IPv6 replaces the 32-bit addresses of IPv4 with 128-bit ones, ending address scarcity and removing the need for NAT. In daily use the differences that matter are VPN leaks, geolocation accuracy, and running both protocols at once.
The addresses, and why the change happened
IPv4, specified in RFC 791 in 1981, uses 32-bit addresses written as four decimal octets: 203.0.113.45. That gives about 4.29 billion possible addresses, a number that seemed limitless when the population of networked computers was in the thousands. IANA allocated the last unreserved blocks to the Regional Internet Registries in February 2011, and ARIN exhausted its free pool in September 2015. Since then, IPv4 addresses have been a traded commodity, typically changing hands at $30 to $50 each.
IPv6, specified in RFC 8200, uses 128-bit addresses written as eight groups of four hexadecimal digits: 2001:0db8:85a3:0000:0000:8a2e:0370:7334, usually compressed to 2001:db8:85a3::8a2e:370:7334 by collapsing one run of zero groups. The address space is roughly 3.4 x 10^38, which is not merely larger but large enough that allocation policy assigns every residential customer an entire /64 subnet as a minimum, and frequently a /56 or /48 containing many subnets.
The scale change removes the reason NAT exists. Under IPv4, a household shares one public address across every device, and the router rewrites addresses and ports to keep sessions apart. Under IPv6, every device can hold a globally routable address, and the router's job becomes filtering rather than translating.
IPv6 is not backwards compatible with IPv4. They are separate protocols that share physical infrastructure. An IPv6-only host cannot reach an IPv4-only server without a translation mechanism such as NAT64 (RFC 6146) paired with DNS64 (RFC 6147).
Dual stack: you are probably running both right now
Most consumer connections in the United States are dual stack. Your device holds an IPv4 address, typically private and behind NAT, and one or more IPv6 addresses that are globally routable. Google's measurements passed 50 percent of users reaching its services over IPv6 in April 2026, and the United States sits above that global figure. Major mobile carriers have run IPv6-only access networks with 464XLAT (RFC 6877) translation for years, which is why a phone frequently reports no IPv4 address at all.
When a name resolves to both an A record and an AAAA record, the client has to choose. Happy Eyeballs version 2, specified in RFC 8305, resolves both, starts the IPv6 connection first, and races an IPv4 attempt after a short delay, typically 50 milliseconds. Whichever handshake completes first wins and the other is abandoned. This is why your traffic to the same website can use different protocols on different days without anything visibly changing.
Your device also holds several IPv6 addresses simultaneously. There is a link-local address starting fe80::, at least one global address derived by SLAAC (RFC 4862), and usually a rotating temporary address from the privacy extensions in RFC 8981, which is what outbound connections actually use so that the interface identifier does not become a permanent tracking token.
- fe80::/10 is link-local, valid only on the local segment, never routed.
- fc00::/7 is unique local addressing, the IPv6 analogue of RFC 1918 private space.
- 2000::/3 is the currently allocated global unicast range; if your address starts with 2 or 3, it is publicly routable.
- A /64 is the standard subnet size; the lower 64 bits identify the host and are what privacy extensions randomise.
The three practical differences that affect you
First, leaks. This is by far the most common real-world consequence. A VPN that tunnels only IPv4 leaves your native IPv6 connectivity untouched, so any site with an AAAA record is reached directly from your ISP-assigned address. Happy Eyeballs will prefer that path. The result is a VPN that appears to work, shows the correct exit address on an IPv4 test page, and reveals your real address to every dual-stack site you visit.
Second, geolocation. IPv6 allocations are newer and geolocation databases have had less time and less corrective feedback to refine them. City-level accuracy for IPv6 tends to be worse than for the equivalent IPv4 range, and mobile IPv6 prefixes are frequently mapped to a carrier's regional aggregation point rather than anywhere near you. If a service places you in the wrong city, checking whether it saw your IPv6 or IPv4 address is a reasonable first diagnostic.
Third, reachability. Under IPv6 there is no NAT to traverse, so a device with a global address can accept inbound connections if the router's firewall permits it. This makes self-hosting far simpler than the port-forwarding gymnastics IPv4 requires, and it means a misconfigured firewall exposes a device directly rather than hiding it behind translation. Consumer routers default to blocking unsolicited inbound IPv6, but that default is a firewall rule, not a structural property.
The prefix your ISP delegates is often stable for months. Because a /64 identifies your household specifically, an IPv6 prefix is a stronger household identifier than a shared IPv4 address behind CGNAT. Privacy extensions randomise the host portion but not the prefix.
