WebRTC leak test: what the browser check sees
WebRTC is a set of browser features for audio, video, and direct data connections. To establish a peer-to-peer path, the browser gathers ICE candidates, which are possible routes to another participant. This WebRTC leak test creates a local data channel and asks a public STUN server for connectivity information. It shows the candidates exposed by the browser and compares public server-reflexive (srflx) candidates with the public IP this site sees in your HTTP request.
A host candidate may show a private local address, or the browser may replace it with an mDNS name ending in .local. That name prevents a remote website from seeing the local address; it is not a public IP leak. A server-reflexive candidate shows the public-facing address learned through STUN. Relay candidates indicate a TURN relay, if one is available. Browser versions and privacy settings vary, and some browsers hide or limit candidate details.
When a VPN changes the reported address
The page reports a VPN leak only if you check the box saying a VPN is connected and the browser exposes a public srflx address that differs from the address seen by this site. Without that box checked, a public candidate is expected to match the ordinary internet route and is simply reported. A mismatch may mean WebRTC used another network path. It can also result from multiple network interfaces, IPv4/IPv6 routing, proxy setup, or a changing address. Repeat the check with the VPN connected and compare both addresses with your VPN provider's guidance.
This browser-side WebRTC check does not test DNS leaks, assign an anonymity score, or guarantee that every site sees the same network identity. The STUN server receives standard connection information to answer the ICE request. The public IP comparison uses this site's same-origin address endpoint. The page does not upload or store the candidate list.
What to do if a WebRTC test shows an unexpected IP
Confirm the VPN is connected and that the visible public address changes when you turn it on. Update the browser, then review its WebRTC or IP handling settings. Chromium-based browsers and Firefox may offer privacy controls or reputable extensions that limit non-proxied UDP/WebRTC traffic. This can affect calls and conferencing. Follow your VPN provider's documented browser or system-level leak protection instead of installing several overlapping extensions. Re-run the test after each change, then check the services you use. Our VPN check guide covers other useful checks. The VPN and proxy differences guide explains why routes can differ.
Frequently asked questions
Are mDNS .local addresses a WebRTC leak?
No. They are local names used instead of exposing the device's private address to a remote peer.
Why does the result say no public candidates?
The browser, network, or privacy controls may hide candidates, STUN may be blocked, or the check may have timed out. It does not prove that every WebRTC path is protected.
Does this check DNS leaks?
No. It checks WebRTC ICE candidates only. DNS queries are outside this test.
Does this page send candidates to the site?
No. Candidate gathering and comparison run in your browser. The site supplies only the HTTP public-IP value; the selected STUN server sees its own ICE request.
More free tools: IP lookup · Blacklist check · Port checker · Speed test