You check your IPv6 address in the morning, check it again the next day, and it's different. Nothing is broken. Your device is almost certainly using temporary "privacy" addresses, which it generates on purpose and swaps out on a schedule so that websites can't follow one fixed address around. Here's how that works, how to see it on your own machine, and when it gets in the way.
An IPv4 device usually has one address per network. An IPv6 device routinely has three or more on the same interface, and they do different jobs.
A typical home connection works like this. Your router receives a prefix from your ISP and advertises a /64 of it on your network. Each device takes that 64-bit prefix and invents the other 64 bits itself, the interface identifier. That process is called SLAAC (stateless address autoconfiguration), and it means no DHCP server has to hand anything out.
The device then builds:
fe80::, only valid on your local networkWhen your laptop opens a connection to a website, it picks the temporary one by default. That's the address our IP lookup and every other site sees, and it's the one that keeps changing.
The original scheme for building the interface identifier was called Modified EUI-64. It took the network card's MAC address, stuck ff:fe in the middle and flipped one bit. A MAC of 00:1A:2B:3C:4D:5E became an interface identifier of 021a:2bff:fe3c:4d5e.
That had an obvious flaw. The last 64 bits of your address were the same on every network you ever joined, at home, at work, in a café, so anyone collecting addresses could recognise the same laptop everywhere. It also advertised the hardware vendor, since the first half of a MAC identifies the manufacturer. (If you want the detail on that, see MAC address vs IP address.)
Two fixes came out of this, and modern systems use both.
Temporary addresses were first defined in RFC 3041, revised as RFC 4941, and are now specified by RFC 8981. The interface identifier is random, it's used for outgoing connections, and it expires and gets replaced on a timer.
Stable privacy addresses, from RFC 7217, fix the stable address instead. The identifier is derived from a secret plus the network prefix, so it stays constant on one network but is completely different on the next. RFC 8064 then recommended that stable addresses stop embedding the MAC at all.
If you see ff:fe in the middle of a device's IPv6 address today, it's probably an older device, an embedded gadget or a server configured the traditional way.
RFC 8981 sets the default lifetimes for a temporary address at one day preferred and two days valid. In practice that means:
So at any moment you may see two temporary addresses side by side: the current one and yesterday's, winding down. The RFC also says temporary addresses must be regenerated when you move to a new network, so joining different Wi-Fi gives you a fresh one immediately.
Operating systems are free to tune these values, so don't be surprised if your machine's numbers differ from the RFC defaults.
There's a second, separate reason your address might change: your ISP may hand your router a different prefix. When that happens, every global address on your network changes at once, stable ones included. Some providers keep prefixes for months; others rotate them on reconnect. If all your devices change together, that's the prefix. If only the tail end changes on one device, that's privacy addressing. The same logic applies to IPv4 leases, which we cover in static vs dynamic IP addresses.
Linux:
ip -6 addr show scope globalLook at the flags after each address:
inet6 2001:db8:1234:5678:a1b2:c3d4:e5f6:789a/64 scope global temporary dynamic
valid_lft 172512sec preferred_lft 86112sec
inet6 2001:db8:1234:5678:1c2d:3e4f:5a6b:7c8d/64 scope global dynamic mngtmpaddrtemporary is the privacy address. mngtmpaddr marks the stable address that temporary ones are generated from. The lifetimes count down in seconds. Whether temporary addresses are used at all is controlled by the net.ipv6.conf.<interface>.use_tempaddr sysctl: 0 disables them, 1 creates them but prefers the stable address, 2 creates them and prefers them. The kernel default is off, but distributions often turn it on. Ubuntu, for example, ships /etc/sysctl.d/10-ipv6-privacy.conf setting it to 2.
macOS:
ifconfig en0 | grep inet6Addresses marked autoconf temporary are privacy addresses. autoconf secured is the stable, per-network one.
Windows:
ipconfig /allYou'll see separate lines for "IPv6 Address" and "Temporary IPv6 Address". To see the settings behind them:
netsh interface ipv6 show privacyPrivacy addresses stop one specific thing: a site or tracker using the last 64 bits of your address to recognise your device over time and across networks. That's worth having.
They don't hide your network. The first 64 bits, your prefix, are the same for everyone in your home and usually stay put for a while, so a site can still tell that today's visitor came from the same household as yesterday's. The address still maps to your ISP and a rough location, just like IPv4 (see how accurate IP geolocation is). And cookies, logins and browser fingerprinting don't care about your IP at all.
So think of it as removing a free, permanent identifier, not as anonymity. If you want the address itself hidden, that's a job for a VPN or Tor.
The usual pain point is allowlisting. You add "your IP" to a firewall rule, a database allowlist or an admin panel, and two days later you're locked out, because the address you added was temporary.
Better options, in order:
2001:db8:1234:5678::/64 covers every device on your network and survives address rotation. Our subnet calculator will show you exactly what a prefix covers.Disabling privacy addresses on a laptop just to make an allowlist behave is the wrong trade. You lose the privacy on every network you visit to fix a problem on one.
That's normal. One link-local (fe80::), one stable global, and one or two temporary global addresses is a typical set. If your network has a unique local prefix (fd00::/8) as well, you'll see addresses from that too.
It won't break anything, but on a personal device it gives away a long-lived identifier for no real gain. It's reasonable on servers and fixed infrastructure, where you want predictable addresses anyway.
No. IPv4 has no equivalent. Your public IPv4 address is usually your router's address, shared by the whole household, and it changes only when your ISP reassigns it.
The temporary one, for connections your device starts. Check with the IP lookup and compare it with ip -6 addr or ipconfig /all: it should match the address flagged as temporary.
0 comments
No comments yet. Be the first.