a private IP address
A private IP address is one drawn from a set of address ranges reserved for use inside a local network, never on the public Internet. Think of office room extensions like 'ext. 204': they are perfectly clear inside the building, and the same extension number is reused in thousands of other buildings, because nobody outside ever dials it directly. Private addresses work the same way — many separate networks reuse the same numbers internally, and that is fine because they are not globally unique and not routed across the Internet.
Three IPv4 ranges are reserved for this (by the standard RFC 1918): 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. That is why almost every home router hands its devices addresses like 192.168.1.x or 10.0.0.x. Public Internet routers are configured to drop packets to or from these ranges, so a private address is meaningless outside its own network. To reach the wider Internet, a device with a private address must go through Network Address Translation (NAT), which swaps the private source address for a shared public one on the way out.
Besides these private blocks, IPv4 reserves several special addresses worth knowing: 127.0.0.0/8 (loopback, the host talking to itself, usually 127.0.0.1), 0.0.0.0 (this host / unspecified), the all-ones address as a broadcast, and 169.254.0.0/16 (link-local, auto-assigned when no DHCP server answers). A common misconception is that private addressing is a security feature — it is not. It conserves scarce public IPv4 addresses; the privacy of inside hosts is just an incidental side effect of NAT.
Your home laptop, your phone, and a friend's laptop across town may all carry 192.168.1.10 simultaneously — no conflict, because each lives behind its own router's NAT. The reuse only breaks if you try to route between two such networks (for example over a VPN) without renumbering.
The same private address is reused in countless networks because it never travels the public Internet.
Private addressing is not a firewall. NAT happens to hide inside hosts as a side effect, but it enforces no security policy; an exposed service or an outbound connection can still let attackers in.