Where am I(P)? · macOS menu bar

Is the VPN actually on? Now you can see it.

WhereAmIP shows the country your traffic really leaves from — and tells you the moment a VPN takes over, an IPv6 or DNS leak opens, or a connection that claims to be online isn't.

Install with Homebrew Download the app

$ brew install frinsen/tap/whereamip

Recommended. Builds from source on your Mac — no Gatekeeper warnings.

🇳🇱Wed 10:52

WhereAmIP v0.6

203.0.113.7⌘C

Amsterdam, Netherlands

Example VPN B.V.

IPv4: 203.0.113.7 (Amsterdam, NL)

IPv6: 2001:db8:4a::17 (Amsterdam, NL)

Since 01.09.26, 10:41:03

Checked: 01.09.26, 10:52:19

VPN: WireGuard (utun4) owns default route

DNS: 10.2.0.1 (+1 more)›

Copy Diagnostics⌘D

Refresh⌘R

WhereAmIP Help⌘?

Settings›

Quit WhereAmIP⌘Q

Menu bar style

Emoji flag, monochrome ISO code (the readable choice at 16 px), or a crisp flag image — your pick in Settings. Try the switch: the menu bar item above follows.

What it tells you

Truth about your connection, not interface status.

Every row in the dropdown answers a question you'd otherwise open three terminals for.

Route

Which VPN really owns your traffic

Named from the routing table and the network service the client registers — not from which apps happen to be running. A tunnel it can't identify says VPN (utun4), never a guessed brand.

Leak

IPv6 leaking past your VPN

IPv4 and IPv6 exits are measured independently. When the VPN carries v4 but v6 still leaves through your home ISP, you see it everywhere: badge, dropdown, notification, CLI. Found in the field, not in theory.

DNS

Who actually answers your DNS

Configured resolvers above, the servers that really answered below — operator, location, transport. A round of six cache-busting lookups finds all of a load-balanced pool, not just one member.

Reachability

Online for real, not "Wi-Fi connected"

A real probe, not interface flags. When a stale VPN leaves the network "up" but nothing loads, the flag turns into ❌ and the dropdown names the leftover routes causing it.

Copy

Paste-ready diagnostics

⌘C the exit IP, ⌥⌘C both addresses, ⌘D the whole dropdown as plain text — warnings included — for a bug report. The CLI prints the same: whereamip diagnostics.

Private Relay

Knows where Safari exits

iCloud Private Relay carries Safari through Apple's relay while other apps take the system route. WhereAmIP detects the split and shows both exits, so a "different location in Safari" stops being a mystery.

In the menu bar

One glyph. Five things it can tell you.

The menu bar item is the product. Pick a style in Settings; the offline and leak states show up on top of whichever you chose.

DEThu 13:04

ISO codeMonochrome, readable at 16 px, blends in with the system items.

🇩🇪Thu 13:04

Emoji flagThe default. Instantly readable in a crowded bar.

Thu 13:04

Flag imageCrisp PNG flags for people who find emoji flags too small.

Thu 13:04

No internetWi-Fi says connected, the reachability probe says no.

⚠️Thu 13:04

LeakA badge on any style when IPv6 or DNS leaves outside the tunnel.

⚠️Thu 15:44

VPN active, IPv6 leaking. The warning row names the provider your v6 traffic still exits through, and the badge stays in the bar until it stops.

🇩🇪Thu 13:05

Everything configurable lives in one submenu. Three menu bar styles, two languages, five toggles, both windows on demand.

🇩🇪Thu 13:04

The DNS submenu separates what is configured from who actually answered. Here the router forwards to Quad9, and the submenu says so instead of guessing.

Install

Installed in under a minute.

# tap, trust the tap once, install
brew tap frinsen/tap
brew trust frinsen/tap
brew install whereamip

# start it — then turn on Settings ▸ Launch at Login
open "$(brew --prefix)/opt/whereamip/libexec/WhereAmIP.app"

Recommended. Built from source on your Mac (Xcode command line tools required) — no unsigned-binary warnings, no Gatekeeper dance. Updates: the dropdown offers brew update && brew upgrade whereamip the moment a release is out, and relaunches you into it with one click.