How to check what your connection is doing
Force each protocol separately and compare. If the IPv6 request succeeds while a VPN is connected and returns an address that is not your VPN exit, you have found an IPv6 leak in one command.
On the local side, list the addresses your interface actually holds so you can tell a temporary privacy address from the stable SLAAC address. On Windows, an address marked Temporary is the one used for outbound connections.
- If
curl -6fails with a network unreachable error, you have no working IPv6 and the leak class does not apply to you. - If both commands return the same address, you are on an IPv4-only or IPv6-only path via translation.
- If they return different addresses and only one belongs to your VPN, that is the leak.
- 2606:4700:4700::1111 is Cloudflare's IPv6 resolver; 2001:4860:4860::8888 is Google's.
# force each protocol and compare the answers
curl -4 https://ifconfig.co
curl -6 https://ifconfig.co
# which protocol does a given host offer
dig +short AAAA netflix.com
dig +short A netflix.com
# local addresses
ip -6 addr show scope global # Linux
ifconfig | grep inet6 # macOS
Get-NetIPAddress -AddressFamily IPv6 | Format-Table IPAddress, PrefixOrigin, SuffixOrigin, AddressState # Windows
# reachability
ping -6 ipv6.google.com
ping6 -c 4 2606:4700:4700::1111When to turn IPv6 off, and when not to
Disabling IPv6 is a legitimate short-term workaround when your VPN does not tunnel it and you cannot change providers. It removes the leak by removing the capability. It is not a long-term position, and it has costs that are growing rather than shrinking.
Turn it off when you have confirmed an IPv6 leak, your VPN client offers no IPv6 handling, and the affected machine does not need to reach IPv6-only services. Do it per adapter rather than system-wide: on Windows use Disable-NetAdapterBinding -Name "Wi-Fi" -ComponentID ms_tcpip6, and on macOS use sudo networksetup -setv6off Wi-Fi. Microsoft explicitly does not support disabling IPv6 globally via the DisabledComponents registry value set to 0xFF, and several Windows components misbehave when it is absent.
Leave it on when you are on mobile data, where the access network may be IPv6-only and disabling it breaks connectivity outright; when you self-host and want direct reachability without port forwarding; and when you are behind CGNAT, because IPv6 is frequently the only path by which inbound connections can reach you at all.
The better resolution in every case is a VPN configuration that carries both address families inside the tunnel, or that blocks IPv6 at the firewall level while connected rather than leaving it routable. Check whether your client has an IPv6 setting before reaching for the adapter binding.
# Windows: check binding state before and after
Get-NetAdapterBinding -ComponentID ms_tcpip6 | Format-Table Name, Enabled
Disable-NetAdapterBinding -Name "Wi-Fi" -ComponentID ms_tcpip6
Enable-NetAdapterBinding -Name "Wi-Fi" -ComponentID ms_tcpip6Frequently asked
Is IPv6 faster than IPv4?
Marginally, and not for the reasons usually claimed. The header is simpler and there is no NAT translation step, but the dominant factor is path quality. On networks where the IPv6 path is well provisioned, IPv6 is a few milliseconds faster; where it is an afterthought routed through a tunnel, it is slower. Happy Eyeballs picks whichever wins.
Do I need IPv6 at home?
You do not need to configure anything; if your ISP provides it, your router and devices use it automatically. It becomes genuinely useful if you self-host, because a global address removes the need for port forwarding, and it is necessary if you are behind CGNAT and want inbound reachability at all.
Why does my IPv6 address keep changing?
That is privacy extensions working as specified in RFC 8981. Your device generates temporary addresses with randomised host portions and rotates them, typically every 24 hours, so the interface identifier does not act as a permanent tracker. The network prefix, which identifies your household, generally stays stable much longer.
Can a website see both my IPv4 and IPv6 addresses?
Not from a single connection, which uses one protocol. But a page can load resources over both, or use JavaScript to fetch from an IPv4-only and an IPv6-only hostname, and correlate the two. This is a known technique for linking a VPN-protected IPv4 session to a leaking IPv6 address.
What percentage of the internet uses IPv6 now?
Google measured over 50 percent of its users reaching it over IPv6 for the first time in April 2026, while APNIC Labs measured around 42 percent global capability at the same point using a different methodology. The United States sits above the global average, driven heavily by mobile carriers running IPv6-only access networks.