IPWHOIS.io Review: Free IP Geolocation API Explained
IPWHOIS.io Review: Free IP Geolocation API Explained
IPWHOIS.io is an IP geolocation and IP intelligence API that returns location, network, timezone, currency, and security data for any IPv4 or IPv6 address. It is best known for its free endpoint at ipwho.is, which requires no API key or signup and allows up to 1,000 requests per day. This article explains what the service actually returns, how the free and paid tiers differ, and how to verify the data you get back.
What IPWHOIS.io Is and Who It's For
IPWHOIS.io Review: Free IP Geolocation API Explained - What IPWHOIS.io Is and Who It's For.
IPWHOIS.io is a hosted REST API, not a downloadable database (though an offline database option exists for enterprise customers). You send an HTTP GET request with an IP address, and the service returns JSON, XML, or CSV describing that address.
Typical users include:
- Developers who need to localize content, auto-fill forms, or route traffic by region
- E-commerce and fraud teams comparing a visitor's IP location against a billing address
- Security teams checking whether an address belongs to a proxy, VPN, Tor exit node, or hosting provider
- Analysts who need ASN, ISP, and timezone data at scale
Because the free tier allows commercial use, it is also a common starting point for prototypes and small production apps.
How the API Works
The core endpoint is simple:
# Look up your own IP address
curl "http://ipwho.is/"
# Look up a specific address
curl "http://ipwho.is/8.8.4.4"
HTTPS is supported and should be used for browser-based requests. You can also request specific fields to reduce payload size:
curl "http://ipwho.is/8.8.4.4?fields=timezone"
curl "http://ipwho.is/8.8.4.4?fields=currency"
curl "http://ipwho.is/8.8.4.4?fields=security"
A full response includes several logical groups:
| Group | Example fields |
|---|---|
| Location | country, region, city, latitude, longitude, postal |
| Network | ASN, organization, ISP, domain |
| Timezone | id, abbreviation, UTC offset, DST flag, current time |
| Currency | name, ISO code, symbol, exchange rate |
| Security | proxy, VPN, Tor, hosting, relay, mobile flags |
| Metadata | IP type, EU membership, calling code, capital, borders |
Paid plans add native-language translations of place names, which matters if you display city or country names to users in their own language.
Free vs Paid: What Actually Changes
IPWHOIS.io Review: Free IP Geolocation API Explained - Free vs Paid: What Actually Changes.
The free endpoint is genuinely usable, but it has clear boundaries. Here is the practical comparison:
| Feature | Free | Basic ($19.99/mo) | Business ($39.99/mo) | Unlimited ($99.99/mo) |
|---|---|---|---|---|
| Requests | 1,000/day | 600,000/month | 3,000,000/month | Unlimited |
| Commercial use | Yes | Yes | Yes | Yes |
| Native-language data | No | Yes | Yes | Yes |
| Currency data | No | Yes | Yes | Yes |
| Security data (proxy/VPN/Tor) | No | No | Yes | Yes |
| Bulk endpoint | No | No | Yes | Yes |
| Uptime SLA | None | 99.9% | 99.99% | 99.99% |
Two things stand out. First, security flags are not available on the free plan — if proxy or VPN detection is your goal, you need at least the Business tier. Second, the free tier has no uptime guarantee, so it is unsuitable for anything business-critical.
Rate limits are applied per client IP address for direct requests, but per domain when you call the API from JavaScript in a browser. Exceeding the limit returns HTTP 429 with a Retry-After header, and access resets after 24 hours.
What the Data Is Good For
IPWHOIS.io Review: Free IP Geolocation API Explained - What the Data Is Good For.
Content and commerce localization
Geolocation lets you redirect visitors to the right language version, pre-fill country and phone code fields, and display prices in local currency. IPWHOIS.io returns the currency name, ISO code, symbol, and an exchange rate against the US dollar, which covers most localization needs without a second API.
Timezone handling
Timezone conversion is a common source of bugs. The API returns the IANA timezone ID, UTC offset, daylight saving flag, and current local time, so you can render dates correctly without maintaining your own mapping tables.
Fraud and abuse signals
The security object flags proxies, VPNs, Tor nodes, hosting providers, iCloud Private Relay, and mobile carriers. A datacenter IP claiming to be a residential customer is a useful risk signal. However, these flags are heuristics — legitimate users on corporate VPNs will also be flagged, so treat them as one input among several rather than a verdict.
Network identification
ASN, organization, ISP, and domain fields help you distinguish between consumer ISPs, cloud providers, and corporate networks. This is useful for traffic segmentation and for understanding where automated traffic originates.
How to Verify IP Geolocation Results
No IP geolocation database is perfectly accurate, and results can differ between providers because they aggregate data from different sources. If you rely on this data, verify it rather than assuming it is correct.
