathering, but does not prescribe a framework-specific server recipe.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If your site does not sit behind a proxy, use the address provided for the direct connection by your server environment. If it does sit behind a proxy or CDN, confirm which proxy headers or platform fields are authoritative in that deployment; do not simply select the first value in a comma-separated header without understanding who set each value.
Rank #2
What the returned IP address does—and does not—mean
The value is best described as the public source address observed for a particular request. Depending on network routing, it may represent a VPN exit, proxy, mobile carrier gateway, organization’s shared gateway, or another intermediary. Addresses can change, and several people may share one public address. An IP address alone therefore does not verify a person’s identity or establish where that person is physically located.
For a site owner, the server-observed address is generally the right answer when a feature genuinely needs the public address associated with the request. Keep the purpose narrow, explain collection where appropriate, and avoid retaining or exposing the value longer than the feature requires.
Can I get an IP address without WebRTC?
Yes. For the ordinary purpose of obtaining the public address associated with a visit to your site, use the server-observed-address pattern above. WebRTC is not required.
Free tools Windows power users keep installed
One-click scans. No signup required.
WebRTC uses ICE candidate gathering to find possible network paths for real-time communication. Depending on the browser and network, gathered candidates can include private addresses on local or virtual interfaces as well as public Internet-facing addresses. Under some VPN split-routing configurations, an address outside the VPN route may also be exposed. NAT, proxies, and browser privacy controls affect what is available.
That broader address discovery is part of establishing real-time connections, not a routine substitute for a server endpoint. It can reveal more network information than an ordinary HTTP request and has privacy and performance tradeoffs. The IETF’s WebRTC security architecture notes that a site will generally learn at least a server-reflexive address from an HTTP transaction; hiding an address from the site itself requires a separate client-side privacy mechanism. Chrome documents configurable WebRTC IP-handling policies for extensions, but those are not a universal setting that ordinary page scripts can rely on across browsers.
| Approach | What it is suited for | Address scope and tradeoff |
|---|---|---|
| Server-observed address | Learning the public source address associated with a request to your site | Determined at your server or trusted edge; affected by VPNs, proxies, NAT, and proxy configuration |
| WebRTC ICE candidates | Finding connection paths for real-time peer communication | May expose a broader set of network addresses; introduces privacy and performance considerations |
| Geolocation API | Requesting device position when the user grants permission | Provides position data, not a public IP address; requires a secure context and permission |
Is navigator.geolocation the same as IP lookup?
No. The Geolocation API is a permission-based way to request device position, not a way to read the visitor’s public IP address. It is available in secure contexts and the browser asks the user for permission. The position may be determined using the best available device or browser method, such as GPS.
If your feature needs a person’s location, explain why, request geolocation transparently, and handle the case where the user declines or location is unavailable. If you need approximate location inferred from an IP address, that is a separate IP-geolocation lookup; do not present it as precise device positioning. Accuracy depends on the service and circumstances, and no accuracy figure or provider is established here.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallPrivacy and implementation choices
- Use the narrowest method that meets the need. For the public address seen by your site, use the server endpoint rather than gathering WebRTC candidates.
- Validate trust at the server boundary. Only honor forwarding information set by proxies you control and have configured as trusted.
- Handle errors and missing data. The browser request can fail, the server can return an error, or the response can be malformed. Do not silently treat a missing value as a valid address.
- Minimize collection and retention. Avoid recording or keeping IP data without a clear purpose, and consider what your users need to know about its use.
- Do not infer identity or exact location. A shared or routed public address is not proof of who made the request or where that person is.
Troubleshooting
The browser reports a failed fetch
Confirm that /api/client-ip exists on the same origin and that the server is reachable. Inspect the browser’s Network panel for the request’s status and response. If the endpoint is on another origin, cross-origin restrictions may apply; for this pattern, a same-origin endpoint avoids adding a separate CORS configuration.
Rank #4
The endpoint returns an HTTP error or non-JSON response
Check the server route, deployment logs, and response content type. The example deliberately checks response.ok before parsing JSON, so a server error becomes a visible failure rather than a misleading parse result. Make sure successful responses contain the documented ip field.
The address is a proxy, VPN, or gateway address
This can be expected: the server observes the source address of the request as it reaches the server or trusted edge. Check the visitor’s routing and your own proxy configuration. Do not promise that the result will be a device’s private LAN address or an unmasked ISP address.
The address changes between requests
That does not necessarily indicate a bug. VPN endpoints, mobile networks, proxies, and changing network assignments can alter the source address. Treat each result as metadata about a request, not as a durable user identifier.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesA forwarded header contains unexpected values
Do not trust arbitrary client-provided forwarding headers. Verify which infrastructure added the header, whether it removes incoming spoofed values, and which proxy hops your server framework trusts. If you cannot establish that chain, use the direct connection data available to your server rather than treating the header as authoritative.
WebRTC reveals an address you did not expect
ICE candidate gathering can expose addresses associated with interfaces and routes used for connectivity. VPN split routing and local or virtual interfaces can affect candidates. If your task is only to learn the public source address of a site request, remove the WebRTC gathering step and use the server endpoint instead.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Or skip the browser setup
ScreenshotNeo is a website screenshot API and MCP server; it does not return a visitor’s IP address and is not a replacement for the endpoint above. It is relevant if your separate task is to capture a page while developing or checking a site. A single GET request can return an image or PDF. Its cleanup options can accept cookie or consent banners and remove known consent platforms, newsletter popups, and chat widgets before capture; each step can be turned off. Bot checks, blank pages, failed loads, timeouts, and cache hits are not billed, with the outcome indicated in response headers. AI agents can use its MCP server tools, including take_screenshot, get_page_info, and capture_pdf.
Example using cURL (replace the target URL with the page to capture):
Recommended Free Tools
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo documentation for request options. The same endpoint can be called with Python or Node.js:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);ScreenshotNeo offers 1,000 screenshots per month free with no card; paid plans start at $5 for 3,000. Every feature is on every plan. For page captures, try the ScreenshotNeo website, or sign up for 1,000 free screenshots a month with no card.
Frequently Asked Questions
Will the visitor see that my site requested their IP address?
The browser makes an ordinary request to your site’s endpoint; how you disclose and use the resulting network data is a separate privacy and product decision.
Can an IP address identify a specific visitor by itself?
No. A public address may be shared or routed through intermediaries, and it should not be treated as verified identity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
