WebRTC Leak Test

WebRTC can expose your real IP address to websites even when your VPN is active. This test inspects every ICE candidate your browser reveals — host, srflx, and relay — and tells you exactly what is leaking. It's a different failure mode than a DNS leak, which exposes your resolver, not your IP — run both, plus our full IP leak test for a combined view. New to how this works? Start with what a WebRTC leak actually is for the full technical breakdown.

WebRTC ICE candidate inspector
Reveals every IP your browser exposes via WebRTC STUN/TURN
Run the test to check for WebRTC leaks
Click the button above to begin
Public IP
LAN IP
Relay
ICE candidates detected
Click Run Leak Test to inspect your browser’s ICE candidates

Scored using our published, open-source methodology. View methodology

ICE candidate types — what each one reveals

host · local candidate
LAN leak
Your device's own IP addresses — LAN (192.168.x), link-local (169.254.x), and IPv6 (fe80::). Reveals your local network structure. Usually harmless alone but combined with srflx enables fingerprinting. Since Chrome 81 and Edge 81, host candidates on these browsers are usually obfuscated behind a randomly generated .local mDNS hostname instead of a raw IP — see the note below on why that isn't full protection.
srflx · server-reflexive candidate
Real IP leak
Your real public IP as seen by the STUN server — the IP your ISP assigned to you. If this differs from your VPN IP, your real identity is fully exposed. This is the critical WebRTC leak type, and it is not affected by mDNS obfuscation — srflx always carries a real routable IP.
relay · turn relay candidate
Safe
An IP provided by a TURN relay server — not your real address. When your VPN fully tunnels WebRTC, only relay candidates appear. Seeing only relay candidates means you are protected.
prflx · peer-reflexive candidate
Low risk
A peer-discovered address observed during connectivity checks. Rarely reveals new IP information beyond srflx. Appears during active peer-to-peer connections, not passive STUN probing.

How WebRTC bypasses your VPN — the 4-step mechanism

Site uses WebRTC

A website calls RTCPeerConnection() — happens on video call sites, screen sharing tools, and some ad networks silently.

Browser contacts STUN

Browser sends UDP packets directly to a STUN server — outside the VPN tunnel, using your real ISP connection.

STUN reveals real IP

STUN reflects your actual IP back to the browser as a server-reflexive candidate — your VPN IP is never used.

Site reads your IP

JavaScript reads ICE candidates via onicecandidate events and extracts your real IP — no special permissions required.

Real-world leak scenarios most guides skip

Kill switch is on, but you still leak

A kill switch protects you if the VPN tunnel drops — it blocks all traffic until the tunnel reconnects. It has nothing to do with WebRTC. While the tunnel is up and healthy, WebRTC opens a separate UDP socket straight to a STUN server, and unless your VPN client specifically intercepts that traffic at the OS network layer, the STUN response carries your real public IP as a server-reflexive (srflx) candidate. The kill switch never fires because, from its point of view, nothing went wrong — the tunnel never dropped.

Browser extension vs. desktop app

Most WebRTC leaks we see reported against "trusted" VPN providers trace back to the browser extension, not the app. Full VPN apps route every socket on the device, including the ones WebRTC opens. Lightweight browser extensions on some providers proxy HTTP/HTTPS requests only — they change what fetch() and page loads see, but the UDP path WebRTC uses for STUN binding requests goes around them entirely. If your test shows a leak, check whether you're running the extension alone versus the full client.

Split tunneling forgot the browser

Split tunneling lets you route specific apps outside the VPN tunnel for performance (gaming, large downloads). If your browser — or a specific extension/profile — is excluded from the tunnel, either intentionally or by a misconfigured rule inherited from a previous setup, WebRTC traffic from that browser instance goes out over your regular ISP connection while every other tab looks protected. This is one of the more common self-inflicted leaks we see, and it won't show up in a plain "what's my IP" check because the page load itself is still tunneled — only the WebRTC socket isn't.

Corporate proxy or managed network

On a corporate network sitting behind a proxy or NAT gateway, HTTP traffic may be transparently proxied while STUN/UDP traffic is allowed to pass directly, because many enterprise proxies only inspect TCP port 80/443. The result: your browsing looks like it's coming from the corporate egress IP, but a WebRTC srflx candidate can reveal the workstation's real internal-to- external mapped IP, which is a distinct and sometimes more identifying data point in an office environment.

