Privacy Glossary: VPN, DNS & IP Address Terms Explained

AES-256 Encryption

The encryption standard used by virtually every reputable VPN, also used by governments and banks to protect classified and financial data. The "256" refers to the key length in bits — brute-forcing it is considered computationally infeasible with current technology. See how VPN encryption works in the VPN Guide.

ASN (Autonomous System Number)

A unique identifier assigned to a network or group of networks under single administrative control, such as an ISP, cloud provider, or VPN service. Every public IP address belongs to an ASN, which is how websites can tell if you're connecting from a residential ISP, a data center, or a known VPN provider. See your own ASN on the Network Details page.

Bandwidth Throttling

When an ISP deliberately slows a connection for specific types of traffic (streaming, torrenting) or during periods of network congestion. It's difficult to prove directly, but comparing speeds with and without a VPN can reveal throttling that targets specific traffic types rather than your connection as a whole — see the throttling section on the Speed Test page.

Browser Fingerprint

A profile built from dozens of technical details your browser exposes — screen resolution, installed fonts, GPU, timezone, and more — that's often unique enough to identify and track you even with cookies disabled. See how identifiable your own browser is with the browser fingerprint test.

Canvas Fingerprinting

A tracking technique that draws invisible graphics using your browser's Canvas API and reads back tiny rendering differences caused by your specific GPU, drivers, and operating system. Because these differences are highly consistent per device, they create a stable identifier that persists even after clearing cookies.

CCPA / CPRA (California Consumer Privacy Act)

California's state privacy law (expanded by the CPRA) gives residents the right to know what personal data companies collect, request its deletion, and opt out of its sale — including a mandatory "Do Not Sell or Share My Personal Information" option from data brokers. Nearly 20 other US states — including Texas, Virginia, Colorado, and Florida — have since enacted similar comprehensive privacy laws. See the full state-by-state breakdown on the Data Brokers page.

CGNAT (Carrier-Grade NAT)

A technique ISPs use to share a single public IPv4 address among many customers — a workaround for IPv4 address exhaustion. If your connection is behind CGNAT, some services (port forwarding, certain VPN configurations, self-hosting) may not work correctly because you don't have a truly unique public address. In the US, this is especially common on T-Mobile Home Internet and Verizon 5G Home Internet, where it frequently causes "Strict NAT" errors in online console gaming.

Cookies

Small pieces of data websites store in your browser to remember information between visits — login sessions, shopping carts, and preferences. First-party cookies (set by the site you're visiting) are generally benign; third-party cookies are the ones most associated with cross-site ad tracking.

CPU Cores (Hardware Concurrency)

The number of logical processor cores your device's CPU reports to the browser via the navigator.hardwareConcurrency API. It's a moderately identifying fingerprinting signal — most devices cluster around a handful of common values (4, 8, 16), so it narrows down your device type without being unique on its own. See your own value on the Fingerprint page.

Credential Stuffing

An automated attack where hackers take username/password pairs from a data breach and try them against thousands of other websites, betting that people reuse passwords. It's the main reason a single breached password should be treated as compromised everywhere, not just on the site it leaked from.

Dark Web

The portion of the internet not indexed by standard search engines and accessible only through specialized software like Tor. Stolen data from breaches — passwords, credit card numbers, Social Security numbers — is commonly bought and sold on dark web marketplaces. Check whether your own email or password has surfaced there with the Email Breach Check.

Data Breach

An incident where an organization's systems are compromised and user data — emails, passwords, financial details — is stolen, often later sold or published on the dark web. Check if your own accounts have been exposed with the Email Breach Check or Password Breach Check.

Data Broker

A company that collects personal information — from public records, purchase histories, app data, and more — and compiles it into profiles sold to advertisers, background-check services, and other buyers. See which brokers likely have a file on you and how to opt out on the Data Brokers page.

Device Memory

An estimate of your device's total RAM, rounded down to the nearest power of two (e.g., 4, 8, 16 GB), exposed to websites via the navigator.deviceMemory API. Combined with CPU cores and screen resolution, it helps narrow down which specific device model you're using. See your own value on the Fingerprint page.

