Culvert VPNDoes a VPN hide your IP address?
Yes. With a VPN on, websites and apps see the VPN server's address instead of yours. Here is who can still see your real IP, and the leaks to check for.
Yes. When a VPN is connected, every website and app you use sees the VPN server's public address, called the exit IP, instead of the address your carrier or Wi-Fi gave your phone. Your real address is still known to the local network, to your ISP and to the VPN provider, because they all sit before the point where the swap happens. Whether it is hidden from a given party depends entirely on which side of the VPN server that party is on.
What an IP address gives away
Your IP address is assigned by whichever network you are on: your home router's from your ISP, your phone's from the carrier, the café's from its provider. On its own it reveals which ISP you use and roughly where you are, usually to the city. Combined with time, it links visits together: a site that sees the same address on Monday and Thursday can reasonably assume it is the same household.
That is why hiding it matters even though it is not a secret. It is not that the address itself is sensitive; it is that it is the one identifier every site collects without asking.
How the VPN replaces it
Your phone's packets travel encrypted to the VPN server. The server decrypts them and forwards them, and as it does so it rewrites the source address from your phone's to its own. The website receives a request from the server's address and answers to the server's address. The server matches the reply to your session and sends it back down the tunnel.
The result is that the website records the exit IP. Many people share one server at any moment, so from the site's point of view your visit arrives from the same address as every other user of that server.
Who still sees your real address
| Party | Sees your real IP? | Sees where you go? |
|---|---|---|
| The Wi-Fi network you are on | Yes | No |
| Your ISP or mobile carrier | Yes | No |
| The VPN provider | Yes | Yes, at the server |
| Websites and apps | No | Yes, their own site |
The first two rows cannot be otherwise. The Wi-Fi router and your carrier are the ones that gave you the address, and the encrypted packets to the VPN server are addressed from it. What they lose is the destination: they see a stream to one server and nothing beyond it.
The provider row is the honest cost of a VPN. The server needs your real address to send replies back, so the provider is now the party that can pair your address with your destinations. Culvert VPN keeps that client IP address for up to 30 days for abuse handling, does not log the sites you visit, your DNS queries or the contents of your traffic, and its servers see only an opaque connection id rather than an account; the privacy policy spells this out.
The three ways your real IP leaks anyway
A VPN that is connected can still let your address out through a side door. All three are checkable.
DNS leaks. If your phone's DNS lookups go to the local network's resolver instead of through the tunnel, the resolver sees your real address alongside the name of every site you visit. The site's server still sees the exit IP, but the Wi-Fi owner or ISP now has a list of where you went. What a DNS leak is explains how to spot one.
IPv6. Many networks give your phone both an IPv4 and an IPv6 address. A VPN that only routes IPv4 through the tunnel leaves IPv6 traffic going out directly, with your real IPv6 address on it, to any site that supports IPv6. A well-built app either carries IPv6 in the tunnel or blocks it while connected. The IPv6 post covers what to check.
Gaps between sessions. When the tunnel drops and reconnects, or when a network switch briefly interrupts it, traffic can escape in the gap with your real address. Android's own "Block connections without VPN" setting closes that gap by refusing to send anything outside the tunnel.
Split tunnelling is not a leak, but it is worth remembering: any app you have chosen to keep outside the VPN uses your real address by design.
How to check
The only reliable check is to ask a server what address it saw, while connected. If the answer is the VPN server's address, the tunnel is carrying your traffic. A good app does this itself and shows the result on the connect screen, using its own server for the question rather than a third-party "what is my IP" site, which would otherwise learn your exit address and the fact you use a VPN. The IP leak test post has the full routine, including DNS and IPv6.
Culvert VPN shows the exit IP it verified through the tunnel by asking its own server, so you can see the swap has happened rather than trust that it did, and it is free on Google Play.
Questions people also ask
Can my ISP still see my IP address with a VPN?
Yes. Your ISP assigned that address and every packet from your phone, including the encrypted ones to the VPN server, carries it. What the ISP no longer sees is where the traffic goes after the server.
Does the VPN provider know my real IP?
It has to, to send replies back to your phone. Culvert VPN keeps that address for up to 30 days for abuse handling and does not log the sites you visit; the details are at /privacy.
Do I get a new IP address every time I connect?
You get the exit address of whichever server the app picks, which is shared with everyone else on it. Reconnecting may land on a different server in the same city, so the address can change between sessions.