Why does my home IP address change when I restart the router?

Most home connections get a dynamic address from the ISP. With PPPoE, every reconnect is a new session and often a new address. With DHCP the router usually gets the same address back if its lease is still valid, but a long outage, a new router or ISP maintenance can hand you a different one.

My IP changes every day even though nothing happened. Why?

If the address you see is IPv6, that is probably your device's privacy (temporary) address, which operating systems rotate on purpose, typically about once a day. The network prefix stays the same; only the last 64 bits change. Some ISPs also force a daily PPPoE reconnect.

Can I get an IP address that never changes?

Ask your ISP for a static IP; it is usually part of a business plan or a paid add-on. If you only need a name that follows your changing address, dynamic DNS (DDNS) is enough, unless you are behind CGNAT, in which case nothing from outside can reach you directly.

Is my IP changing a sign that I've been hacked?

No. The address your ISP assigns changes for ordinary reasons and has nothing to do with what runs on your computer. A change in the network name (ASN) you didn't expect is worth a look, though: it means traffic is leaving through a different network, such as a VPN app, proxy or browser extension you didn't knowingly install.

Why Does My IP Address Keep Changing?

First: which address changed?

People say “my IP changed” about two different things.

Your private address is the one your router gives your laptop or phone: 192.168.x.x, 10.x.x.x or 172.16.x.x–172.31.x.x. It changes when the router’s DHCP hands out a different one, and nobody outside your house ever sees it. If a printer or a port-forwarding rule stopped working at home, this is usually the one that moved, and the fix is a DHCP reservation in the router.

Your public address is what websites, game servers and the “new sign-in from…” emails see. It belongs to your ISP (or to the VPN, relay or mobile carrier your traffic leaves through), and you don’t control it. The rest of this page is about that one.

To see it, open the IP check, or from a terminal:

curl -4 https://api.ipify.org; echo        # your public IPv4
curl -6 https://api64.ipify.org; echo      # your public IPv6, if you have one
dig +short TXT o-o.myaddr.l.google.com @ns1.google.com   # same idea, over DNS

One thing to rule out immediately. If your connection has both IPv4 and IPv6, a site sees whichever one your browser used for that connection, and browsers pick between them per connection. So one check showing 203.0.113.45 and the next showing 2001:db8:4f2a::1c is not a change at all. The IP check shows only the single address this connection came from, so compare IPv4 with IPv4.

Read the ASN before you guess

The quickest way to sort the causes is to compare two things between the old and new reading: the address, and the ASN (the number of the network that owns it, shown next to the ISP name).

What changed	Most likely reason
Address changed, same ASN and ISP name	Your ISP gave you a new address: lease, reconnect, CGNAT pool, IPv6 rotation
ASN and ISP name changed too	Your traffic now leaves through a different network: VPN, iCloud Private Relay, mobile data, office or guest Wi-Fi
Only the city changed	Possibly nothing. IP geolocation is an estimate, often the ISP’s regional hub, and databases get revised

If the ASN changed and you didn’t switch networks on purpose, look for a VPN app, a “secure browsing” feature in antivirus, a browser extension, or Private Relay turned on with a software update.

Same ISP, new address: the usual causes

Dynamic leases (DHCP)

Most cable and fiber connections get their public IPv4 address by DHCP, the same protocol your router uses inside the house, just run by the ISP. The address comes with a lease. While your router stays online and keeps renewing, you usually keep the same address for weeks or months.

You get a new one when the renewal chain breaks:

the router or modem was off long enough for the lease to expire (a power cut, a holiday);
you replaced the router, so the ISP sees a different hardware (MAC) address and treats it as a new customer device;
the ISP did maintenance, renumbered a region, or moved customers between equipment.

That’s why “it changed after the power cut” or “it changed when I got a new router” are the most common stories, and why a simple reboot often does not change the address.

PPPoE sessions

DSL and many fiber lines use PPPoE: the router logs in with a username and password and gets an address for that session. Every new session can bring a new address, so a router reboot or a line drop is much more likely to change it than with DHCP. Some ISPs also end sessions on a schedule, for example once every 24 hours, so the address changes daily without anyone touching anything. Your router’s log or WAN status page shows the PPPoE reconnects.

CGNAT: you don’t have your own public IP

Many ISPs, and practically all mobile carriers, no longer give each customer a public IPv4 address. Your router gets an address inside the ISP’s network, and a carrier-grade NAT (CGNAT) translates many customers onto a shared pool of public addresses.

How to tell: open your router’s status page and look at its WAN (internet) address. Compare it with what the IP check shows.

WAN address equals the public IP: you have your own address.
WAN address is in 100.64.0.0/10 (that is, 100.64.x.x to 100.127.x.x): that range is reserved for exactly this use (RFC 6598). You’re behind CGNAT.
WAN address is 10.x, 172.16–31.x or 192.168.x: there’s another NAT in front of you, either CGNAT using private space or a second router (an ISP modem in router mode).

