WebRTC Leak Test

A WebRTC leak happens when a peer-to-peer API inside your browser reveals an IP address that is different from the one the website would see from an ordinary HTTP request. WebRTC uses STUN to discover your public IP for voice, video, and data channel connections, and that lookup often happens outside your VPN tunnel.

The test opens an RTCPeerConnection in your browser, creates a data channel, and asks the browser to gather ICE candidates from public STUN servers. Each candidate is an IP address your browser is willing to share with a peer. We list every unique address and compare the public ones against the IP the server saw when you loaded this page.

A host candidate is a local network address, such as your LAN IP. An srflx (server-reflexive) candidate is your public IP as seen by a STUN server on the internet. An mDNS candidate looks like a random UUID followed by `.local`; modern browsers use it to hide your LAN address. Seeing only mDNS candidates means your browser is protecting the information a malicious site could otherwise learn.

WebRTC was designed to find the shortest network path between peers, so browsers query STUN servers independently of the rest of the page. On VPNs that only tunnel regular browser traffic or that use split tunneling, the STUN packet escapes through your real network interface and returns your real public IP. Kill switches at the application layer do not block this.

In Firefox, open about:config and set `media.peerconnection.enabled` to false. In Chrome and Edge, install the WebRTC Network Limiter or uBlock Origin and enable the "Prevent WebRTC from leaking local IP addresses" option under Settings → Privacy. In Safari, WebRTC is only enabled for pages you grant microphone or camera access to. Brave has a built-in toggle under Settings → Privacy → WebRTC IP handling policy.

Only if the VPN routes all outgoing UDP traffic through the tunnel, including the STUN handshake. VPNs that rely on browser proxy settings alone (including many HTTP/SOCKS proxies) do not intercept WebRTC. Full-tunnel VPN clients installed at the operating system level usually do. Re-run this test with your VPN connected to confirm.

The test runs entirely in your browser. It sends a standard STUN binding request to public Google and Cloudflare STUN servers, which reply with the IP they see. Browser Inspector does not capture or store any of the candidates; they are displayed on this page only.