DNS (Domain Name System)

The system that translates human-readable domain names (like whatismy-ipaddress.com) into the numerical IP addresses computers use to find each other. Every website visit starts with a DNS lookup, which is why the DNS server you use can see every domain you visit — even when your connection itself is encrypted.

DNS Leak

A privacy failure where DNS requests bypass an active VPN tunnel and go directly to your ISP's DNS servers instead of the VPN's, revealing which websites you visit even though your traffic content is encrypted. Test your own connection with the DNS Leak Test.

DNS over HTTPS (DoH)

A protocol that encrypts DNS queries inside standard HTTPS traffic, preventing your ISP or anyone monitoring the network from seeing which domains you look up — a big reason major US ISPs historically opposed it, since it cuts off a source of browsing data they could otherwise sell to advertisers. It's enabled by default in Firefox, and increasingly available (though not always on by default) in Chrome, Edge, and Safari. It doesn't replace a VPN, though — it only protects the DNS lookup, not the rest of your traffic.

Do Not Track (DNT)

A now-deprecated browser header that asked websites not to track you across the web. Almost no site ever honored it, and most modern browsers have removed the setting entirely — it has been effectively replaced by legally-binding signals like Global Privacy Control. See why I don't use it in the Fingerprint methodology.

Dynamic IP vs. Static IP

A dynamic IP address changes periodically — most home internet connections work this way, with the ISP reassigning addresses from a shared pool. A static IP address stays fixed and is typically purchased separately, often used for hosting servers or remote access where a stable address is required.

Firewall

A security system, built into your router or operating system, that monitors incoming and outgoing network traffic and blocks connections that don't meet defined rules. It's your primary defense against an open port being reached by an attacker. Check which ports are exposed on your own connection with the Open Port Scanner.

Five Eyes Alliance

An intelligence-sharing agreement between the US, UK, Canada, Australia, and New Zealand (extended to Nine Eyes and Fourteen Eyes with additional countries). Some privacy-focused users prefer VPN providers based outside these jurisdictions, on the theory that it reduces exposure to intelligence-sharing legal requests — though a genuine, audited no-logs policy matters more than jurisdiction alone.

GDPR (General Data Protection Regulation)

The European Union's comprehensive data protection law, giving EU/EEA residents strong rights over their personal data, including the right to access, correct, and completely erase it. It's significantly stronger than any current US federal or state law — there's no US equivalent, only a patchwork of state-level laws like CCPA/CPRA. See how it compares to US protections on the Data Brokers page.

Geo-Blocking / Geo-Restriction

When a website or streaming service restricts or changes its content based on the country or region your IP address indicates, such as a show only being licensed for viewers in the US. A VPN can bypass this by connecting through a server in an eligible location, though streaming services actively try to detect and block VPN IP ranges. See the Best VPN for Streaming guide.

Global Privacy Control (GPC)

A browser signal that automatically tells websites you don't want your personal data sold or shared, satisfying opt-out requirements under several US state privacy laws. It's legally binding in states like California and Colorado, but it only covers data already collected — it doesn't stop a tracker's request from loading in the first place. See the Ad Tracker Blocking Test.

GPU Renderer

The specific graphics processor model and driver your browser reports (e.g., "ANGLE (NVIDIA GeForce RTX 3070)"), read via the WebGL API. It's one of the highest-impact browser fingerprinting signals because the exact combination of GPU model, driver version, and OS is highly specific to your device. See your own GPU signature on the Fingerprint page.

Hostname (Reverse DNS)

A human-readable name associated with an IP address, looked up via a reverse DNS (PTR) record. It often reveals your ISP or connection type — for example, a hostname containing "comcast" or "verizon" — and its absence is normal for many VPNs and mobile connections. Learn more on the Network Details page.

HTTPS / TLS

HTTPS is the secure version of the HTTP protocol used to load websites, encrypted using TLS (Transport Layer Security). It protects the content of your connection to a specific site from eavesdroppers, but — unlike a VPN — it doesn't hide which site you're visiting or your IP address from that site.

