Leak Tests
IP Leak Test
Check whether your real IP address is leaking through HTTP, WebRTC, DNS, or IPv6 — simultaneously. One test, four sources, one verdict.
Checking…
HTTP / standard
--
Checking…
WebRTC / STUN
--
Checking…
DNS resolver
--
Checking…
IPv6
--
IP address comparison by source
HTTP
--
--
Pending
WebRTC
--
--
Pending
DNS
--
--
Pending
IPv6
--
--
Pending
Scored using our published, open-source methodology. View methodology
What this test checks — 4 leak sources
HTTP IP — your visible address
The IP seen by websites when you make an HTTP request. This is what a VPN replaces with its server IP. This check almost always passes when a VPN is active — the other sources are where leaks hide.
WebRTC — the most common leak
WebRTC is a browser API for real-time communication. It uses STUN servers to discover your IP and can expose your real public IP even through a VPN. Firefox and Chrome are both vulnerable if WebRTC is not blocked.
DNS resolver — who handles your queries
Checks whether DNS queries go through your VPN's private resolver or your ISP's server. A DNS leak means your ISP can see every domain you visit even when your traffic is encrypted by the VPN.
IPv6 — the invisible leak channel
If your device has an IPv6 address and your VPN doesn't tunnel or block it, every IPv6-capable website sees your real ISP address bypassing the VPN entirely. Many VPNs only protect IPv4 by default.
The three most common leak scenarios
Critical
WebRTC reveals your home IP
Even with a VPN active, Chrome and Firefox's WebRTC implementation contacts STUN servers and reveals your real public IP and local LAN IP. The VPN cannot intercept this — it requires browser-level blocking.
High
DNS queries go to your ISP
Your VPN encrypts traffic but forgets to redirect DNS queries through its private resolver. Every domain lookup goes to your ISP's DNS in cleartext, revealing your browsing history regardless of the VPN.
Medium
IPv6 bypasses the VPN tunnel
Your VPN only tunnels IPv4. Your ISP-assigned IPv6 address remains active and goes out unprotected. Any modern website that supports IPv6 receives your real address even if your HTTP IP shows the VPN server.
How to fix each type of leak
1
Fix WebRTC leaks — disable WebRTC in your browser
In Firefox: set
Fixes WebRTC leaks
media.peerconnection.enabled to false in about:config. In Chrome: install a WebRTC control extension. Most VPN browser extensions also include a WebRTC blocking option.2
Fix DNS leaks — use a VPN with private DNS
Switch to a VPN that forces all DNS queries through its own resolver. In settings, look for "DNS leak protection" or "private DNS." NordVPN, ExpressVPN, and Mullvad all enforce this by default.
Fixes DNS leaks
3
Fix IPv6 leaks — enable IPv6 protection in VPN
Check your VPN app's advanced settings for "IPv6 leak protection" or "block IPv6." If unavailable, disable IPv6 at OS level: Network Adapter settings → uncheck IPv6 (Windows) or use sysctl (Linux/macOS).
Fixes IPv6 leaks
4
Enable the VPN kill switch
A kill switch blocks all internet traffic if the VPN connection drops, preventing your real IP from being exposed during reconnection. Enable it in your VPN app settings — it is the most important safety net available.
Prevents all leak types
