What we collect, store, and never touch.

Most privacy policies are unreadable on purpose — dense legal language designed to satisfy a requirement, not to inform a reader. This one is written to be understood. If something is unclear, contact us and we'll explain it.

What Network Lookup does

Network Lookup (networklookup.com) provides free network diagnostic and security tools — IP geolocation, DNS records, email authentication, SSL/TLS inspection, and more. Many tools run entirely in your browser. Server-side tools query our own infrastructure and a small number of external sources listed below.

Tools that run entirely in your browser

The following tools process everything locally. Nothing about your input is sent to us — or to anyone else:

• JWT Decoder — tokens are decoded in JavaScript locally and never leave the page.
• Base64 Encode/Decode and Hash Generator — all encoding and hashing happens in the browser.
• SPF Record Generator and DMARC Record Generator — records are assembled locally; nothing is submitted.
• Email Header Analyzer — pastes are parsed in JavaScript locally.
• What's My User Agent — reads what your browser exposes (including the high-entropy Client Hints, requested automatically on load) and renders it on this page; nothing is transmitted.
• Subnet Calculator (CIDR / VLSM) — all arithmetic happens in the browser.
• CSP Analyzer, paste mode — pasted policies are analysed locally. (URL mode fetches the target's policy through our server.)

Two more tools run locally but open network sockets to third parties as part of what they measure: the WebRTC Leak Test (STUN requests to Google, Cloudflare, and Nextcloud endpoints when you click Run) and the Browser Fingerprint tool (one STUN request to Google's endpoint on page load, as part of its WebRTC check). Neither sends anything to us or stores anything; the STUN details are in the third-party section below.

Tools that use our API

Tools like IP Lookup, WHOIS, ASN Explorer, the SPF / DMARC / DKIM checks, IP Blacklist, CAA / DNSSEC, Bulk IP Lookup, and the others send the value you enter (an IP, a domain, a header set) to our server to perform the lookup. We do not keep per-request logs, and we never link a lookup to the visitor who made it. Query responses may be cached at our edge for typically 5–10 minutes to improve performance and reduce load on upstream services. We don't currently run user accounts, and there is no link between a query and a visitor.

One thing we do keep — aggregate, never about you. Four surfaces are demand-counted: the /ip/ address pages, the /asn/ pages, IOC Enrichment reports, and Domain Health reports. For those, we maintain a running count of which IP addresses, ASNs, domains, and IOC values get looked up — a total plus a first-seen and a last-seen timestamp per item — so we can understand demand and decide which result pages are worth expanding. (The IP Reputation checker — incorrectly listed among the demand-counted surfaces in an earlier version of this page — does not send the demand beacon and is not counted.) These counts are about the item being looked up, not about you: no visitor IP address, no device or browser information, and no per-request log is stored against them. The tools that run entirely in your browser (listed above) send us nothing and are never counted.

IP geolocation

We use MaxMind's GeoLite2 database for IP-to-location and IP-to-ASN lookups. The database is loaded on our own server (a Cloudflare Worker reads it from R2 object storage) — your IP address is not sent to any third party for geolocation.

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Cloudflare

This site is served through Cloudflare's network. Cloudflare may collect standard web server logs — IP address, request URL, user agent, timestamp — as part of operating the service, including DDoS protection and bot mitigation. We don't see individual-visitor records; we only use Cloudflare Web Analytics, which is aggregate, cookieless, and does not fingerprint browsers. Cloudflare's own privacy practices are published at cloudflare.com/privacypolicy.

Google AdSense (advertising)

This site displays advertisements through Google AdSense. Google and its advertising partners (including third-party vendors) may use cookies and similar technologies (such as web beacons or local storage) to serve ads based on your prior visits to this site or other websites. This is sometimes called "interest-based advertising."

You can opt out of personalised advertising by visiting Google's Ads Settings at google.com/settings/ads, or by visiting the Digital Advertising Alliance opt-out page at optout.aboutads.info. EU residents can also use youronlinechoices.eu.

Google's use of advertising cookies enables it and its partners to serve ads to your browser based on your visits to this site and/or other sites on the internet. Google's use of personal information is governed by its own privacy policy: policies.google.com/privacy. Google's advertising-cookie use is described at policies.google.com/technologies/ads.