# the port is in the MacPorts tree
sudo port install whereamip

# start it — then turn on Settings ▸ Launch at Login
open /Applications/MacPorts/WhereAmIP.app

For Macs without Homebrew. The app lands in /Applications/MacPorts, the CLI in your port prefix. Builds from source through MacPorts, which needs a full Xcode for SwiftPM ports. Updates: the dropdown copies the matching port upgrade command for you.

Prefer a download?

Every release ships WhereAmIP.app.zip on the releases page. It is unsigned — after unzipping, right-click → Open, or clear the quarantine flag:

xattr -d com.apple.quarantine WhereAmIP.app

Updates are manual on this path; the app's update row opens the releases page for you.

Command line, too

Everything the menu bar shows, as text or JSON — see the command line section below.

Command line

The same answers, scriptable.

The app and the whereamip CLI share one core, so a script never sees a different answer than the menu bar shows. Text for humans, JSON for everything else.

whereamip status — exit, city, provider, the interface that owns the route, resolvers and their egress, both address families. Add --json for machines.
whereamip watch — one new line whenever the exit IP, the route or connectivity changes. Pipe --json into a file and you have the history the app deliberately does not keep.
whereamip diagnostics — the paste-ready report, byte-for-byte what ⌘D copies in the app: exit, route, DNS, and every warning the dropdown shows.
whereamip config — the app's settings from the shell: display style, notifications, update and DNS checks, language.
whereamip debug — live-stream the app's diagnostic log. Nothing is written to disk.

Installed alongside the app by Homebrew and MacPorts. Output stays English by design: it is an interface for scripts and bug reports. Sample addresses are documentation ranges.

zsh — whereamip

$ whereamip status
🇩🇪 203.0.113.7  Berlin, DE
   Example Telekom GmbH
route: Wi-Fi (en0)
dns: 192.168.178.1 +1
   egress: 198.51.100.53 (Example DNS)
IPv4: 203.0.113.7 (Berlin, DE)
IPv6: 2001:db8:a4d::484d (Berlin, DE)

$ whereamip status --json | jq -r .exit.countryCode
DE

$ whereamip watch --json >> ~/exits.jsonl   # your own history, if you want one

$ whereamip diagnostics
WhereAmIP 0.6 — checked 03.09.26, 11:43:57
Warning IPv6 leak — v6 exits via Example Telekom GmbH (DE)
Exit    203.0.113.7 · Amsterdam, NL · Example VPN B.V.
IPv6    2001:db8:a4d::484d · Berlin, DE · Example Telekom GmbH
Route   WireGuard (utun4) owns default route
DNS     10.64.0.1 (utun4)
Egress  198.51.100.53 · Example VPN B.V. (Amsterdam, NL) · UDP

$ whereamip config set dns false     # same toggle as Settings

First start

A welcome that says what it is — and a What's New that says what changed.

Two explicit windows, both reachable from Settings any time. No permission prompts unless you flip a toggle yourself.

WhereAmIP

Getting Started

WhereAmIP v0.6

WhereAmIP lives in your menu bar and shows the country flag of your real internet exit. The flag flips the moment a VPN takes over your default route, and warns you about IPv6 leaks, DNS leaks, and connections that claim to be online but aren't.

Your setup

Launch at Login

Add to Applications folder

Show Notifications

Done

WhereAmIP

What's New

WhereAmIP v0.6

What's New is one click away. Two explicit Settings entries, both windows redesigned.

The update row knows how you installed WhereAmIP. Homebrew, MacPorts, or a downloaded zip.

Installing on older Xcode works again.

Your setup

Launch at Login

Show Notifications

Done

Privacy

Your data stays yours.

