IPv6

The older form ran out of addresses years ago, and the newer one has enough that a single customer can be handed a whole block. Which form you leave through changes what a site can join together.

IPv6 is the newer form of internet address, written as groups of hexadecimal digits separated by colons.

What the newer address looks like

The older form is four numbers with dots between them. The newer one is eight groups of hexadecimal digits with colons between them, and a run of zeroes is collapsed to a double colon.

That is why an address in the newer form is written inside square brackets whenever a port follows it. Without the brackets nothing can tell where the address stops and the port starts.

Why both forms are still around

Sites and proxy sellers still deliver mostly the older form, because everything understands it. The newer form is switched on alongside it rather than instead of it.

So a machine usually has both, and the two are separate addresses. A site that sees one today and the other tomorrow sees two visitors unless something else ties them together.

What a profile accepts

The connection fields of a profile take an address in the newer form when it is written in brackets, with the port in its own field. A launch builds one rule from it that covers every scheme.

An address written without brackets is refused instead. A launch that cannot build a usable rule stops rather than quietly going out on your own address.

What a leak check has to catch

A browser hands out candidate addresses during call setup, and some of them are in the newer form. A local one starting fd or fe80 is your own network and belongs in the verdict.

The empty address is a placeholder rather than a leak, so it is not counted. Counting it would make the check cry wolf on a machine that is behaving correctly.

Often confused with

IPv4
The older form. Both are addresses, both are read the same way by a site, and a machine with both has two of them at once.
A hidden local address
A browser often replaces a local address with an invented name ending in local. It changes, so nothing can be linked by it.
DNS
That is the question of which address a name has. The form of the answer and the path the question took are separate problems.

What this does not do

A pasted seller list in the newer form is not read. The import reads an address and a port split by a colon, and an address full of colons is named as unreadable rather than guessed at.
Nothing in the app switches your machine between the two forms. A profile leaves through whatever its proxy gives it, and everything outside a profile is unchanged.
The app does not tell you which form your exit uses. The check shows the address that came back, and reading its shape is left to you.
It does not change how a site treats the two. Some weigh them differently, and that decision is made on their side.

Check it

What is accepted, what is refused and what a leak verdict counts.

A bracketed address passes and a bare one is refused: apps/desktop/src/main/main.js
A bracketed target is split back into address and port: apps/desktop/src/lib/proxyAuthBridge.js · apps/desktop/test/proxy-auth-bridge.js
A local address counts and the empty placeholder does not: apps/desktop/test/leak-verdict.js
The check on this site reads what the browser hands out: apps/web/components/tools/LeakCheck.tsx

Questions

Can I use a proxy on an address in the newer form?: Yes, typed into the connection fields of a profile with the address in brackets and the port separate. Pasting a list of them into the import is not supported.
Is the newer form safer?: No. It is an address either way. The one real difference is that a block is often larger per customer, so fewer strangers share your address.
Can a site link my two addresses?: It can, if it sees both from the same session or the same account. They are separate addresses, and being separate is not the same as being unrelated.
Does the leak check see addresses in the newer form?: Yes. A local one is named as local in the verdict, and the empty placeholder is not counted as an address at all.
My proxy is in the newer form and the launch refuses.: Check the brackets around the address and the port in its own field. Refusing is the deliberate answer when a rule cannot be built, because the alternative is going out on your own address.

Next to this

See what your browser hands out

The leak check runs in the page you are on and nothing leaves your machine.

Download ARMANOS Leak check