Google Search Console & analytics

We may use Google Search Console to understand how our pages appear in Google's search results. We do not use Google Analytics. Aggregate traffic shape — which pages are popular, which countries visitors come from — comes from Cloudflare Web Analytics, which does not identify individual users.

Third-party services contacted by tools

For most server-side tools, the IP address or domain you enter is sent to the services below from our infrastructure — they see the queried value, not your identity and not your visitor IP:

• Cloudflare DNS-over-HTTPS (cloudflare-dns.com) — server-side DNS queries for the SPF, DMARC, DKIM, DNSSEC, CAA, MTA-STS, and BIMI checks, reverse-DNS in the bulk IP tool, and the email validator's record checks.
• Public DNS resolvers (propagation checker) — Cloudflare (three variants), Google, NextDNS, dns.sb, AliDNS, and DNSPod, each queried from our server for the domain you check.
• Google DNS-over-HTTPS (dns.google) — the server-side whoami probe for the DNS leak test.
• crt.sh (Sectigo) — Certificate Transparency log search for the CT search tool and subdomain finder.
• SSLMate Cert Spotter — the SSL Inspector's Certificate Transparency source.
• hstspreload.org (Chromium project) — the HSTS preload status check.
• RIPEstat (RIPE NCC) — AS overview, announced prefixes, and BGP neighbours for the ASN Explorer.
• IANA RDAP bootstrap and the responsible registry or registrar — WHOIS lookups and the Domain Health registration panel.
• Tor Project — the public bulk exit list (fetched periodically and cached, not per lookup) consulted for Tor-exit status on IP pages, IP reputation, and IOC reports.
• DNSBL operators — SpamCop, PSBL, DroneBL, GBUdb Truncate, SpamEatingMonkey, Interserver, and JustSpam, queried server-side by the IP blacklist checker.

Three tools query a third party directly from your browser — that service sees your visitor IP along with the queried name, exactly as it would if you queried it yourself: the DNS Records tool, Reverse DNS, and the Typosquatting Checker resolve via Cloudflare DNS-over-HTTPS (cloudflare-dns.com) in-browser. Cloudflare's 1.1.1.1 resolver does not log query IP addresses, per their stated policy. Reverse DNS's "Look up my IP" button asks cloudflare.com/cdn-cgi/trace for your own address. And two tools open STUN connections from your browser: the WebRTC Leak Test (Google, Cloudflare, and Nextcloud endpoints, when you click Run) and the Browser Fingerprint tool (Google's endpoint, on page load, as part of its WebRTC check).

Self-hosted web fonts — Instrument Serif, JetBrains Mono, and Inter are served from our own /fonts/ path. No third-party font CDN is contacted.

Cookies

• First-party cookies: we set no first-party cookies for tracking or personalisation.
• Google AdSense: may set third-party cookies for ad personalisation and frequency capping (see opt-out links above).
• Cloudflare: may set technical cookies (cf_clearance, __cfruid) as part of DDoS protection and bot mitigation. These are functional infrastructure cookies and aren't used for advertising or cross-site tracking.

Data retention

• API query cache: 5–10 minutes at the Cloudflare edge, then auto-expires.
• Server logs: managed by Cloudflare per their retention policy (typically 30 days for infrastructure logs).
• Aggregate lookup counts: per queried IP, ASN, or domain — a count plus first-seen and last-seen timestamps, with no visitor data attached. Kept to understand which subjects are in demand.
• User accounts: none currently — the tools work without a login, and we keep no visitor profiles.

Children's privacy

This site is not directed at children under 13 and we do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us and we will delete it.

Your rights

If you want to know what we know about you: practically nothing. No per-visitor query history, no profile — the only lookup data we keep is an aggregate count per item looked up, which carries nothing that identifies you (see "Tools that use our API" above). If you're concerned about data Cloudflare or Google hold about your visit, you can contact those providers directly — they're the data processors for infrastructure logs and ad serving respectively.

For any other privacy question or concern, email contact@networklookup.com or use our contact page.

Changes to this policy

We'll update this policy if our data practices change — when new tools or data sources are added, if we introduce user accounts, when advertising or analytics arrangements change, or when legal requirements change. The "last updated" date at the top reflects the most recent revision.