No tracking, no analytics, no history, no log files. Nothing is written to disk except your preferences.
The only network requests are the documented lookups needed to answer "where do I exit right now" — keyless public geo APIs, a reachability probe, the Private Relay check, stack-pinned IPv4/IPv6 lookups, and the optional DNS check (config set dns false turns it off entirely).
A daily-ish version check against GitHub Releases shows an update row — it never downloads or installs anything; your package manager does. config set updates false silences it.
Diagnostics go to your clipboard, and only when you press ⌘D. Nothing leaves your Mac on its own.
Open source, MIT. Read it: github.com/frinsen/whereamip.

FAQ

Questions people actually ask.

How do I show my public IP address in the macOS menu bar?

Install WhereAmIP. The menu bar shows the flag of the country your traffic exits from (or the ISO code, or a flag image, your choice). Click it for your public IPv4 and IPv6 addresses, city, ISP and the VPN that owns the route. One click copies the address.

How can I tell if my VPN is actually working on a Mac?

Watch the flag. It flips the moment a VPN takes over your default route, because WhereAmIP measures the real exit rather than trusting the VPN app's status. If your VPN says Connected but the flag still shows your home country, your traffic is not going through the tunnel. The dropdown also names the VPN that owns the route.

Is there an IPv6 leak test for macOS that runs all the time?

Yes. Every refresh looks up the IPv4 and IPv6 exits independently. When IPv6 leaves your Mac outside the tunnel while IPv4 goes through the VPN, the dropdown shows an IPv6 leak warning with both exits, and Copy Diagnostics includes it.

How do I check for DNS leaks on macOS?

Open the DNS submenu. It lists the resolvers configured on your Mac and, separately, the resolver addresses that actually answered a set of cache-busting lookups. A resolver answering from outside your VPN is flagged as a leak. The check can be switched off in Settings.

Does it work with WireGuard, Tailscale, OpenVPN, Cloudflare WARP or NordVPN?

It works with any VPN that takes your default route, including WireGuard, OpenVPN, IKEv2, Tailscale exit nodes and Cloudflare WARP. The name comes from the routing table and the network service the client registers, not from a list of apps, so unknown clients still show up as VPN (utunX) with the correct exit.

Is WhereAmIP free?

Free and open source under the MIT license. No account, no Apple ID, no subscription, no ads, no tracking. Install with Homebrew or MacPorts, or download the zip from GitHub.

Is my VPN actually working?

Look at the flag. The moment a VPN takes over your default route, the flag flips, and the dropdown names the VPN that owns the route — based on the routing table, not on which apps are running.

Why does my VPN show as "VPN (utun4)" instead of its name?

Because WhereAmIP would rather say less than say something wrong. Any VPN that registers a macOS network service is named automatically; a few are recognised by fingerprint on top (Tailscale, Cloudflare WARP, OpenVPN, and the common commercial clients). Some tunnels register no name anywhere — those get the honest generic label. Press ⌘D: the report says why naming failed, which is exactly what an issue needs to add yours.

Am I connected to the internet right now?

WhereAmIP probes real reachability instead of trusting Wi-Fi status. If the network looks up but nothing loads — a classic stale-VPN symptom — the flag becomes an offline symbol, and if leftover OpenVPN hijack routes are the cause, the dropdown says so.

Why does Safari show a different location than my other apps?

That's iCloud Private Relay carrying Safari through Apple's relay while everything else takes the system route. WhereAmIP detects the split and shows both exits.

brew upgrade says "already installed" but there is a newer version?

Your tap clone is stale — Homebrew's API mode refreshes its own data, not third-party tap clones. Run brew update && brew upgrade whereamip; that is exactly what the dropdown's update row copies for you.

Does it phone home?

No. No accounts, no API keys, no tracking — see Privacy above for the complete list of requests it does make, and the switches that turn the optional ones off.

How do I attach useful logs to a bug report?

⌘D in the dropdown (or whereamip diagnostics) copies a compact report of everything the app currently sees, warnings included. For a live trace, whereamip debug streams the diagnostic log — nothing is written to disk before or after.