Skip to content
SpeedIQ

WebRTC Leak Test

By Vathanakone Prakosay · Updated on · 5 min read

In short

This WebRTC leak test asks your browser which IP addresses WebRTC can reveal and compares them with the public IP that websites see. With a VPN on, WebRTC should show only the VPN address. Any other public address is a WebRTC leak.

WebRTC leak testruns in your browser

The test asks a STUN server of Google (stun.l.google.com) ↗ which addresses WebRTC exposes, and ipinfo.io ↗ for the public IP websites see and for the network that owns any extra address. Nothing runs until you click. Results stay in your browser; we do not store or receive them. Checks marked ↗ send one request to a third party (see Privacy, section 3.3).

    How does this WebRTC leak test work?

    The WebRTC leak test opens a WebRTC connection in your browser, the same way a video call would, and collects the network addresses it finds for about five seconds. Then it compares them with the public IP address your connection uses.

    1. Your browser contacts a STUN server. The STUN server replies with the public IP it saw (RFC 8445, 2018).
    2. The browser lists its candidates: public addresses, local network addresses or hidden mDNS names.
    3. The test asks ipinfo.io for the public IP that websites see.
    4. If WebRTC shows a public address from a different network than the one websites see, the test reports a possible leak. An IPv6 address from the same provider is not a leak.

    You get the result in plain words. The addresses stay on your screen; SpeedIQ does not store them.

    How do I read the WebRTC leak test result?

    Green means WebRTC shows no address from another network. Red means it shows a public address outside your VPN tunnel.

    ResultWhat it means
    No public address via WebRTCWebRTC is blocked or reveals nothing. No leak.
    Same network as your connectionNo leak. With a VPN on, this should be your VPN provider. An IPv6 address of the same provider is normal.
    Public address from another networkPossible WebRTC leak: WebRTC found a route outside the VPN. Check whether the network is your ISP.
    Local address (for example 192.168.x.x)Your local network address is visible. It does not expose your real IP, but it adds to your browser fingerprint.
    Hidden (mDNS)The browser replaced the local address with a random name. That is the safer default.

    Run the test twice: once without a VPN and once with the VPN connected. Without a VPN, seeing your real IP is normal. The leak only matters when the VPN is on.

    What is a WebRTC leak?

    A WebRTC leak happens when a website reads your real IP address through WebRTC while you use a VPN or proxy. WebRTC is the browser standard for real-time communication, such as peer-to-peer video calls and file transfers. To connect two browsers directly, it collects every address that might work, and a web page can read that list with JavaScript, without a call and without asking for camera or microphone access.

    The IETF standard on WebRTC IP handling names the main risk: with some VPN setups, WebRTC can discover not only the public address of the VPN but also the address from your internet provider (RFC 8828, 2021).

    Does a VPN stop WebRTC leaks?

    A full-tunnel VPN usually stops the public part of a WebRTC leak, but not always the local part. If all traffic, including the STUN request, goes through the VPN tunnel, the STUN server sees the VPN IP. With split tunneling, some traffic can bypass the tunnel, and WebRTC may use that route to expose your real IP (RFC 8828, 2021).

    Some VPN apps add their own WebRTC leak protection in the browser extension. Check it with this test instead of trusting the setting.

    How do I fix a WebRTC leak?

    You fix a WebRTC leak by limiting which network routes WebRTC may use, or by turning WebRTC off in the browser settings.

    After each change, run the WebRTC leak test again. The result should show no address from another network.

    WebRTC leak vs DNS leak vs IPv6 leak

    A WebRTC leak exposes an IP address through the browser. A DNS leak sends the names of the websites you visit to your ISP's resolver. An IPv6 leak sends IPv6 traffic outside a VPN that only tunnels IPv4. Each needs its own test: use the VPN leak test for IP, IPv6 and WebRTC together, and our DNS leak test guide for DNS.

    What can this WebRTC leak checker not see?

    The test only checks this browser. Apps outside the browser, other browsers and other devices can behave differently. It waits five seconds; very slow networks may return fewer candidates. For the background, read What is a WebRTC leak?

    FAQ

    Is this WebRTC leak test safe?

    Yes. The test only reads addresses that your browser already gives to every website that uses WebRTC. SpeedIQ does not store the result. The STUN server of Google and ipinfo.io see your IP address when you click, like any website you open.

    How do I know if my VPN is actually working?

    Run the test with the VPN on. The public IP should belong to your VPN provider, and WebRTC should show no address from another network. The VPN leak test also checks IPv6.

    Does a public IP in the result always mean something is broken?

    No. Without a VPN, WebRTC shows your normal public IP, which every website sees anyway. It is only a leak if the address belongs to a different network than your VPN while the VPN is on.

    Can a browser extension change the result?

    Yes. Extensions and browser settings that restrict WebRTC can hide some or all addresses. That is why you should test again after every change.

    Does the test check IPv6 addresses?

    Yes. The test lists IPv4 and IPv6 candidates. For your IPv6 connection outside WebRTC, use the VPN leak test.

    More checks on SpeedIQ

    Sources