Is your VPN actually hiding you?
Four checks in one pass: the address sites see, WebRTC candidates, your IPv6 path and DNS.
Runs entirely in your browser — nothing is sent to us.
Checking…
Public IP
Checking…
Checking…
WebRTC
Checking…
Checking…
IPv6
Checking…
Checking…
DNS
Not checked
The DNS leak check needs a test server, which is not set up on this deployment.
What the test checks#
- Public IP
- The address websites see, and whether it belongs to a VPN, proxy or data-centre network. If it is your ISP's, the VPN is not carrying this traffic.
- WebRTC
- Browsers can hand a web page a list of the device's network addresses, so that calls and file transfers can connect directly. The test asks for that list and compares it with your public address.
- IPv6
- Whether you have an IPv6 path at all, and whether it is on the same network as your IPv4. A VPN that tunnels only IPv4 leaves IPv6 traffic going straight out through your ISP.
- DNS
- Whether name lookups go to the VPN's resolver or to your ISP's. This one needs a test server, and when a deployment does not have one the page says so and skips it rather than guessing.
How to read the result#
| State | Meaning | What to do |
|---|---|---|
| No leak | The check found nothing outside the tunnel | Nothing. Re-run after switching networks or servers |
| Worth a look | A private address was exposed through WebRTC. Local addresses alone do not identify you | Optional: restrict WebRTC in your browser |
| Leaking | A different public address, or an IPv6 path around the tunnel, is visible to sites | Fix before relying on the VPN, see below |
| Not checked | The check could not run here, or the browser blocks it | Treat it as unproven, not as passed |
If something leaks#
- IPv6 leak. Turn on the VPN app's IPv6 leak protection, or its option to block IPv6. If the app has neither, choose a provider that supports IPv6.
- WebRTC leak. Firefox has a setting for it in
about:config(media.peerconnection.ice.default_address_only). Chromium-based browsers rely on extensions that restrict WebRTC to the default route. - Public IP not masked. The VPN is not connected, or this traffic bypasses it. Look for a split-tunnelling rule, and turn on the kill switch so a dropped connection does not fall back to the open network.
- Run the test again. A leak that came back after reconnecting is a setting you need to find, not bad luck.
Run the test once with the VPN off, to see what the baseline looks like, and once with it on. The home page shows the address both times.
Related guides
- How websites see your IP addressEvery site you visit receives your public IP address. Where it comes from, how proxies and CDNs pass it along, what else is sent with it, and what a VPN changes.
- IPv4 vs IPv6: what changedIPv4 has 4.3 billion addresses and IPv6 has 340 undecillion. How the two differ, how to read IPv6 notation, why both are in use, and what it means for your privacy.
- What is DNS and how does a DNS lookup work?DNS turns names like example.com into IP addresses. The five steps of a lookup, the record types you will meet, and how to run a DNS lookup yourself.
- Public vs private IP addressesYour devices have a private address from your router and share one public address with the internet. The ranges, how NAT links them, and how to tell which is which.