Tools / WebRTC Leak Test
WebRTC Leak Test
You think
"The VPN covers everything."
The mirror
WebRTC — the tech behind browser video calls — can hand out your real IP anyway. Any page can ask.
The test runs in your browser and asks a Cloudflare STUN server for your public address — exactly what any web page can do. We don't see, store or log the result.
What this means for you
Any page you open can run this exact check silently. With a VPN "on" and a leak, a forum, an ad script or a seller still gets your real IP — your city, your ISP, your household.
It happened
Hector Monsegur, "Sabu" of LulzSec, was reported to have been identified after a single IRC login without Tor exposed his home IP. One unmasked connection was enough. Your browser just made the same kind of connection.
Synthesis
Resize this reflection — free first
Firefox: turn WebRTC off
about:config → media.peerconnection.enabled → false. Browser video calls stop working until you flip it back.
Brave / Chrome: limit IP exposure
Brave: Settings → Privacy and security → WebRTC IP handling policy → "Disable non-proxied UDP". Chrome: the "WebRTC Network Limiter" extension applies a similar policy.
Go further: a VPN, then verify it
Providers worth a look: Mullvad and Proton VPN. Connect, then re-run this test — a VPN only counts if the test says so.
Any partner link on this site will be marked and will never come before a free fix.
Fixed it? Prove it.
Re-run the test — a clean result flips this finding to green. Your "Fixed ✓" state is kept on this device only.
What is a WebRTC leak?
WebRTC is the browser feature behind video calls and peer-to-peer apps. To connect two devices it asks a STUN server "what address do you see me at?" — and any web page's JavaScript can trigger that same question and read the answer.
If you use a VPN, sites should only see the VPN's address. In a leak, the browser also reports your real public address (the one your ISP gave you) outside the VPN tunnel. This test compares the address WebRTC reports with the one your normal browsing uses, and flags any difference.
Modern browsers hide your local network address behind a random .local name, so a clean result usually shows no local IP — that is the browser doing its job.
Checked WebRTC? Hold the mirror up to the next belief
Full Digital Mirror scan
You think: one leak, one problem.
The mirror: all findings in one reflection, scored.
DNS Leak Test
You think: lookups are nobody's business.
The mirror: your ISP answers — and logs — every one.
Email Breach Check
You think: my inbox is mine.
The mirror: the average address sits in several public dumps.