What a WebRTC leak is and how this test finds one
WebRTC is the part of your browser that makes video calls, screen sharing and peer-to-peer file transfers work without plug-ins. To connect two browsers directly it has to discover every route to your machine, so it gathers ICE candidates: the addresses of your network interfaces (host candidates) and, by asking a STUN server “what address do you see me coming from?”, your public address (server-reflexive candidates). Any web page can start that process silently — no permission prompt — and read the results.
That is harmless until you use a VPN or proxy to hide your address. If the STUN request travels outside the tunnel, the server sees your real BT, Sky, Virgin Media or mobile IP and hands it to the page. That is a WebRTC leak.
This page runs the same gathering a tracking script would, against two independent STUN servers — Google’s stun.l.google.com:19302 and Cloudflare’s stun.cloudflare.com:3478. At the same time it asks an IPv4-only and an IPv6-only address service which addresses your browser uses for ordinary web traffic, plus our own edge function for the address and network of this very connection. Then it compares. Any public address WebRTC exposes that websites don’t see over HTTP is flagged as a leak, with the exact address in the verdict.
How to read the results
| You see | What it means |
|---|---|
| No leak — same IP as your VPN | Every public address WebRTC found matches what websites see. Your VPN covers WebRTC. |
| No leak — no public IP revealed | STUN was blocked or WebRTC is restricted. Also safe, though browser calls may struggle. |
| Leak | WebRTC reveals a public address that websites don’t see. With a VPN on, that is your real IP escaping. |
| IPv6 leak | Your VPN carries IPv4 but your IPv6 address goes straight out. Common with older VPN setups. |
| WebRTC disabled | No leak is possible, and in-browser video calls won’t work. |
Local addresses. Chrome, Edge, Firefox and Safari now hide your LAN address behind a random name ending in .local (mDNS), so the table normally shows “Hidden”. A visible 192.168.x.x or 10.x.x.x doesn’t identify you on the internet, but it adds to a browser fingerprint. Sites you have given camera or microphone permission see real local IPs — use the optional microphone run to see exactly that view.
Test without a VPN first: with no VPN there is nothing to leak past, so a matching result is expected. The test that matters is the second run with the VPN connected. For the address and provider websites see, use what is my IP.
How to fix a WebRTC or IPv6 leak
- Firefox: set
media.peerconnection.enabledto false inabout:configto switch WebRTC off entirely, or keep calls working withmedia.peerconnection.ice.default_address_onlyandmedia.peerconnection.ice.no_hostset to true. - Chrome and Edge: no built-in setting. Install Google’s WebRTC Network Limiter extension and choose “Use my proxy server (if present)”. Managed machines can use the
WebRtcIPHandlingpolicy. - Brave: Settings → Privacy and security → WebRTC IP handling policy → Disable non-proxied UDP.
- Opera: Settings → Advanced → Privacy & security → WebRTC → Disable non-proxied UDP — essential with Opera’s built-in browser VPN.
- Safari and every iPhone browser: local IPs are already protected; make sure your VPN is device-wide.
- Your VPN app: use the app rather than a browser extension, turn on the kill switch and IPv6 leak protection, and don’t split-tunnel your browser.
Phones are usually safe with a proper VPN app, because Android and iOS route all of the device’s traffic — UDP included — through the tunnel. Leaks are mostly a desktop problem, and most of all a browser-extension-VPN problem: an extension is a proxy for web pages, and WebRTC’s UDP traffic simply doesn’t use it.
What this test can’t tell you
DNS leaks. Testing those needs authoritative name servers that log which resolver looked up a one-off hostname. We don’t run any, so we don’t show a DNS result rather than invent one. Your VPN app’s DNS-leak protection setting is the fix either way, and DNS lookup shows what public resolvers return for a domain.
Relays aren’t VPNs. iCloud Private Relay hides your address from websites in Safari, but WebRTC’s UDP traffic goes direct, so a “leak” with Private Relay is expected. Chrome’s IP Protection only proxies selected third-party domains in Incognito. Cloudflare WARP in full mode behaves like a VPN.
Multiple public addresses. Some mobile networks and business connections use a pool of public addresses, so WebRTC can see a different one from the web without any VPN. Compare with the VPN off before worrying. Torrent clients and other apps are outside the browser and aren’t tested here.
What is contacted: the two STUN servers above, api4.ipify.org and api6.ipify.org (with icanhazip.com as fallback), and our own /api/ip edge function. Nothing is logged or stored. For browser details that sites read from your user agent, see the user agent parser.
Frequently asked questions
What is a WebRTC leak?
It is when a website uses your browser’s WebRTC feature to learn your real public IP address even though you are connected through a VPN or proxy. WebRTC asks a STUN server which address it sees you coming from; if that request bypasses the tunnel, the server reports your home or mobile address and the page can read it without any permission prompt.
Does a WebRTC leak mean my VPN is broken?
Not necessarily. Full-device VPN apps with a kill switch almost never leak. Leaks come mainly from browser-extension VPNs, which are proxies that only carry web pages, from split tunnelling, and from VPNs that tunnel IPv4 but leave IPv6 untouched. Turning on the app’s WebRTC or IPv6 leak protection, or restricting WebRTC in the browser, fixes it.
Why does the test show a .local address instead of my local IP?
Modern Chrome, Edge, Firefox and Safari replace your LAN address with a random multicast DNS name ending in .local, so pages can no longer read addresses like 192.168.1.20. Only sites you have granted camera or microphone access see the real one. The optional microphone run on this page shows that view, then releases the microphone immediately.
Should I disable WebRTC completely?
Only if you never make calls in the browser. Switching it off stops Google Meet, Teams on the web, Discord in the browser and similar tools from working. Restricting it is usually better: Brave and Opera can disable non-proxied UDP, Firefox can limit WebRTC to the default route, and Chrome can do the same through Google’s WebRTC Network Limiter extension.
Can this page test for DNS leaks?
No, and we say so rather than show a made-up result. A genuine DNS-leak test needs authoritative name servers that record which resolver looked up a random one-off hostname. We don’t operate those. Make sure DNS leak protection is enabled in your VPN app and that your IP address page shows the VPN’s network when connected.
Why does iCloud Private Relay show a leak?
Private Relay only covers Safari’s ordinary web traffic, not WebRTC’s UDP connections, so a STUN server still sees your real address. Apple designed it that way; it isn’t a fault. If you need your address hidden from WebRTC as well, use a full VPN, or a browser setting that blocks non-proxied UDP.