IP Address

A unique numerical label assigned to every device connected to the internet, used to identify it and route traffic to and from it. Every request you send — loading a webpage, streaming a video — carries your IP address so the response knows where to go. Websites, advertisers, and your ISP can all see it. Check yours at the top of the homepage.

IP Blacklist

A database maintained by security vendors and mail providers that flags IP addresses associated with spam, malware, or other abusive activity. Being listed can cause your emails to be rejected or sent to spam and can trigger extra CAPTCHA challenges — sometimes through no fault of your own, since ISPs recycle IP addresses. Check your own IP's reputation with the IP Blacklist Check.

IP Geolocation

The process of estimating a physical location — country, region, city, sometimes coordinates — from an IP address, based on databases that map IP ranges to where they're registered or deployed. It's rarely precise enough to pinpoint an exact address, but it's usually accurate at the city level, which is why VPN location spoofing works for unblocking regional content. See your own detected location on the Location Details page.

IPv4

The original internet addressing system, using a 32-bit number written as four decimal groups (e.g., 192.168.1.1). It allows for about 4.3 billion unique addresses — a number the internet exhausted years ago, which is why IPv4 addresses are now shared through techniques like CGNAT.

IPv6

The newer addressing system designed to replace IPv4, using a 128-bit number that supports an effectively unlimited number of unique addresses. IPv6 is increasingly common on mobile networks and modern ISPs; if a VPN doesn't tunnel IPv6 traffic, it can leak your real location even while your IPv4 address stays hidden — see IPv6 Leak below. The IPv6 Test shows whether your connection has IPv6.

IPv6 Leak

When a VPN only tunnels IPv4 traffic and leaves IPv6 traffic to travel outside the encrypted tunnel, exposing your real location on IPv6-enabled networks even while your IPv4 address appears hidden. A common blind spot in cheaper or misconfigured VPN setups — see the full Security Analysis.

ISP (Internet Service Provider)

The company that provides your internet connection — Comcast, Verizon, AT&T, and similar. Your ISP can see every domain you visit (via DNS) and, without a VPN, potentially throttle or monitor your traffic. Your ISP's name typically shows up as the "ASN Organization" associated with your IP — see your own on the Network Details page.

Kill Switch

A VPN feature that automatically blocks all internet traffic if the VPN connection drops unexpectedly, preventing your real IP address from being exposed even for a moment. Any VPN used for privacy — not just streaming — should have a reliable kill switch enabled. See how providers compare in the VPN Comparison.

MAC Address

A unique hardware identifier burned into your device's network adapter (Wi-Fi or Ethernet chip), distinct from your IP address. It's only visible to devices on your local network — like your router — not to the wider internet, but it can be used to track a device across different Wi-Fi networks unless your OS randomizes it, which iOS, Android, and macOS (Sequoia and later) now do by default — Windows offers the option but doesn't enable it automatically.

Malware & Spyware

Malware is any software designed to damage, disrupt, or gain unauthorized access to a device. Spyware is a specific category that secretly monitors activity — including keyloggers that record every keystroke, capturing passwords as you type them. It's one of the main ways passwords end up compromised outside of a data breach — see how on the Password Breach Check page.

Media Codecs

The audio and video compression formats (like H.264, AV1, or AAC) your browser reports support for. Because codec support varies by OS, browser, and installed hardware/software combinations, the specific list is another signal used in browser fingerprinting. See your own supported codecs on the Fingerprint page.

Multi-Hop VPN (Double VPN)

A configuration that routes your traffic through two VPN servers in sequence instead of one, adding an extra layer of encryption and making it harder to trace traffic back to you. It comes at the cost of noticeably slower speeds, since traffic makes two encrypted hops instead of one.

NAT (Network Address Translation)

The technique a router uses to let multiple devices on a private network share a single public IP address, translating between your private (192.168.x.x) and public IP as traffic passes through. It's a normal, essential part of how home and office networks connect to the internet — see Public vs. Private IP for more detail.

No-Logs Policy

A VPN provider's commitment not to record your browsing activity, connection timestamps, or IP addresses. The claim is only meaningful when verified by an independent third-party audit — without one, there's no way to confirm the provider actually keeps its promise. See the VPN Comparison for audited providers.

