WebRTC Leak Test
WebRTC lets browsers make video calls and peer-to-peer connections, and to do that it discovers your network addresses. A page can read those addresses with a few lines of JavaScript, which can reveal your real IP address even when you use a VPN. This test shows exactly what your browser exposes.
Press Start leak test to see which IP addresses your browser reveals through WebRTC.
Addresses found in ICE candidates
| Address | What it is | Candidate | Protocol / port |
|---|---|---|---|
| No test run yet. | |||
Raw ICE candidates
–
How to use the WebRTC Leak Test
- Connect your VPN (or leave it off to see your normal exposure).
- Press Start leak test. The browser gathers WebRTC candidates for a few seconds.
- Read the verdict: it compares the public IP found through WebRTC with the IP that websites see.
- Check the address table for local network and IPv6 addresses that are exposed.
- If it leaks, enable your VPN's WebRTC protection or change the browser setting described below, then run the test again.
Reading the results
| What you see | Meaning | Action |
|---|---|---|
| Public IP via WebRTC matches the IP websites see | No leak. WebRTC reveals nothing new. | None needed. |
| Public IP via WebRTC differs from the IP websites see | Leak. Your real ISP address is visible while the VPN hides it from normal traffic. | Enable WebRTC leak protection (see below). |
| Private address like 192.168.x.x, 10.x.x.x or fd00:: | Your local network address is exposed. Minor, but adds to your fingerprint. | Update the browser; modern versions hide it with mDNS. |
| Random name ending in .local | mDNS protection is working: the local address is hidden. | None needed. |
| No addresses at all | WebRTC is disabled or blocked. | None, but video calls in the browser may not work. |
How to fix a WebRTC leak
- VPN app or extension: most VPN browser extensions have a "WebRTC leak protection" or "Block WebRTC" switch. The desktop app alone may not cover the browser.
- Firefox: open
about:configand setmedia.peerconnection.enabledtofalseto switch WebRTC off, or setmedia.peerconnection.ice.default_address_onlytotrueto only use the default route. - Brave: Settings → Privacy and security → WebRTC IP handling policy → "Disable non-proxied UDP".
- Chrome and Edge: there is no built-in switch; use a trusted extension that sets the WebRTC IP handling policy to "default public interface only" or "disable non-proxied UDP".
- IPv6: if only the IPv6 address leaks, turn on IPv6 leak protection in the VPN or disable IPv6 on the network adapter while connected.
After changing a setting, reload this page and run the test again. Then check your browser fingerprint too: a VPN hides your IP address but not your device characteristics.
Why WebRTC needs your IP address
WebRTC is the technology behind browser video calls, screen sharing and peer-to-peer file transfer. To connect two devices directly it uses the ICE protocol: each browser lists its possible addresses as "candidates". Host candidates come from the network adapters, server-reflexive candidates are obtained by asking a STUN server "what address do you see me as?". Because the STUN request is sent over UDP outside the normal HTTP connection, some VPN and proxy setups do not route it through the tunnel, and the real address appears.
Frequently asked questions
What is a WebRTC leak?
A WebRTC leak happens when a website uses the browser's WebRTC API to discover your IP address through a STUN server, bypassing the VPN tunnel or proxy that normal web traffic goes through. The site then sees your real public IP address or your local network address, even though your VPN is connected.
How does this test work?
The page creates an RTCPeerConnection with Google's public STUN server (stun.l.google.com:19302), starts gathering ICE candidates and reads the addresses in them. Host candidates contain local addresses; server-reflexive (srflx) candidates contain the public address the STUN server saw. It then compares these with the address returned by the ipify API, which is what normal websites see.
My local IP shows as a long .local name. Is that bad?
No, that is a privacy protection. Modern Chrome, Edge, Safari and Firefox replace your local IP address with a random mDNS hostname ending in .local, so sites cannot read your LAN address. It only matters if the real address (for example 192.168.1.20) is shown.
The test shows my real IP but I am not using a VPN. Is that a leak?
No. Without a VPN or proxy every website already sees your public IP, so WebRTC exposing the same address reveals nothing new. A leak only matters when you are trying to hide your IP and WebRTC shows a different address from the one websites see.
How do I stop WebRTC leaks?
Turn on the WebRTC leak protection in your VPN app or extension if it has one. In Firefox you can set media.peerconnection.enabled to false in about:config to disable WebRTC entirely. In Chrome and Edge, use an extension that sets the WebRTC IP handling policy to only use the proxied or default route. Brave has a WebRTC IP handling policy setting under Privacy and security.
Why do I see an IPv6 address?
If your internet provider supports IPv6 your device often has a public IPv6 address, and WebRTC can reveal it. Many VPNs only tunnel IPv4, so an IPv6 address that differs from what the VPN shows is a common leak. Check your VPN's IPv6 leak protection or disable IPv6 on the network adapter.
Is my data sent anywhere?
The STUN request goes to Google's public STUN server, which only replies with the address it saw, and one request goes to api.ipify.org to read the IP that websites see. You can untick the comparison option to skip that request. Nothing is stored or logged by this page.