What Is WebRTC?

WebRTC (Web Real-Time Communication) is an open-source technology built into modern browsers. It enables real-time audio, video and data communication directly between browsers, without a plugin or third-party software. It powers video calls on Google Meet, voice chat in Discord's browser version and peer-to-peer file sharing tools. For the overview of where a WebRTC leak sits next to DNS, IPv6 and other privacy threats, see our online privacy check guide.

WebRTC is genuinely useful. But it has a serious privacy flaw: to set up a direct peer-to-peer connection, your browser must discover and share your IP addresses. Depending on your network and VPN setup, this can include your real public IP address, even while you are connected to a VPN.

What Is a WebRTC Leak?

A WebRTC leak occurs when your browser reveals your real IP address through WebRTC's ICE (Interactive Connectivity Establishment) protocol and bypasses your VPN tunnel. The website or peer you talk to, or any JavaScript running on the page, can read these IP addresses with simple browser APIs.

WebRTC leaks are dangerous because they are invisible. There is no error message, no warning and no indicator that your real IP is exposed.

Two kinds of addresses can leak:

  • Public IP address: the address your internet service provider (ISP) gives your router. This is the one a VPN should hide. It reveals your ISP and your rough location.
  • Local (private) IP address: the address of your device inside your home or office network, such as 192.168.x.x. It does not show your location, but it adds detail to your browser fingerprint.

How Does WebRTC Leak Your IP Address?

WebRTC leaks your IP address because ICE collects every usable network path before a call starts. The browser gathers "candidates" from three sources:

  1. Host candidates: the addresses of your own network interfaces, including local IPs.
  2. Server-reflexive candidates: your public IP as seen by a STUN server. The browser sends a small request to the STUN server, and the server replies with the address it saw.
  3. Relay candidates: addresses of a TURN relay server, used when no direct path works.

A web page can start this process without a call and without asking for camera or microphone access. It then reads the candidate list in JavaScript. The IETF standard on WebRTC IP handling (RFC 8828) names the main risk: with a split-tunnel VPN, WebRTC can discover not only the public address of the VPN, but also the public address from your ISP.

Does a VPN Stop WebRTC Leaks?

A VPN does not stop WebRTC leaks automatically. Whether your real IP leaks depends on how the VPN routes traffic and how your browser handles WebRTC:

  • Full-tunnel VPN: all traffic, including STUN requests, goes through the tunnel. The STUN server then sees the VPN IP, so the public address usually does not leak. Local IPs can still show.
  • Split-tunnel VPN: some traffic bypasses the tunnel. WebRTC may use the bypass route and reveal your ISP address (RFC 8828).
  • Browser-only VPN or proxy extension: a proxy usually carries only web traffic. WebRTC uses UDP, which can go around the proxy unless the browser forces it through.

The only reliable answer for your own setup is a WebRTC leak test with the VPN switched on.

How to Run a WebRTC Leak Test

A WebRTC leak test compares the IP addresses WebRTC exposes with the IP address your VPN should show. You can do it in under a minute:

  1. Note your real public IP with the VPN off. Use the IP Geolocation check on the SpeedIQ test page or read our IP address lookup guide.
  2. Connect your VPN and reload the page.
  3. Run the IP Geolocation check again. It should now show the VPN server's IP and location.
  4. Run the WebRTC Leak check.
  5. Compare. If any address in the WebRTC result matches your real public IP from step 1, you have a WebRTC leak.

How the SpeedIQ check works: it opens a WebRTC connection in your browser, asks Google's public STUN server (stun.l.google.com) for candidates, collects them for about five seconds and lists the IPv4 addresses it found. The result stays in your browser. The check shows IPv4 addresses only, so also run the IPv6 leak test to cover IPv6.

