IP Address Generator in 2026: Public, Private, Loopback

For IPv4 the generator produces values in four scopes: public, private, loopback, and link-local. For IPv6 it produces four scopes as well: global, unique local (ULA), link-local, and loopback. The scope is part of the request, not something you guess from the output, because the same dotted quad can be private in one context and a valid host on a private network in another.

Scope is a fixture label, not a reachability claim. A generated public-scope address is outside the private and special-purpose blocks, but it may still coincide with a real allocation somewhere on the internet. Do not send traffic to generated addresses. If a test must be certain that nothing real is contacted, use the documentation ranges described below instead of public-scope output.

The blocks below are the ones a validator or a fixture builder must handle explicitly. Private space is 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, which gives roughly 17.8 million addresses. Loopback is the whole 127.0.0.0/8 block, not just 127.0.0.1, and link-local is 169.254.0.0/16, familiar as the APIPA range when DHCP fails.

Beyond those, several blocks matter for tests. 100.64.0.0/10 is carrier-grade NAT space and behaves like private space on many networks. 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 are reserved for documentation, which makes them ideal for fixtures that must never reach a real host. 198.18.0.0/15 is reserved for benchmarking. 0.0.0.0/8 means "this host", 224.0.0.0/4 is multicast, and 240.0.0.0/4 is reserved.

The three private blocks are defined by RFC 1918 and are not routable on the public internet. Which one you use is a matter of scale and convention: 10/8 gives a single flat space large enough for anything, 172.16/12 is common in container networks, and 192.168/16 is the default on consumer routers. The blocks do not overlap, so a test that assumes every private address starts with 10 is wrong about two thirds of the space.

A subtlety that breaks tests: private addresses are ordinary addresses inside the private network. If your CI runner sits on 10.0.0.0/8, a generated private address in that block can point at a real internal host, including a metadata service or an admin panel. Generate from the 192.168.0.0/16 range or, better, from the documentation ranges when the test must be isolated.

Loopback addresses never leave the host. 127.0.0.1 is the common one, but the entire 127.0.0.0/8 block is loopback on most stacks, and 127.0.0.53 is used by systemd-resolved for local DNS. A test that hard-codes 127.0.0.1 as a server address will collide with anything else on the machine using the same port, which is why parallel test runs should allocate ports dynamically.

Link-local IPv4 addresses in 169.254.0.0/16 are assigned automatically when no DHCP server answers. Seeing one in production logs almost always means DHCP failed, not that a customer is on a strange network. On IPv6 the equivalent is fe80::/10, and it behaves differently: every IPv6 interface has a link-local address, it is required for neighbour discovery, and it cannot be used without a zone index because the same address exists on every link.

IPv6 has no broadcast and no NAT requirement, and its scope rules are carried in the prefix. Global unicast currently lives in 2000::/3, which is the entire range from 2000:: to 3fff:ffff:ffff:ffff:ffff:ffff:ffff:ffff. Unique local addresses live in fc00::/7 and are conventionally generated from fd00::/8. Link-local is fe80::/10, and ::1/128 is loopback with ::/128 as the unspecified address.

The generator returns addresses in those four scopes. Two details matter for tests: a ULA address is not globally routable and must be treated as private, and a link-local address is only meaningful with a zone identifier, for example fe80::1%eth0. If your code stores an IPv6 address, store the zone separately rather than glued into the text, because a percent sign in a URL has a different meaning.

IPv4-mapped IPv6 addresses take the form ::ffff:192.0.2.1 and appear when a dual-stack socket reports an IPv4 peer as IPv6. They are not general-purpose IPv6 addresses, and treating them as such produces bugs in rate limiters and access rules that compare prefixes. 6to4 addresses in 2002::/16 and Teredo addresses in 2001::/32 are transition mechanisms with their own structure; do not generate them as if they were ordinary global addresses.

Other traps are older but still present. A leading zero in an IPv4 octet, such as 010.1.1.1, is interpreted as octal by some parsers and rejected by others, so never accept it in a fixture. The abbreviated form 127.1 is accepted by some stacks as 127.0.0.1. Ports are a separate field and must never be concatenated into the address value.

For unit tests that never open a socket, use documentation ranges: 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 for IPv4 and 2001:db8::/32 for IPv6. These are reserved precisely so that examples and tests cannot reach a real host. A parser should accept them as syntactically valid public-scope addresses, which makes them a good test of classification logic too.

For integration tests that do open sockets, bind to loopback and allocate the port from the operating system rather than hard-coding 8080. For tests that need a plausible remote peer, use the documentation ranges and make any client refuse to dial them. That combination gives you realistic values and a hard guarantee that a misconfiguration cannot send traffic somewhere unexpected.

Every generated address should pass the same validator the application uses. That is the point of generating it. Assert that the family matches the requested scope, that the address is inside the expected block, and that the text form parses back to the same bits. A round trip catches zero compression errors in IPv6, where 2001:db8:0:0:0:0:0:1 must normalize to 2001:db8::1 and nothing else.

Also assert what the address is not. A private-scope fixture must not fall inside a public block, a loopback fixture must be in 127.0.0.0/8 or exactly ::1, and no fixture should ever be multicast, broadcast, or the unspecified address unless the test is explicitly about those cases. Those negative assertions are cheap and catch the most embarrassing generator bugs.