How to fix WebRTC leaks

1

Firefox — disable WebRTC entirely

Navigate to about:config, search for media.peerconnection.enabled and set it to false. Completely blocks all WebRTC — no STUN or TURN candidates can be gathered.
Best Firefox fix
2

Chrome — install a WebRTC control extension

Chrome has no built-in WebRTC toggle. Install "WebRTC Control" or enable the block WebRTC option inside uBlock Origin advanced settings. Most VPN browser extensions also include WebRTC blocking.
Best Chrome fix
3

Use a VPN with built-in WebRTC protection

NordVPN, ExpressVPN, and Mullvad browser extensions block WebRTC leaks automatically. Their extensions intercept RTCPeerConnection and proxy STUN requests through the VPN tunnel — no configuration needed.
Easiest fix
4

Use the Brave browser

Brave has built-in WebRTC leak prevention in privacy settings under "WebRTC IP handling policy." Set it to "Disable non-proxied UDP" to prevent host and srflx candidates from being exposed.
Brave only
5

Managed / corporate devices — enterprise policy

On company-managed Chrome or Edge installs, an admin can set the WebRtcLocalIpsAllowedUrls and WebRtcIPHandling Chrome policies via Group Policy or a managed config profile to force relay-only behavior fleet-wide, without relying on end users to install extensions.
IT admins

Frequently asked questions

“Does a VPN kill switch stop WebRTC leaks?”
No — a kill switch and a WebRTC leak solve different problems. A kill switch cuts your internet connection if the VPN tunnel drops, so you're never exposed unprotected. It does nothing to stop WebRTC, because when the VPN is connected and working normally, WebRTC still opens a separate UDP path to a STUN server that many VPN clients don't intercept. The tunnel is up and the kill switch is irrelevant — the leak happens through a route the kill switch was never designed to watch. Run a full IP leak test alongside this one, since a kill switch failure and a WebRTC leak can both surface there.
“Why am I still leaking with a premium VPN like NordVPN or ExpressVPN?”
Their native desktop apps and mobile apps route all traffic at the OS network layer, including WebRTC, so the desktop app alone is usually safe. The leak almost always shows up when someone uses the browser extension instead of (or in addition to) the app, or when a browser add-on lite-mode is active. Browser extensions from some providers only proxy HTTP/HTTPS traffic and don't intercept the UDP sockets WebRTC uses for STUN, so ICE candidate gathering bypasses them entirely.
“Does Incognito or Private Browsing mode stop WebRTC leaks?”
No. Private browsing modes clear cookies, history, and local storage on exit — they don't change how RTCPeerConnection or STUN works. WebRTC leak behavior is identical in a private window and a normal window on the same browser and OS. See what incognito mode actually hides (and doesn't) for the full picture of what private browsing does and doesn't protect.
“What is Chrome's mDNS host candidate obfuscation, and does it fix the leak?”
Since Chrome 81, host candidates (local LAN/link-local addresses) are hidden behind a randomly generated UUID-based .local hostname instead of the raw IP, so a page reading a host candidate directly sees something like 8f3b2e91-xxxx.local rather than 192.168.1.42. This is a real privacy improvement for local network exposure, but it only touches host candidates. It does nothing for srflx candidates — the server-reflexive candidate that exposes your actual public IP behind a VPN is sent as a plain, unobfuscated IP address regardless of mDNS, per the RTCIceCandidate specification. Sites that resolve the .local name via their own STUN infrastructure can also work around the obfuscation in some configurations, so it should not be treated as a leak fix.
“Do ad blockers or uBlock Origin stop WebRTC leaks by default?”
Not by default. uBlock Origin can block WebRTC, but the option — "Prevent WebRTC from leaking local IP addresses" — is under Settings → Privacy and is off in most default installs. Standard ad-blocking filter lists target ad and tracker domains, not the STUN protocol, which typically talks directly to Google's or Twilio's public STUN servers rather than a domain on any blocklist.
“Will disabling WebRTC break video calls or screen sharing?”
Yes, for any site that depends on it — Google Meet, Discord voice/video, WhatsApp Web calling, and most browser-based screen-share tools use WebRTC directly and will stop working if you disable it in Firefox's about:config or block it via extension. This is why the more practical fix for most people is a WebRTC-aware VPN client or browser (relay-only handling) rather than a full disable, unless you never use browser-based calling.
“Can WebRTC leak my IP on mobile browsers too?”
Yes, though exposure differs by platform. Mobile Chrome on Android supports full WebRTC and can leak the same way as desktop Chrome. Safari on iOS restricts some ICE gathering behavior and, since iOS 14, blocks WebRTC IP leakage to non-permissioned sites more aggressively by default, but this depends on the iOS/Safari version and whether the site has been granted camera/microphone permissions, which can re-enable full ICE gathering. Pair this test with our IPv6 leak test on mobile, since carrier IPv6 assignment is a separate, common leak path on phones.
“If this runs entirely in my browser, how do I know PrivacyTestLab isn't seeing my leaked IP?”
This test uses your browser's own RTCPeerConnection API talking directly to a public STUN server (Google's STUN infrastructure) — the ICE candidates are read and rendered by JavaScript running locally in your tab. No candidate data, IP, or test result is transmitted to PrivacyTestLab's servers; the entire inspection happens client-side, which you can verify yourself by opening your browser's Network tab and confirming no request to this domain contains your IP or candidate list. See our transparency page and privacy policy for the full data-handling policy behind every tool on this site.

Community

Get the next leak test before it's news

Tool releases and research notes, sent when there's something worth reading. Nothing else.

At least 10 characters.