What an IP leak actually is
When you use a VPN or proxy, websites are supposed to see only the middleman’s address. A leak is any side channel that reveals your underlying network anyway. The two channels that matter in a browser are WebRTC and DNS — both designed for speed, both happy to take a shortcut around your tunnel if misconfigured.
This page compares what each channel exposes against your visible public IP. On a direct connection (no VPN), differences are usually harmless — dual-stack IPv4/IPv6 is the common cause. On a VPN, any mismatch deserves attention.
How WebRTC can bypass a VPN
WebRTC powers in-browser calls and peer-to-peer transfers. To connect two peers directly, it asks a STUN server “what address do you see me as?” — and some VPN and proxy setups let that question travel outside the tunnel, handing your real address to any website that asks.
Modern browsers mask your local network addresses with anonymous mDNS names, which is why you may see entries ending in .local — that part is working as intended. The value to watch is the public (server-reflexive) address: it should match your VPN, not your home line.
What a DNS leak reveals
Before your browser connects anywhere, it asks a DNS resolver to turn the site’s name into an address. Whoever runs that resolver sees every domain you visit. With a VPN, DNS queries should travel through the tunnel to the VPN’s resolver — if they still go to your ISP’s resolver, your browsing interests leak even though your traffic is encrypted.
Our check has your browser resolve a unique, freshly generated hostname; the authoritative server reports back which resolver actually asked. That resolver — not the one in your settings — is the one seeing your queries.
How to fix a leak
WebRTC: prefer a VPN client with WebRTC-leak protection (most reputable ones have it), or disable/limit WebRTC via your browser’s settings or a trusted extension. After changing anything, re-run this test.
DNS: enable your VPN’s own DNS or “block outside DNS” option, or set an encrypted resolver (DNS over HTTPS) in your browser settings — then confirm the resolver shown above changes accordingly.
IPv6: some VPNs tunnel only IPv4 and let IPv6 walk around the tunnel. If you see an IPv6 address from your home ISP while on a VPN, enable the VPN’s IPv6 protection or disable IPv6 on the device.
Common questions
The test shows a mismatch but I don’t use a VPN. Is that bad?
Usually not. Without a tunnel to bypass, a “mismatch” is typically your connection using IPv4 for one path and IPv6 for another, or a carrier-grade NAT quirk. Leaks are only meaningful relative to something that’s supposed to hide you.
My VPN is on and WebRTC shows my home IP. What now?
That’s a genuine leak: any website could learn your real network with a few lines of JavaScript. Turn on your VPN client’s WebRTC/leak protection or restrict WebRTC in the browser, then re-run this test until the exposed address matches the VPN.
Which resolver should the DNS test show?
Whatever you chose on purpose: your VPN’s resolver when tunneled, an encrypted public resolver (Cloudflare, Google, Quad9, …) if you set one, or your ISP’s on a plain connection. The problem case is expecting one and seeing another.
Can a website run these same checks silently?
The WebRTC part — yes, that’s exactly why it matters; no permission prompt is involved. The DNS part requires infrastructure on the site’s side but is equally invisible to you. Testing here simply shows you what any motivated site could already see.
Does this test store anything?
No. The checks run in your browser against open endpoints, results render locally, and this site has no server to send them to.