WebRTC resultWhat it meansWhat to do
Only the VPN IPNo public IP leakNothing; repeat after browser or VPN updates
VPN IP plus a local IP (192.168.x.x, 10.x.x.x)No public IP leak, but extra fingerprint dataOptional: restrict WebRTC to the public interface
Your real public IPWebRTC leakApply a fix below, then test again
No addressesWebRTC is blocked or disabledNothing; some video call sites may not work

How to Fix a WebRTC Leak

You fix a WebRTC leak by limiting which network interfaces WebRTC may use, or by turning WebRTC off. Chromium-based browsers such as Brave and Edge support the four WebRTC IP handling modes described in RFC 8828: all interfaces, default route plus local addresses, default route only, and force proxy (also called "disable non-proxied UDP").

Fix WebRTC Leaks in Chrome

  • Use a browser extension: extensions like "WebRTC Leak Prevent" can restrict how Chrome handles WebRTC IP exposure. Chrome has no built-in switch for this on desktop.
  • Switch to Brave: Brave has a built-in "WebRTC IP handling policy" setting. Search Settings for "webrtc" and choose "Disable non-proxied UDP".

Chrome on Android exposes your local IP address, and there is no setting to disable it (Mullvad, 2026).

Fix WebRTC Leaks in Firefox

Type about:config in the address bar, accept the warning, search for media.peerconnection.enabled and set it to false. This disables WebRTC completely. Set it back to true when you need a browser video call.

Fix WebRTC Leaks in Edge

Edge, like Chrome, works with a WebRTC extension from the extension store. On managed computers, an administrator can set the Edge policy WebRtcLocalhostIpHandling to "AllowPublicInterfaceOnly" or "DisableNonProxiedUdp". Both options stop WebRTC from exposing the local IP address (Microsoft, 2026).

Which fix fits which browser?

BrowserBuilt-in fixEffect on video calls
Firefoxabout:config, media.peerconnection.enabled = falseWebRTC calls stop working
BraveWebRTC IP handling policy: Disable non-proxied UDPCalls usually work, sometimes over TCP
Chrome (desktop)None; use an extensionDepends on the extension setting
EdgeExtension or admin policy WebRtcLocalhostIpHandlingCalls usually work
Chrome (Android)NoneNot applicable

Also check your VPN app. If it offers split tunneling, keep the browser inside the tunnel.

WebRTC Leak vs DNS Leak vs IPv6 Leak

These three leaks expose different data, so test each one:

  • WebRTC leak: the browser reveals an IP address through peer-to-peer setup.
  • DNS leak: your domain lookups go to your ISP instead of the VPN's resolver. See the DNS leak test guide.
  • IPv6 leak: IPv6 traffic bypasses a VPN that only tunnels IPv4. See the IPv6 leak test.

If you need stronger anonymity than a VPN gives, read our Tor Browser privacy guide.

Summary

WebRTC leaks are a silent but serious privacy threat for anyone using a VPN. They expose your real IP address through your browser without any visible warning. Run a WebRTC leak test regularly, for example with SpeedIQ's WebRTC leak check, and configure your browser to prevent non-proxied UDP connections.

→ Try it free: You can test for WebRTC leaks directly at SpeedIQ. No account, no ads, results in a few seconds.

FAQ

Does WebRTC leak your IP address?

It can. WebRTC collects your network addresses to set up peer-to-peer connections, and a web page can read them with JavaScript. With a split-tunnel VPN or a proxy extension, this list can include your real public IP.

Does a VPN automatically stop WebRTC leaks?

No. A full-tunnel VPN usually hides your public IP from WebRTC, but split tunneling and browser proxy extensions often do not. Run a WebRTC leak test with the VPN switched on to be sure.

How do I disable WebRTC in Firefox?

Open about:config, accept the warning, search for media.peerconnection.enabled and set it to false. Set it back to true when you need browser video calls.

Is WebRTC encrypted?

Yes. The WebRTC security standard requires encryption for all media and data channels (SRTP and DTLS). Encryption protects the content of a call, but it does not hide your IP address.

How often should I test for WebRTC leaks?

As a rule of thumb, test after every browser update, VPN app update, new extension or VPN setting change. Updates can reset WebRTC settings.

Sources