WebRTC Leak Test

Sees what IP addresses your browser would expose to a peer via WebRTC, even with a VPN active.

Browser surfaced no candidates. WebRTC may be disabled.

Opens an RTCPeerConnection with public STUN servers, gathers ICE candidates, reports any IPs the browser surfaces. The whole test runs locally — no data leaves your machine.

What you can do

A surfaced public IP means WebRTC-using sites can read it via the RTCPeerConnection API. Two browser-side options to limit exposure.

Disable WebRTC in your browser

Firefox: about:config → media.peerconnection.enabled = false. Breaks in-browser video calling but stops the IP exposure completely. Chrome doesn't expose a setting — an extension is required.

Use a leak-prevention extension

WebRTC Network Limiter (Chrome, by Google) restricts WebRTC to TURN-only, hiding local and public IPs. WebRTC Control and WebRTC Leak Shield work similarly across browsers. Keeps video calling usable while limiting the IP surface.

How WebRTC leaks IPs

WebRTC enables direct browser-to-browser connections for video chat and peer-to-peer features. To make those work behind NAT, the browser asks public STUN servers for its external IP — and JavaScript on any page can read the result via the RTCPeerConnection API. This bypasses VPNs that only proxy HTTP/TCP traffic, because the STUN exchange is UDP and goes directly from your machine to the STUN server. Browsers added mDNS-style local-address obfuscation in 2020 (host candidates become random_uuid.local instead of 192.168.x.x), which partially mitigates local-network exposure but does nothing for the public IP that STUN returns. For a VPN to fully prevent WebRTC leaks it must route UDP destined for STUN ports through the tunnel — or block it entirely. Most modern commercial clients do; some self-hosted setups don't unless explicitly configured.

Technical tool for diagnosing the quality of a network connection. Does not provide means of access to information resources whose access is restricted under applicable law.