Skip to content
TextArray
100% local

IP address extractor

Pull every IPv4 and IPv6 address out of logs, configs or any text.

Input
Output
Related tools
IP subnet calculatorDeveloper tools
Random IP address generatorRandom generators
URL extractorDeveloper tools
Email extractorDeveloper tools
Cron expression parserDeveloper tools
CSS formatternewDeveloper tools
IP address extractor
Paste a server log, a firewall export, an e-mail header, a config file or any block of text and this tool lists every IP address it contains, one per line, in the order they appear. Both families are covered: dotted IPv4 like 203.0.113.7 and IPv6 in full or compressed form — 2001:db8::1, ::1, fe80:: and IPv4-mapped addresses like ::ffff:192.168.0.1 all count. A bracketed host such as [2001:db8::1]:443 yields the address without the port.
The matching is strict on purpose. IPv4 octets must be 0–255, so 999.1.1.1 never slips through, and a five-part version string like 1.2.3.4.5 is rejected whole rather than trimmed into a false positive. Timestamps (12:30:45), MAC addresses (00:11:22:33:44:55) and C++ scope operators (std::vector) are all recognized as non-addresses and skipped.
Remove duplicates collapses repeated hits — and it understands IPv6 equivalence, so 2001:db8::1 and 2001:0DB8:0:0:0:0:0:1 count as the same address. Sort numerically orders IPv4 by octet value and IPv6 by expanded value, with IPv4 first, which turns a noisy log into a clean survey of who talked to your server. The address type switch narrows the output to one family when you only care about one. The live tally shows the total found plus the IPv4/IPv6 split.
Typical uses: pulling attacker IPs out of auth logs for a blocklist, auditing which addresses appear in a config, extracting peers from a traceroute or netstat dump. Everything runs locally in your browser — logs never leave your device, which matters, because logs are full of personal data.
FAQ
Which IPv6 forms are recognized?
Full eight-group addresses, ::-compressed ones (2001:db8::1, ::1, fe80::), and IPv4-mapped tails like ::ffff:192.168.0.1, case-insensitively. A bare :: alone is skipped — in running text it is almost always a scope operator, not the unspecified address.
Why is 999.1.1.1 not extracted?
Octets must be 0–255, so 999.1.1.1 is not a valid IPv4 address. Version-like strings with five or more parts (1.2.3.4.5) are rejected whole too — the tool never trims a longer number run into a fake address.
How are IPv6 duplicates compared?
By expanded value, not spelling: 2001:db8::1, 2001:0db8:0:0:0:0:0:1 and 2001:DB8::1 are one address. The output keeps the spelling of the first occurrence; the tally counts all three as found.
What order does numeric sort use?
IPv4 first, ordered by octet value (10.0.0.9 before 10.0.0.10), then IPv6 ordered by expanded value. Without sorting, addresses stay in the order they appear in the text.
Is my text uploaded anywhere?
No. The extraction runs entirely in your browser and your logs never leave your device.