What is a WebRTC leak?

WebRTC lets browsers make voice calls, video calls, and direct connections without a plugin. To connect two people, a browser collects the network addresses it can be reached on, and a web page can read that list with a few lines of script.

A leak happens when that list contains your real IP address while you use a VPN. Sites then see the VPN address in the normal way, but they can still find your own address through WebRTC.

How to read your result

• No leak: WebRTC showed nothing beyond the address websites already see.
• Different public address: WebRTC found a public address on the same IP version that websites do not see. With a VPN on, this is a leak. Without a VPN, it can be normal on connections with more than one route to the internet.
• Address on the other IP version: websites see your IPv4 address, and WebRTC found an IPv6 address, or the other way around. With a VPN on, check whether the address belongs to your own provider.
• Local address: WebRTC showed a private address from your home network. This cannot identify you on its own, but it does help with tracking.

How to test your VPN

1. Run this test with your VPN off, and note the addresses.
2. Connect your VPN and reload this page.
3. Run the test again. Your addresses from the first test should be gone.

How to stop a WebRTC leak

• Check your VPN settings: many VPN apps and browser extensions include WebRTC protection, so make sure it is on.
• Firefox: open about:config and set media.peerconnection.enabled to false. This also stops calls in the browser.
• Chrome, Edge, and Brave: these have no simple switch for all cases. Brave offers a WebRTC policy in its privacy settings, and for Chrome and Edge you can use an extension that limits WebRTC.
• Safari: it limits what pages can read by default, and it hides local addresses.

Choosing a VPN? Read our VPN comparison guide and the privacy and security guide.

Why do I see an address ending in .local?

Modern browsers replace your local address with a random name ending in .local. This is a privacy feature, so it is a good result.