WebRTC can reveal your device's IP addresses directly to websites, bypassing a VPN or proxy. This test runs entirely in your browser and shows which IP addresses WebRTC exposes.
Starting test…
Running…
Note: modern browsers hide local IPs behind an
.local mDNS name. A public IP appearing here while you're
on a VPN indicates a leak.
WebRTC is the browser technology behind video calls and peer-to-peer connections in the browser. To connect two people directly it has to discover the real network addresses of each device — and historically it could hand those addresses to any web page that asked, including the local and public IP a VPN was supposed to be hiding.
This test runs that same discovery in your browser and shows you what it finds.
If the addresses shown are your VPN's, nothing is leaking — that is what a website would see, and it matches what you intended.
If your real public IP appears while a VPN is connected, that is a genuine leak and a site could use it to identify your actual location and provider.
Private addresses such as 192.168.x.x or 10.x.x.x are not a leak in any meaningful sense. They describe your position on your own local network, are the same for millions of households, and cannot be used to reach or identify you from outside.
A long hexadecimal string ending in .local is mDNS obfuscation — the browser deliberately substituting a random identifier for your local IP. Seeing it means the protection is working.
It is not a bug so much as a consequence of the design. WebRTC deliberately gathers every candidate address it can find, because the whole point is to locate a working path between two peers. When it runs at the browser level it can enumerate interfaces that an application-level VPN does not cover.
Browsers have tightened this considerably. Local addresses are now typically replaced with mDNS names, and permission is required in more situations. The residual risk is highest with browser extension VPNs, which only redirect the browser's own HTTP traffic, and with split-tunnel configurations that route some traffic outside the tunnel by design.
In rough order of how much they cost you in broken functionality:
about:config and set media.peerConnection.enabled to false. This disables WebRTC entirely, which will break browser-based calling.It is when the WebRTC feature in your browser reveals your real IP address to a website even though a VPN or proxy is in use. It happens because WebRTC enumerates network addresses directly to establish peer-to-peer connections.
No. That is a private address describing your device on your own local network. It is shared by millions of households, cannot be routed from the internet, and reveals nothing that identifies you.
A system-wide VPN client usually does, because every network interface is routed through the tunnel. Browser extension VPNs frequently do not, since they only handle the browser's HTTP traffic and leave WebRTC free to use the real connection.
Only if you do not need it. Disabling WebRTC breaks browser-based video calls, screen sharing and some file transfer tools. For most people a system-wide VPN with leak protection enabled is a better trade-off.
That is mDNS obfuscation: the browser replaced your real local IP with a random identifier specifically to prevent this kind of fingerprinting. It means the built-in protection is working as intended.