Open Port

A network port on your device or router that's actively listening for incoming connections, as opposed to a closed port that rejects them. Unnecessary open ports are a common attack surface — each one is a potential entry point for an attacker if the service behind it has a vulnerability. Scan your own connection with the Open Port Scanner.

OpenVPN

An open-source VPN protocol that's older and more thoroughly battle-tested than newer alternatives, running over TCP or UDP and working through nearly any firewall. It's slower than WireGuard but remains a reliable fallback when a network actively blocks other VPN protocols. See the full protocol comparison in the VPN Guide.

Password Manager

An app that generates and securely stores a unique, complex password for every account, so you never have to reuse a password across sites — the single biggest factor behind credential stuffing attacks. If a password check flags a breach, changing it with a password manager is the recommended first step. See what to do next on the Password Breach Check page.

Personally Identifiable Information (PII)

Any data that can be used to identify a specific individual, either alone (a Social Security number) or combined with other data (a name plus a date of birth and ZIP code). US state privacy laws like the CCPA and CPRA give residents specific rights over how companies collect, sell, and store PII — see the state-by-state breakdown.

Phishing

A social engineering attack where you're tricked into entering credentials on a fake website, or into clicking a malicious link, usually via an email or message that impersonates a trusted company. It's one of the most common ways passwords end up compromised — often using details from a previous data breach to make the message more convincing. See how it fits into the bigger picture on the Password Breach Check page. If you own a domain, missing SPF/DKIM/DMARC records make it easy for attackers to spoof your domain in phishing emails — check yours with the SPF, DKIM & DMARC Checker.

Pixel Ratio

The ratio between physical device pixels and CSS pixels (e.g., 2.0 on most modern phones, 1.0 on standard desktop monitors), exposed via window.devicePixelRatio. Combined with screen resolution, it helps distinguish device types — a moderately identifying browser fingerprinting signal. See your own value on the Fingerprint page.

Platform (Navigator Platform)

A string reported by navigator.platform identifying your device's underlying operating system family (e.g., Win32, MacIntel, Linux). It's a low-impact fingerprinting signal on its own since it only narrows things down to a broad OS category shared by millions of devices. Modern browsers increasingly freeze this value to limit tracking, forcing fingerprinters to rely on newer client hints instead. See your own value on the Fingerprint page.

Programmatic Advertising

The automated, real-time bidding system that places most online ads — an ad slot is auctioned to advertisers in milliseconds based on data about the visitor, often pulled from tracking pixels and cookies. It's one of the four tracker categories the Ad Tracker Blocking Test checks against.

Proxy Server

An intermediary server that reroutes traffic from a single app or browser, changing the IP address a website sees without encrypting the connection. Proxies are faster and cheaper than VPNs but offer far less protection — see the full VPN vs. Proxy comparison.

Public IP Address vs. Private IP Address

Your public IP address is the one visible to the wider internet, assigned by your ISP. Your private IP address (typically something like 192.168.x.x or 10.x.x.x) is used only inside your home or office network to distinguish devices behind the same router. A router uses NAT to map private addresses to your single public one.

Public Wi-Fi Risk

The added exposure of using an unsecured or shared network — like at an airport, cafe, or hotel — where other users on the same network can potentially intercept unencrypted traffic. A VPN encrypts your connection before it reaches the local network, neutralizing most of this risk. See the full VPN Guide.

Residential Proxy vs. Datacenter Proxy

A residential proxy routes traffic through an IP address assigned by an ISP to a real home, making it look like ordinary consumer traffic. A datacenter proxy uses IP addresses from cloud hosting providers, which are cheaper and faster but far easier for websites to detect and block.

Session Recording

A tracking technique that records your on-page behavior — mouse movements, clicks, scrolling, and sometimes keystrokes — and can play it back like a video for the website owner. It's one of the four tracker categories the Ad Tracker Blocking Test checks against, and among the most invasive since it can capture data typed into forms before you even submit them.