A practical verification workflow:
- Check your own address first. Look up your current IP and confirm the city and ISP match what you expect.
- Compare across providers. Query the same IP through a second service and note where they disagree. Persistent disagreement usually means the address is registered to a regional ISP hub rather than the user's actual city.
- Confirm what your VPN exposes. If you use a VPN, run a leak check to make sure your real IP is not visible through WebRTC or DNS. A personal VPN guide explains how to choose and test a connection properly, and you can cross-check the reported address with a standard IP lookup walkthrough.
- Test the security flags. Look up a known datacenter IP and a known residential IP to see how the flags behave before you build logic around them.
- Check browser-level signals. IP data is only one layer. Browser fingerprinting, DNS leaks, and WebRTC leaks can reveal more about a visitor than geolocation alone — the digital security overview covers how these layers fit together.
For a broader look at how IP-derived location data is used in analytics and business decisions, see this explanation of location intelligence.
Practical Limitations to Plan Around
- City-level accuracy is approximate. IP addresses are allocated in blocks, not per household. Expect country-level accuracy to be high and city-level accuracy to be variable.
- Mobile and CGNAT traffic is harder to pin down. Carrier-grade NAT means many users share one public IP, so location can be coarse.
- VPN detection is not perfect. New VPN ranges appear constantly, and legitimate corporate traffic gets flagged.
- The free tier is rate-limited per day, not per second. A traffic spike can exhaust your quota quickly.
- No SLA on free. If uptime matters, you need a paid plan or a self-hosted database.
When IPWHOIS.io Is the Right Choice
IPWHOIS.io fits well when you want a fast, low-friction API with a generous free tier and you do not need security flags immediately. The no-signup free endpoint makes it easy to evaluate before committing.
It is less suitable if you need proxy and VPN detection on a tight budget, since that requires the $39.99/month tier. In that case, compare against other providers or run your own checks. You can also review how competing tools price their free and paid tiers in this BrowserLeaks pricing breakdown to see what the market offers.
For teams that want to avoid per-request costs entirely, the enterprise option of downloading the full IP database in MMDB, CSV, or JSON format allows self-hosted lookups with no external dependency.
Related reading
- What Is PrivacyTools.io? History, Tools & How to Verify - PrivacyTools.io is a long-running privacy tool directory with a complex history. Learn what it offers today, its split from Privacy Guides, and how to test your setup.
- PrivacyTools.io: What It Is, How It Works & Alternatives - Learn what PrivacyTools.io is, how its tool recommendations work, what changed over the years, and how to test whether your privacy setup actually works.
Sources and further reading
- IP Geolocation API - IPWHOIS.io - Free IP Geolocation and IP Location Lookup API
- IP Geolocation Documentation - IPWHOIS.io - IP Geolocation and IP Location Lookup Documentation
- IP Geolocation API - Pricing - IP Geolocation API for production and business-critical applications — built for commercial use at scale, with guaranteed throughput, priority routing and a 99.99% uptime SLA.
Frequently Asked Questions
Is IPWHOIS.io free?
Yes, there is a free tier with up to 1,000 requests per day. It requires no API key or registration and permits commercial use. Paid plans start at $19.99 per month.
Does the free plan include VPN and proxy detection?
No. Security data — proxy, VPN, Tor, hosting, relay, and mobile flags — is only available on the Business plan ($39.99/month) and above.
What is the difference between ipwho.is and ipwhois.pro?
ipwho.is is the free endpoint that requires no key. ipwhois.pro is the paid endpoint that requires an API key and returns the full field set, including native-language, currency, and security data.
How accurate is the geolocation data?
Country-level accuracy is generally strong. City-level accuracy varies because IP blocks are allocated regionally, not per address. Mobile networks and carrier-grade NAT reduce precision further. Always validate against a second source if accuracy is critical.
Can I use it in a browser with JavaScript?
Yes, CORS is supported. When you call the API from a browser, rate limits are counted per domain rather than per visitor IP, and the daily quota is shared across all traffic from that domain.
What happens if I exceed the rate limit?
The API returns HTTP 429 (Too Many Requests) along with a Retry-After header. Access is restored automatically after 24 hours.
Does it support IPv6?
Yes. The API accepts both IPv4 and IPv6 addresses, and the response includes a type field indicating which was used.
Conclusion
IPWHOIS.io delivers a clean, well-documented IP geolocation API with a free tier that is genuinely usable for small projects and testing. Its strengths are speed, simplicity, and a broad data set covering location, network, timezone, and currency. Its main limitation is that the most security-relevant fields — proxy, VPN, and Tor detection — sit behind the $39.99/month Business plan.
If you need basic geolocation or localization data, start with the free endpoint and confirm the results against your own IP. If you need threat signals or guaranteed uptime, budget for a paid tier and test the flags against known addresses before you build production logic on top of them.