Best Free IP Geolocation APIs in 2026: How to Choose
The best free IP geolocation API in 2026 is the one whose free allowance, response fields, licence terms and accuracy fit your workload, because free plans differ far more in their conditions than in the basic country and city data they return.
Rather than rank providers by figures that change every few months, this guide gives you the criteria to evaluate any of them against its current documentation, describes the two main architectures (hosted API and downloadable database), and states plainly what ipto does and does not offer. Treat any list that quotes exact rate limits for other vendors as a snapshot to verify.
Five questions that separate free tiers
Start by writing down your requirements, then check each provider against them.
- How big is the allowance, and in what unit? Per day, per month and per minute limits behave differently. Read the provider's current documentation for the exact terms and the behaviour at the limit.
- Is commercial use allowed? Some free plans are for testing or personal projects only. Check the terms before launching a product.
- Which fields are included? Country and city are common; ASN, organisation, timezone, currency and security flags (VPN, Tor, proxy, abuse) are sometimes reserved for paid plans.
- Is a key or signup required? Keyless access is faster to try, while keyed access may allow tracking of usage and sometimes higher limits.
- How fresh is the data, and how is it updated? Look for a stated refresh cadence for both the location and the threat data.
Beyond these, check IPv6 support, response latency from your region, and whether the provider documents how it handles addresses it cannot locate. For IPv6 specifics see why IPv6 geolocation accuracy lags.
Hosted API versus downloadable database
A hosted API is the quickest way to start: one HTTP request returns JSON, and the provider handles updates. The costs are a network round trip per lookup, a dependency on someone else's uptime, and the allowance limits discussed above. A downloadable database file turns lookups into local reads with no per-request limit, but you take on the work of downloading updates, loading them into memory or a datastore, and keeping them current. Licence terms for free databases usually require attribution or registration, and they may omit security data that hosted services include.
A common compromise is to start with a hosted API for prototyping and add local caching, then move high-volume paths to a self-hosted dataset if costs or latency demand it. Our post on self-hosted databases versus APIs covers that decision in more detail, and alternatives to MaxMind discusses the database side.
Accuracy: what to expect from any provider
Every provider is approximate at city level. Country-level answers are generally dependable, city-level answers frequently resolve to the nearest metropolitan area or the internet provider's point of presence, and VPN, corporate and mobile traffic can map to a place far from the user. Claims of a single accuracy percentage rarely come with a test method, so the reliable approach is to measure with your own traffic: take addresses for which you know the true location, such as delivery addresses on completed orders, and compare results from two or three candidates. Our explainer on why city accuracy is limited shows why differences between providers often come down to coverage of specific networks.
Where ipto fits
ipto is free with no signup and 1,000 free requests per day. The IP lookup returns country, city, ASN, organisation, currency_code and the flags is_vpn, is_tor, is_abuser, is_datacenter, bogon and bogon_type, all in the same response. Threat feeds refresh every 6 hours and IP and ASN datasets refresh daily. Honest limits: ipto does not detect residential proxies, city-level location is approximate, and the daily allowance is a real cap, so high-volume production traffic needs caching or a different architecture.
The quickest way to judge it is to try a few addresses. Run them through the VPN, Tor and proxy checker, inspect the network with the ASN lookup, check abuse status on the IP abuse checker, and read the request format in the API documentation. Then compare the same addresses on whatever other providers you are considering.
A short decision guide
If you only need a country code for a low-traffic site, nearly any free tier will do, so prioritise simplicity and licence terms. If you need security flags without paying, filter first by which providers include them in the free response, then by allowance. If you need very high volume or minimal latency, a local database with a refresh job is the better fit. And if you operate in a regulated setting, read the provider's privacy terms, along with our overview of IP addresses and GDPR, before sending visitor addresses to any third party.