A traceroute gives a hint too. If the hop right after your router has a 100.64–127.x.x address, CGNAT is likely, though some ISPs use that range for internal routers as well:

traceroute -n 1.1.1.1     # Linux/macOS
tracert -d 1.1.1.1        # Windows

Under CGNAT the public address you’re seen with is chosen by the ISP’s NAT, and it can change when your mappings time out, when the ISP rebalances the pool, or after a reconnect. You also share it with other customers, which is why you may get CAPTCHAs or blocks caused by someone else. And no port forwarding or DDNS setup will make your home server reachable from outside, because the inbound connection hits the CGNAT, not your router.

IPv6 privacy addresses

If the address that changes looks like 2001:db8:4f2a:1100:9c3e:…, the rotation is probably deliberate. Modern operating systems give each device a stable IPv6 address and temporary “privacy” addresses (RFC 8981, previously RFC 4941). Outgoing connections use the temporary one, and the OS replaces it regularly, often daily, so sites can’t track a device by its address.

You can see them:

ip -6 addr show scope global          # Linux: look for "temporary"
ifconfig | grep temporary             # macOS
ipconfig                              # Windows: "Temporary IPv6 Address"

What normally stays the same is the first half, the network prefix your ISP delegated to your router (often a /56 or /64). If the prefix changes too, the ISP is assigning prefixes dynamically, which mostly happens on reconnect, much like dynamic IPv4.

Different network: the address and the owner changed

Mobile data and switching networks

On a phone, the public IP depends on the network you’re on at that moment. Wi-Fi at home, mobile data on the street, the office network: three different ISPs, three different addresses. Even staying on mobile data, the address can change when you toggle airplane mode, move between areas, or the connection drops, because carriers put phones behind CGNAT pools. “My IP suddenly changed” on a phone is almost always this.

VPNs, relays and “secure browsing” features

All of these replace your public address with the provider’s:

VPN apps, including the ones bundled with antivirus suites and routers;
browser features and extensions that proxy traffic;
iCloud Private Relay on Apple devices, which sends Safari traffic through two relays and assigns an exit address that can change between sessions (Apple publishes the exit ranges);
Cloudflare WARP (the 1.1.1.1 app), whose exits are Cloudflare addresses;
corporate VPNs and cloud security gateways on work devices.

Turn the feature off and check again. You return to whatever your ISP is giving you now, which isn’t necessarily the address you had before you turned it on.

Does it matter?

For browsing, no. For a few things, yes:

Sign-in security. Some sites log you out or ask for a code when your IP or its estimated location changes. A CGNAT or relay address may also look like it’s in another city.
Allowlists. If a partner’s API, your office firewall or a database only accepts your IP, a change locks you out.
Hosting at home. A game server, NAS or camera reached by IP breaks every time the address changes.
Your own servers. If a cloud server’s public IP changes, your domain’s A record still points at the old one, and visitors go nowhere. Check with a DNS lookup what the domain currently resolves to.

Cloud servers deserve a note because the cause is different. On AWS, an automatically assigned public IPv4 address is released when you stop the instance, and you get a new one at start; an Elastic IP stays. On Google Cloud, an ephemeral external address can likewise change across stop and start unless you reserve a static one. If you run anything that other systems reach by IP, use the provider’s static address.

How to get a stable address

A static IP from your ISP. The only real fix for allowlists and for hosting. Usually a business plan or a paid add-on. If you’re on CGNAT, ask anyway: some ISPs will give you a public IPv4 address on request.

Dynamic DNS (DDNS). If you only need a name that follows your address, run a DDNS client. Many routers have one built in. Or update the record yourself from a script, for example with the Cloudflare API:

IP=$(curl -4 -s https://api.ipify.org)
curl -s -X PATCH \
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$RECORD_ID" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data "{\"content\":\"$IP\",\"ttl\":300}"

Run it from cron every few minutes and keep the TTL short, so resolvers don’t keep the old address long after it changes (see TTL best practices). DDNS solves the naming problem only. It does nothing for allowlists, and nothing behind CGNAT.

When you’re behind CGNAT. Inbound connections to your public IPv4 address can’t reach you. Your options: use IPv6 if your ISP provides it (your devices have globally reachable addresses, and you then open the port on the router’s IPv6 firewall), ask the ISP for a public IPv4 address, or connect outward to something with a fixed address: a tunnel service, a mesh VPN such as Tailscale, or a WireGuard tunnel to a small VPS.

When a partner needs to allowlist you. Send traffic out through an address you control: a static IP from the ISP, a VPS with a fixed address, or a cloud NAT gateway with a reserved address. Then give them that, not your home connection.

Keeping a record

If you’re trying to prove to your ISP how often the address changes, log it:

# crontab -e
*/10 * * * * echo "$(date -Is) $(curl -4 -s https://api.ipify.org)" >> ~/public-ip.log

A week of that log, together with the router’s WAN log (DHCP renewals or PPPoE reconnects), usually answers the question: leases that renew quietly, a daily forced reconnect, or a CGNAT address that moves around. When the address changes and the ASN changes with it, look at the other guide: why sites flag an IP as a VPN or proxy.

Check your own domain now

Free, no sign-up. Runs the exact check this guide describes and shows what to fix.