Is 192.168.1.1 a valid IP address?

Yes, syntactically, and it is classified as RFC 1918 private. Valid and publicly routable are different properties — an SSRF filter must check the second, not just the first.

Why is 010.1.1.1 rejected?

Leading zeros are ambiguous: historically they denoted octal, so different parsers read different addresses from the same text. Rejecting them removes a well-known filter-bypass technique.

What is 100.64.0.0/10?

Carrier-grade NAT space (RFC 6598), used by ISPs between subscribers and the public internet. It is neither private nor publicly routable, and filters written against RFC 1918 alone miss it.

Does this check whether the address is online?

No. It validates format and classifies the range. Reachability requires an actual network probe.

Should I validate IPv6 differently from IPv4?

The syntax rules differ substantially — compression with ::, hex groups, zone identifiers and IPv4-mapped forms such as ::ffff:192.0.2.1. The classification question is the same: check the address against special-purpose ranges before allowing an outbound connection to it, because unique-local fd00::/8 and link-local fe80::/10 are the IPv6 equivalents of the ranges an SSRF filter must block.

Network & DNS🔒 Browser (client-side)API available📴 Works offlinebeginner

IP Validator

Validates whether a string is a well-formed IPv4 or IPv6 address.

Data stays in your browser

Ready to runInstant execution

All tools →

Result

—

What does this tool do?

Validates whether a string is a well-formed IPv4 or IPv6 address.

Why would I use it?

You are building a form that accepts IP addresses.
You want to confirm a value before using it in config.
You are sanitizing user input.

Real-life example

Input

192.168.0.1

Output

✓ Valid IPv4

Both IPv4 dotted-quad and IPv6 (including compressed ::) are checked.

Input → Process → Output → Next

Input: Type an IP.
Process: The browser validates the syntax.
Output: Valid IPv4 / IPv6, or a validation error.
Next action: Use the validated value in your configuration.

Common mistakes

Accepting out-of-range octets (256.x.x.x is invalid).
Forgetting IPv6 shorthand like ::1.
Treating validation as reachability (a valid IP may be offline).

What the result means

Valid means the syntax conforms to the standard.

Privacy & security

Your input is processed entirely in your browser and never sent to a YAS server.

API

Endpoint

POST https://yas.sh/api/v1/tools/ip-validator

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/ip-validator" \
  -H "Content-Type: application/json" \
  -d '{"input":"192.168.1.1"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/ip-validator", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "input": "192.168.1.1"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/ip-validator", json={"input":"192.168.1.1"})
data = r.json()

Field	Type	Required	Description
input	string	Yes	e.g. 192.168.1.1 or ::1

Success response

{ "slug": "ip-validator", "result": { "input": "192.168.1.1", "valid": true, "version": 4 } }

Validate IPv4 / IPv6 addresses.

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How IP Validator works

IPv4 validation checks four dot-separated decimal octets in the range 0–255, and rejects the ambiguous forms that some parsers still accept: leading zeros (which historically meant octal, so 010 could be 8), fewer than four parts, and integer notation. These legacy forms are a real security issue — differing interpretations between a validator and an HTTP client are a classic SSRF bypass.

IPv6 validation handles the full RFC 4291 grammar: eight groups of up to four hex digits, at most one :: compression run, optional zone identifiers, and IPv4-mapped forms such as ::ffff:192.0.2.1. Beyond syntax, the tool classifies the address against IANA special-purpose registries — private (RFC 1918), loopback, link-local, CGNAT (100.64.0.0/10), multicast, documentation — because 'is this a valid address' and 'is this an address I should connect to' are different questions.

When to use it: real-world scenarios

Hardening an SSRF filter

Before allowing a user-supplied host, confirm the resolved address is not private, loopback, link-local or CGNAT. Getting the range list wrong is how SSRF filters get bypassed.

Cleaning an allowlist or firewall rule set

Rules accumulate typos and stale entries. Validating each line catches the octet above 255 that silently never matched anything.

Parsing addresses out of logs

Distinguishing genuine addresses from version numbers and IDs before enrichment avoids polluting your geo and reputation lookups.

Validating user input in a form

Server-side validation before storing an address prevents a downstream component from interpreting an ambiguous form differently.

Pro tips

Reject leading zeros outright. 127.0.0.1 and 127.000.000.001 are treated differently by different libraries, and attackers know exactly which.
Remember 169.254.169.254 — the cloud metadata endpoint. Any SSRF allowlist that does not block link-local is not a filter.
Validate after DNS resolution, not before. A hostname that passes your check can resolve to a private address, which is DNS rebinding.
100.64.0.0/10 is carrier-grade NAT, neither public nor RFC 1918 private. Filters written before 2012 routinely miss it.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

Syntax and classification only — no reachability, ownership or reputation check.
Zone identifiers on link-local IPv6 (fe80::1%eth0) are host-specific and cannot be validated beyond syntax.
Classification reflects IANA registries at build time; new special-purpose allocations require an update.
A syntactically valid address may still be unroutable or unassigned.

Frequently asked questions

Is 192.168.1.1 a valid IP address?: Yes, syntactically, and it is classified as RFC 1918 private. Valid and publicly routable are different properties — an SSRF filter must check the second, not just the first.
Why is 010.1.1.1 rejected?: Leading zeros are ambiguous: historically they denoted octal, so different parsers read different addresses from the same text. Rejecting them removes a well-known filter-bypass technique.
What is 100.64.0.0/10?: Carrier-grade NAT space (RFC 6598), used by ISPs between subscribers and the public internet. It is neither private nor publicly routable, and filters written against RFC 1918 alone miss it.
Does this check whether the address is online?: No. It validates format and classifies the range. Reachability requires an actual network probe.
Should I validate IPv6 differently from IPv4?: The syntax rules differ substantially — compression with ::, hex groups, zone identifiers and IPv4-mapped forms such as ::ffff:192.0.2.1. The classification question is the same: check the address against special-purpose ranges before allowing an outbound connection to it, because unique-local fd00::/8 and link-local fe80::/10 are the IPv6 equivalents of the ranges an SSRF filter must block.

Related tools

What Is My IP IP Subnet Calculator