SOCKS5 Proxy

A type of proxy that routes traffic at a lower level than typical HTTP proxies, without encrypting it. Common for torrenting, where it hides your IP from other peers in a swarm without the speed overhead of full VPN encryption — but because it doesn't encrypt the data itself, your ISP can still see exactly what you're downloading.

Split Tunneling

A VPN feature that lets you choose which apps or traffic go through the encrypted VPN tunnel and which connect directly to the internet. Useful for routing only sensitive traffic through the VPN while keeping local network access (like a printer) or bandwidth-heavy apps outside the tunnel.

Storage APIs

Browser mechanisms — localStorage, IndexedDB, and similar — that let websites store data on your device between visits. Unlike cookies, this data isn't automatically sent with every request, but it persists similarly and can be used to re-identify you even after clearing cookies, unless you're in private/incognito mode where it's cleared on close. See the details on the Fingerprint page.

Subnet

A logical subdivision of an IP network, defined by a subnet mask (e.g., 255.255.255.0) that determines which addresses belong to the same local segment. Devices within the same subnet can communicate directly; traffic to any other subnet must be routed. Calculate the network address, broadcast address, and usable host range for any subnet with the Subnet Calculator.

Third-Party Cookie

A cookie set by a domain other than the one you're currently visiting, typically placed by an ad network or analytics script embedded on the page. Because the same ad network appears on thousands of sites, its cookie can track your browsing across all of them. Safari and Firefox block third-party cookies by default; Chrome reversed its own multi-year phase-out plan and continues to allow them by default, though users can still disable them manually in settings.

Tor (The Onion Router)

A free, volunteer-run network that routes your traffic through at least three encrypted relays, making it extremely difficult to trace back to you. It's slower than a VPN and some sites block Tor traffic outright, but it offers stronger anonymity for users who need it. See the Tor Browser guide.

Tracking Pixel

A tiny, often invisible image or script embedded on a webpage that silently sends data back to a third party — like Meta or Google — every time the page loads, confirming you visited and often linking that visit to an existing ad profile. The Ad Tracker Blocking Test loads 36 real tracking pixels to show which ones your browser blocks.

Two-Factor Authentication (2FA)

A login method that requires a second proof of identity beyond your password — typically a code from an app or a physical security key — so that a leaked password alone isn't enough to access your account. Strongly recommended on any account holding sensitive data, especially after checking for exposure with the Password Breach Check.

User Agent

A string your browser sends with every request, identifying the browser name, version, and operating system. It's used for compatibility (serving the right layout for mobile vs. desktop) but also contributes to browser fingerprinting when combined with other signals. Modern browsers increasingly freeze or generalize this string to limit tracking, shifting toward User-Agent Client Hints instead.

VPN (Virtual Private Network)

A service that encrypts all of your device's internet traffic and routes it through a server operated by the VPN provider, hiding your real IP address and protecting your data from your ISP and anyone else on the same network. Unlike a proxy, a VPN protects your entire device, not just one browser or app. See the full VPN Guide.

VPN Obfuscation (Stealth VPN)

A VPN feature that disguises encrypted VPN traffic to look like ordinary HTTPS traffic, making it harder for firewalls, streaming services, or restrictive networks (like those in some workplaces or countries) to detect and block. Useful when a network actively blocks known VPN IP ranges or protocol signatures. See related limitations in the VPN Guide.

WebRTC Leak

A privacy flaw in the WebRTC technology browsers use for video calls, which can expose your real IP address directly to websites through browser JavaScript — bypassing your VPN entirely. Test your browser with the WebRTC Leak Test.

WHOIS

A public lookup service that returns registration and network ownership data for an IP address or domain — who operates it, its ASN, network range, and abuse contact. For an IP address, it does not reveal a personal owner, only the network operator; for a domain, it can show the registrar and registration dates depending on the owner's privacy settings. Look up any IP or domain with the WHOIS Lookup tool.

WireGuard

A modern, fast, and lightweight VPN protocol with a codebase of roughly 4,000 lines — small enough to be fully audited — using state-of-the-art cryptography. It's now the default protocol for most reputable VPN providers because it's both faster and more efficient than older alternatives. See the full protocol comparison in the VPN Guide.

Privacy & Networking Glossary

A