Stable IPv6 privacy addresses keep a consistent interface identifier within the relevant network context. Temporary addresses replace their identifiers over time. Both methods avoid relying on a permanently exposed hardware identifier, but a stable identifier can link traffic to the same device for longer.

A device can use both kinds on one interface. It may retain a stable address, have a preferred temporary address for new communication, and keep an older temporary address valid for existing connections. That combination is not evidence that the device has been configured incorrectly.

“Privacy” describes the way an identifier is generated and used. It does not turn an otherwise globally routed IPv6 prefix into a private network, conceal every connection, or guarantee anonymity.

Stable Identifiers Depend on Their Network Context

An IPv6 address contains a network prefix and an interface identifier. A stable opaque identifier does not directly encode a hardware address. Its generation uses the prefix, an interface-specific value, a secret key, and a collision counter. An optional network identifier can further distinguish network contexts.

The result is reproducible when the relevant inputs remain the same. Changing the prefix normally changes the identifier rather than carrying one hardware-derived suffix from network to network. This reduces a particular form of tracking across networks.

Stable does not mean a universal, permanent address. The prefix is still part of the full address, and the address still has configuration lifetimes. If the network prefix changes, DNS records and services using the old address may need to be updated even if the device keeps the same address-generation method.

Recommendations for stable addresses formed through Stateless Address Autoconfiguration (SLAAC) favor opaque generation over embedding a stable link-layer address. This is separate from using temporary addresses: improving the stable identifier does not require removing the rotating address mechanism.

Temporary Addresses Change the Identifier over Time

A temporary address combines the advertised prefix with a randomized identifier and has limited preferred and valid lifetimes. The host generates replacements over time, normally beginning regeneration shortly before the preceding address becomes deprecated.

A host does not necessarily generate a new temporary address for each connection. Several connections can use one preferred temporary address, and existing communication can overlap with the availability of its replacement. The operating system's policy and the address's lifetime matter more than the number of browser tabs opened.

For a new temporary address, the applicable lifetime is limited by both the advertised prefix lifetime and the host's temporary-address policy. Later router advertisements cannot extend a temporary address beyond the maximum age allowed by the host's policy. Changing the suffix also cannot extend a prefix the network has withdrawn.

Both stable and temporary identifiers can look random. A stable identifier remains consistent while its inputs stay the same, whereas a temporary identifier is replaced over time. You cannot distinguish the two methods from the appearance of an address alone.

Preferred and Valid Lifetimes

A preferred address can be selected for new communication. After its preferred lifetime ends, it is deprecated but can remain valid, allowing communication already using it to continue. Once the valid lifetime ends, it is no longer available for normal use.

The distinction allows an address replacement without requiring every existing connection to switch its local address at the same moment. Deprecation is not an instruction to instantly delete the address, and it is not a report of a duplicate-address conflict.

Both stable and temporary addresses can be preferred, deprecated, or invalid. A stable address becomes unusable when its valid lifetime expires, while a deprecated temporary address can remain usable until its valid lifetime ends.

An Example with Three Addresses on One Interface

Consider a hypothetical interface using the documentation prefix 2001:db8:95:30::/64. Assume its stable address remains preferred throughout this example. A temporary address created at 10:00 has a preferred period of 20 minutes and a valid period of 40 minutes; these illustrative periods are not suggested defaults.

  • Stable address: 2001:db8:95:30:1a62:54d3:aa70:992c.
  • First temporary address: 2001:db8:95:30:3927:61be:208a:47d0.
  • Replacement temporary address: 2001:db8:95:30:64aa:e152:330d:70b8.

Assume the replacement is created at 10:18, successfully completes its required checks, and receives the same illustrative lifetime lengths. At 10:19, both temporary addresses can be preferred during the brief transition. The stable address is also present; three address entries need not mean three devices.

At 10:21, the first temporary address is deprecated but valid until 10:40. The replacement remains preferred until 10:38 and valid until 10:58. New communication can favor the replacement, while an existing connection can still use the first address during its remaining valid period.

At 10:41, the first temporary address's valid period has ended. The replacement's preferred period has also ended by then, although it remains valid. This snapshot omits any further replacements deliberately to show the timers; a host maintaining temporary addressing would normally have continued its regeneration process.

All three full addresses share the same 64-bit network prefix and have different 64-bit identifiers. The host generated these addresses on one interface through SLAAC; a server did not assign three separate address leases.

Source Selection Depends on the Destination and Application

Having a temporary address does not guarantee that every packet uses it. Default IPv6 source selection considers scope, address state, the outgoing interface, and other rules. Its preference for temporary addresses applies within that selection process, rather than overriding all earlier suitability checks.

Applications can also request a different preference, and implementation or administrator policy can affect the outcome. An address appearing in the interface's configuration is therefore not necessarily the source address used for a particular connection.

In the example, a suitable new outbound connection may use the replacement temporary address. An application explicitly bound to the stable address can continue using that stable address instead. An existing connection can also keep using the first temporary address while new connections use its replacement.

The privacy methods are useful for clients starting outbound connections. A service accepting connections at a known address needs that address to remain valid and the service to keep listening on it. A stable opaque address can support that arrangement without embedding a hardware identifier, provided the network prefix and relevant lifetimes remain suitable.

Temporary addresses are not inherently unreachable from outside. Reaching a service still depends on routing, the address's validity, listening behavior, and access policy. An unpredictable suffix should not be treated as a replacement for controlling access to a service.

MAC Randomization Changes a Different Identifier

Media access control (MAC) address randomization changes the identifier used on a local link, particularly in Wi-Fi environments where nearby observers can monitor wireless traffic. IPv6 privacy addressing concerns an identifier inside an IP address. Changing one does not, by itself, establish that the other changed.

A local neighbor can associate an IP address with a MAC address through Neighbor Discovery. That association is maintained as network state rather than requiring the IP suffix to contain the MAC value. It explains why a network can communicate with an opaque IPv6 address without decoding its identifier into a hardware address.

A device's private Wi-Fi address setting does not, by itself, show whether its IPv6 source addresses rotate. An opaque IPv6 identifier also does not show whether the device randomizes its MAC address.

What Address Privacy Leaves Visible

A stable identifier can still allow correlation while it remains in use on the same network. Temporary addresses limit how long the same identifier is used, but the network prefix remains visible. An observer on the link, such as the local router, can still associate the host's different addresses.

Cookies, browser characteristics, account identifiers, and application behavior can also connect activity across address changes. For example, two connections made under the same authenticated account do not become unrelated account activity merely because their IPv6 source addresses differ.