Extract IP addresses from text
Paste a log line with 192.168.1.10, 10.0.0.25, 8.8.8.8 and 10.0.0.25 again, and all 4 come back in order, while 999.1.2.3 is skipped because no part may exceed 255. Nothing is looked up or contacted. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
The IPv4 address extractor turns unstructured text into a clean, ordered list of network addresses. Paste a server log, configuration fragment, incident note, command output, or support message and receive every valid dotted-decimal IPv4 occurrence plus a total count.
How valid IPv4 addresses are recognized
The extractor looks for dotted-decimal IPv4 notation: exactly four decimal octets separated by periods. Every octet must be an integer from 0 through 255, so common addresses such as 192.168.1.10, 10.0.0.25, and 8.8.8.8 pass, while 256.1.1.1 and 192.168.1 fail. Multi-digit octets with a leading zero are rejected because forms such as 010 have historically been interpreted as octal by some software and are not an unambiguous modern dotted-decimal representation.
Match boundaries matter as much as octet ranges. The scanner will not carve a plausible substring out of a longer malformed address, a five-part dotted sequence, or an identifier where letters or digits touch the candidate. Punctuation normally found around addresses in prose and logs—parentheses, commas, semicolons, quotes, and colons—does not prevent a match.
The algorithm performs a bounded linear scan and then validates the four small components of every candidate. It does not contact the address, ask DNS for a hostname, determine whether a range is public or private, or infer that an address is currently assigned. Those are separate network and classification tasks.
Reading the ordered extraction result
Send one field named text containing the log, configuration, note, or other plain-text material you want to scan. Repeated occurrences are deliberately retained. If a firewall address appears ten times in an incident log, ten entries can convey frequency and preserve the one-to-one relationship with the source; callers that need a unique inventory can deduplicate the returned array afterward.
Text with no valid address is still a successful extraction and returns an empty array with count zero. The source text is not echoed in the response, which keeps the result compact when scanning longer diagnostic output. Because no enrichment is attempted, the output contains only addresses and their count: there are no hostnames, countries, autonomous system numbers, risk scores, ports, or protocol guesses to become stale or introduce uncertainty.
Using extraction in logs, configs, and operations
During incident response, the ordered list can become the first input to a separate frequency count, allowlist comparison, or private-range classifier without asking an analyst to copy every address manually. Support teams can turn a customer note or command transcript into structured values that are easier to attach to a ticket. Security analysts can extract indicators from authorized evidence, then pass them through appropriate reputation or ownership tools under their own policies.
Remember that extraction is syntactic, not a trust decision: a matched address may be private, reserved, unreachable, spoofed in a log line, or merely included as an example. It also does not recognize IPv6, CIDR prefixes as whole objects, ports as separate fields, or hostnames. Keeping those concerns outside this capability makes behavior predictable and lets each downstream workflow choose the enrichment, filtering, authorization, and retention rules that actually fit its context.
FAQ
Does the extractor validate IPv4 octet ranges?
Yes. A match must contain exactly four decimal octets, and every octet must be between 0 and 255.
Are duplicate IP addresses removed?
No. Every occurrence is returned in source order. Deduplicate the array afterward if your workflow needs unique addresses.
Does it extract IPv6 addresses, ports, or CIDR blocks?
It extracts only the IPv4 address portion in valid dotted-decimal form. It does not extract IPv6 or return ports and CIDR prefixes as separate fields.
Does extraction check whether an address is reachable or public?
No. This is a deterministic syntax parser with no network access. Reachability, ownership, geolocation, and range classification require separate tools.
Why is an address with a leading zero, such as 010, rejected?
Because some software has historically read a part like 010 as an octal number, so its meaning is ambiguous. Only plain decimal parts from 0 to 255 count, which keeps every extracted address unmistakable.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/str/extract-ip-addresses \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"Proxy 192.168.1.10 forwarded to 10.0.0.25; health check: 8.8.8.8."}'const res = await fetch("https://api.kit.forhosting.com/str/extract-ip-addresses", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "Proxy 192.168.1.10 forwarded to 10.0.0.25; health check: 8.8.8.8."
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/str/extract-ip-addresses",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "Proxy 192.168.1.10 forwarded to 10.0.0.25; health check: 8.8.8.8."
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/str/extract-ip-addresses", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"Proxy 192.168.1.10 forwarded to 10.0.0.25; health check: 8.8.8.8."}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"Proxy 192.168.1.10 forwarded to 10.0.0.25; health check: 8.8.8.8."}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/str/extract-ip-addresses", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "Proxy 192.168.1.10 forwarded to 10.0.0.25; health check: 8.8.8.8."
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "str.extract_ip_addresses",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
The scanner validates each of the four octets, rejects misleading partial matches, and keeps duplicates when the same endpoint appears more than once.
How valid IPv4 addresses are recognized
This narrow contract is useful because the same input always returns the same JSON, regardless of connectivity, location, or the time at which the request runs.
Reading the ordered extraction result
A successful response contains ip_addresses, an array of matching strings in their original source order, and count, the number of array elements. Missing text, a non-string value, an empty string, or input beyond the documented size limit produces an invalid_input error, helping integrations distinguish a bad request from a valid document with no matches. For automated calls, the published API base is $0.002 per successful item, while the browser execution can use the same pure parsing logic locally.
Using extraction in logs, configs, and operations
Operations teams can paste reverse-proxy, load-balancer, SSH, firewall, and application logs to pull endpoints out of surrounding timestamps, request paths, status messages, and identifiers. Platform engineers can scan configuration reviews for hard-coded IPv4 endpoints before migrating services or rotating infrastructure.
Integration use cases
Pull endpoints from incident logs
Turn noisy proxy, firewall, or application output into an ordered IPv4 list for authorized investigation and follow-up analysis.
Find hard-coded configuration addresses
Scan configuration snippets and deployment notes for dotted-decimal endpoints before infrastructure changes or service migrations.
Structure support and QA evidence
Extract addresses from command transcripts and ticket notes into predictable JSON for tests, imports, and repeatable troubleshooting.
Technical questions
What happens when the text contains no IPv4 addresses?
The request succeeds with ip_addresses set to an empty array and count set to zero.