Description
You have a VPN on and assume you are in Tokyo, yet a site places you at home. The Wi-Fi icon is full but nothing loads. Safari goes through iCloud Private Relay while every other app does not, so the two see different IPs. WhereAmIP pins the answer to the macOS menu bar: the flag of the country your exit IP sits in. It flips the moment a VPN takes the default route, turns into ❌ when the internet is really unreachable, and it probes actual reachability rather than interface status.
The dropdown lists the public IP (click to copy), city, ISP, which VPN interface owns the default route and the exact time the current state began. It probes IPv4 and IPv6 exits separately, so when a VPN tunnels only v4 while v6 still leaves through the home ISP, a ⚠️ badge appears in the menu bar, a leak an ordinary what-is-my-IP page never shows. The DNS row expands into the resolvers macOS uses per interface, whether DoH or DoT is in force, and which resolvers actually handle your queries on the way out.
It is native AppKit with no third party runtime and no API keys, installed from source through Homebrew or MacPorts, and `whereamip status --json` hands the same data to scripts.
Menu bar flag: Shows the exit country as an emoji flag, an ISO code or a bitmap flag; switch to NL / LU when 🇳🇱 and 🇱🇺 are indistinguishable at 16 px.
Real reachability probe: Judges by whether traffic actually gets out, not by the interface saying connected, so it catches the connected but blackholed state.
Truthful VPN naming: Reads the VPN that owns the default route from the macOS network service it registers, for any client; Tailscale, Cloudflare WARP and OpenVPN get extra fingerprints, and unknown tunnels are shown honestly as VPN (utun4).
IPv6 leak detection: Probes the v4 and v6 exits independently and raises a warning in the menu bar, dropdown, notification and CLI when they genuinely differ.
DNS resolvers and leaks: Lists configured resolvers per interface and encrypted DNS status; an optional active check discovers every load balanced egress resolver and verifies queries exit through the VPN tunnel.
iCloud Private Relay awareness: Flags that Safari may exit somewhere your other apps do not.
One key diagnostics: ⌘C copies the exit IP, ⌥⌘C both addresses, ⌘D a full plain text diagnostics report ready for a bug report.
CLI: whereamip status, watch, diagnostics and config, with --json output.
Notifications and login item: Optional alerts on exit, route or connectivity changes, off by default; launch at login and a first start welcome window.
Quiet update hint: Checks the latest GitHub release a few times a day and offers the matching brew or port command in one dropdown row; the app never downloads or updates itself.
English and German UI: Menus and notifications follow the system language, switchable in Settings.
The dropdown lists the public IP (click to copy), city, ISP, which VPN interface owns the default route and the exact time the current state began. It probes IPv4 and IPv6 exits separately, so when a VPN tunnels only v4 while v6 still leaves through the home ISP, a ⚠️ badge appears in the menu bar, a leak an ordinary what-is-my-IP page never shows. The DNS row expands into the resolvers macOS uses per interface, whether DoH or DoT is in force, and which resolvers actually handle your queries on the way out.
It is native AppKit with no third party runtime and no API keys, installed from source through Homebrew or MacPorts, and `whereamip status --json` hands the same data to scripts.
Features
Menu bar flag: Shows the exit country as an emoji flag, an ISO code or a bitmap flag; switch to NL / LU when 🇳🇱 and 🇱🇺 are indistinguishable at 16 px.
Real reachability probe: Judges by whether traffic actually gets out, not by the interface saying connected, so it catches the connected but blackholed state.
Truthful VPN naming: Reads the VPN that owns the default route from the macOS network service it registers, for any client; Tailscale, Cloudflare WARP and OpenVPN get extra fingerprints, and unknown tunnels are shown honestly as VPN (utun4).
IPv6 leak detection: Probes the v4 and v6 exits independently and raises a warning in the menu bar, dropdown, notification and CLI when they genuinely differ.
DNS resolvers and leaks: Lists configured resolvers per interface and encrypted DNS status; an optional active check discovers every load balanced egress resolver and verifies queries exit through the VPN tunnel.
iCloud Private Relay awareness: Flags that Safari may exit somewhere your other apps do not.
One key diagnostics: ⌘C copies the exit IP, ⌥⌘C both addresses, ⌘D a full plain text diagnostics report ready for a bug report.
CLI: whereamip status, watch, diagnostics and config, with --json output.
Notifications and login item: Optional alerts on exit, route or connectivity changes, off by default; launch at login and a first start welcome window.
Quiet update hint: Checks the latest GitHub release a few times a day and offers the matching brew or port command in one dropdown row; the app never downloads or updates itself.
English and German UI: Menus and notifications follow the system language, switchable in Settings.
