WebRTC leak test
WebRTC can reveal IP addresses your browser knows about — sometimes bypassing a VPN. This test runs entirely in your browser and shows exactly what WebRTC exposes.
Detected candidates
| Address | Type | Assessment |
|---|---|---|
| Gathering ICE candidates… | ||
What is a WebRTC leak?
WebRTC (Web Real-Time Communication) powers in-browser video calls and peer-to-peer transfers. To connect two peers directly it gathers ICE candidates — the IP addresses your machine can be reached on, including local network addresses and, via a STUN server, your public address. A website can read these with JavaScript, which means a poorly configured VPN can be bypassed and your real IP exposed even while the rest of your traffic is tunnelled.
Reading your results
- Local/private addresses (10.x, 172.16–31.x, 192.168.x, or an
.localmDNS name) stay on your network — modern browsers hide the real one behind a random mDNS hostname, which is good. - A public address that matches the one at the top is normal without a VPN. If you are on a VPN and it matches your real ISP address, that's a leak.
- No candidates means WebRTC is blocked or disabled — the strongest privacy posture.
How to fix a WebRTC leak
- Use a VPN that explicitly offers WebRTC leak protection.
- Install an extension such as uBlock Origin (it can block WebRTC) or a dedicated WebRTC-blocker.
- In Firefox, set
media.peerconnection.enabledtofalseinabout:config. - Re-run this test after each change to confirm.
Frequently Asked Questions
Does a WebRTC leak mean my VPN is broken?
Not entirely — your traffic may still be encrypted. But if WebRTC exposes your real public IP while connected to a VPN, websites can de-anonymise you, defeating the purpose. Fix it before relying on the VPN.
Why do I only see a weird .local address?
That's mDNS obfuscation. Chrome and Firefox now replace your real local IP with a random .local hostname so sites can't fingerprint your internal network. It's working as intended.
Is this test safe and private?
Yes. The whole test runs in your browser using a public Google STUN server only to discover candidates. Nothing is sent to or stored on our servers.