WebRTC Leak Test

This test observes addresses exposed through WebRTC ICE candidates and compares public addresses with your HTTP connection. A public address or a mismatch alone does not prove that traffic bypassed a VPN.

What Is a WebRTC Leak?

WebRTC (Web Real-Time Communication) gathers network candidates for browser calls and other peer connections. A privacy leak can occur if candidates expose an address you intended to hide. STUN can reveal a public address, while TURN can relay traffic. Whether an address indicates VPN bypass depends on the browser, tunnel routing, and which address you expected; a public candidate alone is not proof.

How Does This WebRTC Leak Test Work?

We create a peer connection using your browser’s WebRTC API and gather ICE (Interactive Connectivity Establishment) candidates from public STUN servers. We compare observed public addresses with the address of your HTTP connection when available. Different addresses can reflect IPv4/IPv6 or multiple network routes. Confirming VPN bypass requires additional evidence, such as a known pre-VPN address and routing context.

How to Prevent WebRTC Leaks

Firefox: if you do not need WebRTC features, set media.peerconnection.enabled to false in about:config.
Chrome: review your VPN's documented WebRTC and UDP-routing controls, then test in the browser profile you use. Review permissions and maintenance before installing any extension.
Brave: go to Settings > Privacy > WebRTC and choose "Disable non-proxied UDP."
Tor Browser: WebRTC is fully disabled by default.

For browser-specific instructions, read our full guide: WebRTC Leaks Explained.

Related Tools & Guides

DNS Leak Test - check if your DNS queries leak outside your VPN tunnel.
IPv6 Leak Test - compare IPv6 request and DNS test-group observations.
IP Lookup - verify your public IP address and check geolocation data.
Privacy Browser Settings - review browser privacy controls and their tradeoffs.

Frequently Asked Questions

Does disabling WebRTC break video calls?

Fully disabling WebRTC can prevent browser-based calls and other features that depend on it. Browser candidate restrictions and VPN routing or firewall controls may limit address exposure while retaining some connectivity, but behavior varies. Follow the provider's documented settings and test both address exposure and the calls you need; a protection label is not a routing guarantee.

Why does this test show local IP addresses?

Local (private) IPs like 192.168.x.x or 10.x.x.x are gathered during WebRTC’s ICE candidate discovery. While these do not directly reveal your identity, they can leak information about your local network topology.

What are mDNS addresses?

Modern browsers replace local IPs with random mDNS hostnames (like “abcd-1234.local”) to reduce exposure of local network addresses. Seeing mDNS addresses does not prove that all WebRTC traffic is protected; blocked or unavailable STUN servers can also limit test results.