What Is a Dedicated IP on a VPN? Uses, Costs and Privacy

A dedicated IP is a VPN address assigned to you alone. A standard VPN puts you behind a shared address used by many customers. A dedicated IP gives you the same address every time you connect. Allowlists, banks and CAPTCHA systems then see one consistent visitor. It costs extra as an add-on, and it costs you some privacy.

An IP address is the number that identifies your connection on the internet. An allowlist is a list of addresses that a system lets in. A CAPTCHA is a puzzle a site shows to check that you are human.

Shared, dedicated and static: three terms that get mixed up

Shared IP is the default on every consumer VPN. When you connect to a server, your traffic leaves it with the same public address as everyone else on that machine. That can be dozens or hundreds of people at a time. The crowd protects your privacy. A site that logs the address has no way to tell which customer did what. The crowd also causes problems. You inherit the reputation of everyone who used the address before you.

Dedicated IP means one address, one customer. It is almost always static as well, which means it does not change. VPN providers sell it as an add-on on top of a plan rather than including it. Six of the twelve providers in our data do:

• NordVPN
• Surfshark
• ExpressVPN
• CyberGhost
• Private Internet Access
• IPVanish, since 29 October 2026

Static IP means an address that does not change. That is not the same as one that is yours alone. Windscribe sells static IPs that are shared by a handful of users. Its knowledge base says it will not sell dedicated ones, because a single-user address is a big risk to the user’s anonymity. hide.me includes Fixed IP Address servers in its Premium plans. Its network page describes them as a pool of shared and fixed addresses rather than a personal one. When a provider says static, check whether anyone else is on it.

Our how a VPN works page explains how a VPN connection gives you an address. To check the address sites see right now, use our what is my IP tool.

When a dedicated IP helps

Allowlisted remote access. Company systems, a home server or a cloud firewall can be set to accept connections only from known addresses. A firewall is the part of a system that decides which traffic may come in. A shared VPN address cannot be allowlisted safely. Allowing it lets in every other customer on that server, and it changes from session to session anyway. A dedicated IP gives the administrator one address to approve. NordVPN’s page says admins often allowlist specific IP addresses for security. CyberGhost’s page lists IP-restricted network access as the thing a shared IP cannot do.

Fewer CAPTCHAs and blocks. Shared VPN addresses are busy. Some sites limit how many requests one address can make, or score addresses for risk. Those sites treat busy VPN addresses with suspicion. The result is the familiar run of verification puzzles. Sometimes a site blocks the address outright, because another user has abused it. A dedicated IP carries only your history. NordVPN lists fewer CAPTCHAs and a lower risk of blocklisting, which means landing on a list of blocked addresses. Surfshark says it helps you avoid human verification tests and the online actions of other users on a shared address.

Services that react to a changing location. Banks and payment systems flag accounts that appear in a different city at every login. A dedicated IP in one location looks like one customer in one place.

Reputation that depends on a consistent address. Any system that scores the sending address builds a history per IP. Mail servers and fraud filters are examples. On a shared address, that history belongs to everyone. On a dedicated one, it is yours to keep clean. There is a limit. A dedicated IP still sits in a VPN provider’s range of addresses. Some services class whole hosting ranges as VPN or data-center traffic, and they may treat it the same way. A dedicated IP is not a guarantee of access to streaming services, and we have not tested it for that.

Hosting and remote setups. CyberGhost markets its dedicated IP for game servers, remote access and compatible websites. At NordVPN, port forwarding is a different product. It is sold through a separate Dedicated Server add-on, not through the dedicated IP. Port forwarding lets other computers start a connection to your device.

What it costs you in privacy

A shared address protects you by hiding you in a crowd. A dedicated IP removes the crowd. Every request from that address comes from one person. A site that sees it on Monday and Thursday knows it is the same visitor without needing a cookie. A cookie is a small file a site stores in your browser to recognize you. Log into an account under your real name from the address once, and every other site that sees it can treat it as yours.

Surfshark says this on its own page. Its add-on is more closely linked to your individual account and to details like your email address. So, Surfshark says, it may offer less privacy than a shared IP.

The second question is whether the provider can link the address to your account. That decides what it could hand over to a court. Two providers in our data answer with a token design. A token is a code you enter in the app to claim the address.

CyberGhost issues a token that you redeem in its app. It says it pairs the address with a random token only you can generate, rather than linking it to your VPN account. It also says it does not need to know which dedicated IP is yours. Private Internet Access uses the same approach. It says that even it does not know which dedicated IP address belongs to which subscription.

Deloitte’s assurance engagements for both companies named the dedicated-IP token system in scope. An assurance engagement is an independent check of a company’s claims by an accounting firm. For CyberGhost, these took place in September 2022, March 2024 and December 2025. For PIA, they took place in April 2024 and December 2025.

Surfshark sells an anonymous Dedicated IP option, which its refund terms list as non-refundable. A token that only you hold has a downside: it cannot be recovered. CyberGhost says that if you lose it, the company cannot regenerate it and you need to buy another add-on.

Windscribe’s reason for refusing to sell one states the risk that the token designs try to manage. It says a dedicated IP used by one person could be traced to that person through a legal request. The company would then have to disclose what it holds. Its static IPs are shared by several users so that it cannot say which of them was using the address at a given time. Whether a provider keeps the records that could answer such a request is the subject of our no-logs explainer.

There are practical limits too. You pick one location and cannot move it after purchase. Surfshark, CyberGhost and PIA all say so on their pages. Surfshark also allows only one dedicated IP per subscription.

What it costs in money

Add-on prices are shown at checkout and change often. So our data records them only where an official page stated one. On 31 October 2026, CyberGhost’s checkout offered its Dedicated IP from $5 a month on top of a plan.

Windscribe’s static IPs are shared rather than dedicated. They cost $24 a year for a data-center address or $96 a year for a residential one. They are an annual extra on a Pro subscription. A residential address belongs to a home internet connection rather than a data center.

For the other sellers, our data has no price:

• NordVPN, Surfshark and PIA sell the dedicated IP as a paid add-on, with no price recorded in our data.
• ExpressVPN sells it as an add-on and includes it in its Express Pro tier.
• IPVanish launched its add-on on 29 October 2026 in New York, London, Paris, Frankfurt and Tokyo, without stating a price.

Our news report on the IPVanish launch covers what the announcement does and does not say. Plan prices and renewal terms for each provider are on their pricing pages, for example NordVPN’s and Surfshark’s.

Which VPNs offer a dedicated IP (verified 31 October 2026)

For most providers that do not sell one, the reason is privacy, not a missing feature. Mullvad, IVPN and Windscribe all build their services around not being able to say who used an address. Our privacy ranking explains how we weigh that, and the reviews hub links every provider’s record.

Related

• What is a VPN?
• How does a VPN work?
• What a no-logs policy really covers
• Split tunneling explained
• Best VPNs for privacy
• NordVPN review
• Surfshark review
• What is my IP?