What is a WebRTC IP leak?
WebRTC is a browser API for peer-to-peer audio, video, and data — it powers Google Meet, Discord, and most browser-based video chat. To negotiate the shortest network path between peers, WebRTC gathers ICE candidates: a list of every IP address your machine can be reached on, including local LAN addresses and your real public IP. Any web page can request this list with no permission prompt, which means a site can learn your true IP even when you are connected to a VPN that hides your HTTP-level address.
How does this test detect a leak?
We do two things in parallel. First, we look up your public IP via a normal HTTPS request — that is the address everyone sees on the web. Then we create an RTCPeerConnection and enumerate every ICE candidate the browser offers. If any candidate IP differs from the HTTPS-visible address and is not a local 10.x / 192.168.x / fc00::/7 range, your real IP is leaking past the VPN. We also flag local-only candidates so you can see what your LAN topology exposes to JavaScript.
Why does my VPN leak in this test?
Most commercial VPNs route HTTP and TCP traffic through the tunnel but do not capture the OS-level interface enumeration that WebRTC uses to discover IPs. Even if every packet is tunnelled, the browser still sees the underlying adapter's address and offers it as an ICE candidate. The fix is either at the VPN client (proper firewall rules that bind WebRTC to the tunnel interface) or at the browser (disable non-proxied UDP, or install a WebRTC-blocking extension).
How do I stop the leak in my browser?
In Firefox, set media.peerconnection.ice.no_host to true and media.peerconnection.ice.default_address_only to true in about:config. In Chromium browsers, install the WebRTC Network Limiter extension and set it to disable non-proxied UDP. On Brave, the setting is built in under Shields. Then re-run this test — the public IP that leaked before should no longer appear in the candidate list. Note this can degrade peer-to-peer call quality on legitimate video chat.
Is this test safe to run on a VPN I'm paying for?
Yes — the test runs entirely client-side. The ICE candidates never leave your browser; we display them locally and discard them when you close the tab. The only network call we make to confirm your public IP is a plain HTTPS lookup, the same one your browser performs every time it loads a page. Combine it with /network/latency and /network/speed (with the VPN on) to get a full picture of how the tunnel affects performance, not just privacy.
Are local LAN addresses dangerous to expose?
On their own, no — 192.168.x.y tells an attacker only that you are on a typical home network, which is true of nearly everyone. They become a problem when combined with other fingerprinting signals (see /system/info) or with a known router exploit that listens on a predictable LAN address. Modern browsers obfuscate mDNS hostnames in candidates by default, which mitigates most of the risk.