An IPv6 leak test checks whether your real IPv6 address is visible while your VPN is on. If a website still sees the IPv6 address from your ISP, your VPN only protects IPv4 traffic and your IPv6 traffic leaks past the tunnel. Below you learn what IPv6 is, why it matters for privacy, how to run an IPv6 leak test and how to fix an IPv6 leak. For the overview of where IPv6 leaks fit among DNS, WebRTC and other privacy threats, see our online privacy check.

What is IPv6 and why does it matter for privacy?

IPv6 (Internet Protocol version 6) is the successor to IPv4 and was designed to solve the address shortage. IPv6 addresses are 128 bits long, which gives 2^128 possible addresses, about 340 undecillion (3.4 × 10^38). That is enough for every device on the planet to get many addresses of its own. IPv4, in contrast, has only 32-bit addresses.

From a privacy view, IPv6 brings a real concern: some IPv6 addresses can be tied to your hardware. IPv4 addresses are often shared by many devices behind a router (NAT) or by many customers at the ISP. Some IPv6 configurations, however, build the address from your device's MAC address (the older EUI-64 method) or use a stable identifier that can follow you across networks. The IETF now recommends against embedding the MAC address and describes temporary, changing addresses to limit tracking.

AspectIPv4IPv6
Address length32 bits128 bits
Typical sharingOften shared behind NATOften one or more addresses per device
Tracking riskIP points to a household or ISP poolAddress can point to a single device; risk drops with temporary addresses
VPN supportSupported by all VPNsNot every VPN tunnels IPv6

What is an IPv6 leak?

An IPv6 leak occurs when your VPN tunnels IPv4 traffic but does not tunnel IPv6 traffic. Your device keeps sending IPv6 traffic directly through your ISP, past the VPN tunnel. The result: your real IPv6 address is visible to any website that checks for it.

Modern systems usually prefer IPv6 when both work. Windows, for example, favors IPv6 global addresses over IPv4 by default. So if your ISP offers IPv6 and your VPN ignores it, many connections take the IPv6 path outside the tunnel. An IPv6 leak often comes with an IPv6 DNS leak: your DNS queries go to your ISP's IPv6 DNS server. Our DNS leak test guide explains how to check that.

How to run an IPv6 leak test

Use SpeedIQ's built-in IPv6 check. Connect to your VPN, then run the test. If your real IPv6 address appears, you have a leak.

  1. Without VPN: run the IPv6 check and note your IPv6 address. If no IPv6 address appears, your network has no IPv6 and an IPv6 leak is not possible right now.
  2. With VPN: connect, then run the check again.
  3. Compare: the same IPv6 address as before means an IPv6 leak. An IPv6 address from your VPN provider, or no IPv6 at all, means the VPN handles or blocks IPv6.

Technically, the SpeedIQ IPv6 check asks icanhazip.com over IPv6 which address it sees. The result stays in your browser. For a complete picture, also run a WebRTC leak check, because WebRTC can expose IPv6 addresses even when normal web traffic does not.

How to fix an IPv6 leak

The best fix is a VPN that tunnels or blocks IPv6; disabling IPv6 on the device is a fallback.

  • Enable IPv6 leak protection in your VPN: most reputable VPN clients have an option that blocks IPv6 while connected.
  • Use a VPN that supports IPv6 tunneling: some VPNs route IPv6 traffic through the VPN tunnel, which prevents leaks entirely and keeps IPv6 working.
  • Disable IPv6 on your device: on Windows, open the network adapter settings and uncheck "Internet Protocol Version 6 (TCP/IPv6)". On macOS, open System Settings → Network → Details → TCP/IP and set "Configure IPv6" to "Link-Local Only", or run networksetup -setv6off Wi-Fi in Terminal.

A warning for Windows: Microsoft does not recommend disabling or unbinding IPv6, because some Windows components may stop working. It recommends setting Windows to prefer IPv4 over IPv6 instead. Use device-level changes only if your VPN offers no IPv6 leak protection, and test again afterwards.

Summary: what should you do after an IPv6 leak test?

If the test shows your real IPv6 address with the VPN on, turn on IPv6 leak protection or switch to a VPN that tunnels IPv6. Then repeat the IPv6 leak test, the DNS leak test and the WebRTC check.

Try it free: You can check for IPv6 leaks directly at SpeedIQ, with no account and no ads.

FAQ

How can I tell whether I have an IPv6 leak?

Run an IPv6 leak test without and with your VPN. If the same IPv6 address from your ISP shows up both times, your IPv6 traffic bypasses the VPN.

Are IPv6 leaks common?

They happen when a network offers IPv6 and the VPN only tunnels IPv4. Many VPN apps now block or tunnel IPv6, but manual setups and older apps often do not.

Do I need IPv6 for a VPN?

No. A VPN works fine over IPv4. What matters is that the VPN either tunnels IPv6 or blocks it, so no IPv6 traffic goes around the tunnel.

Can IPv6 be tracked?

Yes. A stable IPv6 address, especially one built from your MAC address, can identify your device across sites and networks. Temporary IPv6 addresses reduce this risk.

Should I disable IPv6 to stop leaks?

Only as a fallback. Microsoft does not recommend disabling IPv6 in Windows. Prefer the IPv6 leak protection of your VPN, or a VPN that tunnels IPv6.

Sources