How to use WebRTC VPN & IP Leak Test
- Open the tool. Open this page in a browser with an internet connection.
- Run the check. Connect your VPN if used, then select Run leak test and wait for ICE gathering.
- Analyze the data. Review results and limitations, copy available data, and rerun after changing your network settings.
What is a WebRTC Leak and Why Does It Bypass VPNs?
The WebRTC protocol supports real-time audio, video, and data over a peer-to-peer connection. ICE candidates describe possible network paths. A STUN server helps discover the address assigned to outgoing traffic by NAT. This test opens a dummy data channel with Google STUN; it does not request your camera or microphone and closes the connection after gathering.
A VPN IP leak can occur when a browser uses a route outside the intended VPN tunnel. Browser-only proxies may cover HTTPS traffic without covering UDP used by STUN. Comparing the public web address with a different public ICE address can reveal a possible bypass, but dual-stack IPv4/IPv6 routing and multiple interfaces can also explain a mismatch.
Private IP vs public IP matters: local addresses such as 192.168.x.x are not globally routable. Modern browsers may replace local addresses with mDNS hostnames ending in .local. Neither a private address nor an mDNS name proves your ISP address leaked. Missing candidates can mean privacy protection, a blocked STUN server, or incomplete gathering; they do not certify VPN security. IP checks also do not prevent browser fingerprinting.
How to Fix and Block WebRTC Leaks in Your Browser
Chrome: 1. Use a system VPN that covers UDP and both IP families. 2. If needed, install a trusted WebRTC privacy extension with an IP-handling policy that disables non-proxied UDP; Chrome has no universal built-in WebRTC off switch. 3. Restart affected tabs and repeat the test. Restricting WebRTC may break calls or screen sharing.
Firefox: 1. Open about:config and acknowledge the advanced-settings notice. 2. Search for media.peerconnection.enabled and set it to false to disable WebRTC. 3. Reload this page and test again; restore true when you need WebRTC calls. Managed browsers or some mobile versions may restrict access to this preference.
Brave: 1. Open Settings and search for WebRTC IP Handling Policy. 2. Select Disable Non-Proxied UDP. 3. Reload tabs and rerun the test with your VPN connected. This restricts routing rather than proving all possible leaks are blocked. Check your VPN provider’s guidance if communication apps stop working.
What this network tool measures
Web route comparison
Compares the public lookup result with ICE candidates gathered through the browser WebRTC path.
Public versus local candidates
Labels observed addresses by routability and explains why private addresses and mDNS names are not proof of an ISP leak.
Inconclusive outcomes
Distinguishes a possible mismatch from a clean observation when STUN is blocked, gathering times out or address families differ.
When this check is useful
Test VPN configuration
Run the check after enabling a VPN and repeat it after changing split-tunnel or WebRTC routing settings.
Prepare for a browser call
Investigate unexpected candidate behavior before using a peer-to-peer application, without requesting camera or microphone access.
Explain a privacy result
Use the candidate list and limitations to report what the browser observed instead of claiming that every leak vector was ruled out.
Frequently Asked Questions
Does Incognito mode block WebRTC leaks?
No. Private browsing primarily separates browsing history and session storage. WebRTC can still gather network candidates, and extensions may be disabled in private windows unless explicitly allowed.
Can websites see my real IP with a VPN on?
Websites normally see your VPN exit address for tunneled traffic. Split tunneling, uncovered IPv6 routes, or non-proxied WebRTC traffic can expose another address. A mismatch is a reason to inspect routing, not proof of your identity or physical location.
Does a green result guarantee my VPN is secure?
No. Matching public addresses only mean this test observed no additional public address of the same family. DNS leaks, other applications, tracking cookies, and changing routes are outside the test.
Why does the test show an mDNS name instead of a local IP?
Modern browsers can replace local ICE addresses with a temporary .local mDNS hostname to reduce local-network exposure. That name is not a public ISP address and cannot by itself demonstrate a leak.
Why is the result inconclusive when my VPN is connected?
A blocked STUN request, timeout, mixed IPv4 and IPv6 routes or browser privacy settings can prevent a reliable comparison. Repeat the test and inspect the VPN and browser routing policy rather than treating missing data as a clean result.
Do I need an internet connection, and are my inputs uploaded?
An internet connection is required. The site handshake sends a random challenge, not files or text inputs. Network diagnostics need external connections. IP checks contact Cloudflare and ipapi; DNS queries send the entered hostname to Cloudflare; WebRTC contacts Google STUN; latency probes contact the listed providers. Those services receive your connection address and may apply their own logging policies. Results are not saved by this tool.
Continue checking your network
Technical references: Cloudflare DNS JSON, ipapi fields, WebRTC candidate addresses, Brave IP handling.