What is a WebRTC leak?

A WebRTC leak occurs when your web browser uses the Web Real-Time Communication (WebRTC) protocol to establish peer-to-peer video or audio sessions. The STUN (Session Traversal Utilities for NAT) servers send requests outside of the encrypted VPN tunnel, revealing your actual residential public IP address to the visited website.

How does this leak test detect exposed IP addresses?

This test runs client-side JavaScript that creates a temporary RTCPeerConnection to public Google STUN servers. It logs the ICE candidates returned by your browser. If a candidate IP matches your physical ISP rather than your VPN's exit node, a critical leak is occurring.

How do I fix a WebRTC leak?

To fix a WebRTC leak: 1) Use a reputable VPN with built-in WebRTC and DNS leak protection enabled like NordVPN or Proton VPN; 2) Enable your VPN's system-level Kill Switch; 3) Disable WebRTC in your browser settings (e.g., about:config in Firefox) or install the VPNSecurity.blog Chrome extension.

Does a VPN hide my local LAN IP address (192.168.x.x)?

No. Local private IP addresses (such as 192.168.1.X or 10.X.X.X) are assigned by your local router and are non-routable on the public internet. Seeing a private LAN IP in the test is normal and harmless; only seeing your public residential WAN IP represents a dangerous security leak.

Live Client-Side STUN & IP Diagnostic Engine

Free WebRTC & VPN IP Leak Test

Test whether your VPN is truly protecting your identity or silently leaking your real residential IP and ISP via browser WebRTC STUN requests.

Analyzing Network & WebRTC Interfaces...

Public Egress IP IPv4

Checking...

ISP / Organization: Detecting...

Estimated Location: Locating...

Fingerprint Risk: Assessing...

WebRTC STUN Candidates Scanning

Querying STUN...

STUN Server Tested: stun.l.google.com

Detected Candidates: 0 candidates

IPv6 & DNS Leak Status Auditing

Testing IPv6...

IPv6 Reachability: Checking...

STUN Protocol: UDP / Candidate ICE

Browser WebRTC: Active

Protect Your Identity From STUN & IP Leaks

If your real ISP, country, or IP is displayed above, your connection is exposed. The top-rated VPNs below automatically block WebRTC bypasses with kernel-level kill switches.

Top Leak Prevention Pick

NordVPN

★ 4.7 / 5.0 • 100% Leak Protection

NordVPN features proprietary NordLynx protocol with Post-Quantum key exchange, automated IPv6 and DNS blackhole routing, and an infallible App/Internet Kill Switch.

Built-in WebRTC leak blocking at network driver level
Post-quantum encryption (ML-KEM / WireGuard hybrid)
Threat Protection Pro blocks malicious STUN trackers
Audited 4x independently by PwC and Deloitte
7,400+ ultra-fast RAM-only diskless servers

$3.09 / month (74% Off + 3 Mos Free)

Get NordVPN Leak Protection →

Proton VPN

★ 4.4 / 5.0 • Swiss Privacy

Based in Switzerland outside the 14-Eyes surveillance alliance. Features Secure Core double-hop routing through underground bunkers and 100% open-source audited apps.

Swiss jurisdiction with zero mandatory data retention
Permanent Kill Switch prevents accidental STUN leaks
Full IPv6 leak protection on all platforms
100% Open source and publicly audited code
Integrated NetShield DNS ad & malware blocker

$3.59 / month (60% Off)

Get Proton VPN Protection →

Understanding WebRTC Leaks: What Every VPN User Must Know

Even if you have an active VPN connection and your browser shows an encrypted tunnel, you may still be completely unmasked to websites you visit. This security failure is known as a WebRTC STUN Leak.

Why Do WebRTC Leaks Happen?

Web Real-Time Communication (WebRTC) is a modern web standard built into Google Chrome, Microsoft Edge, Mozilla Firefox, and Safari. It enables browser-based peer-to-peer audio, video, and data streaming without requiring external plugins or extensions.

To establish a direct connection between two peers through Network Address Translation (NAT) firewalls, WebRTC uses STUN (Session Traversal Utilities for NAT) servers. When a web page requests a STUN lookup, your browser queries external servers to discover its public IP address. In poorly configured VPN setups, the operating system routes these STUN UDP packets outside the virtual network interface directly through your local Wi-Fi or Ethernet adapter, exposing your physical residential IP address to the web server.

How to Read Your Diagnostic Results

Host Candidates (e.g. 192.168.1.X or 10.X.X.X): These are private IP addresses assigned by your local router. They are non-routable on the public internet and do not expose your identity or physical location.
Server Reflexive (srflx) Candidates: These are public IP addresses returned by STUN servers. If the srflx IP matches your VPN server's exit address, your VPN is working correctly. If the srflx IP matches your real home internet connection, you are leaking!
IPv6 Leaks: Many commercial VPNs only tunnel IPv4 traffic. If your ISP assigns you an IPv6 address and your VPN does not block or route IPv6, websites can effortlessly log your physical location via IPv6.

Step-by-Step: How to Permanently Prevent WebRTC Leaks

Enable System-Level Kill Switch: Ensure your VPN's Kill Switch is set to strictly block all non-VPN network traffic. Both NordVPN and Proton VPN feature advanced kill switches that prevent STUN packet leakage.
Disable WebRTC in Firefox: Type about:config in your address bar, search for media.peerconnection.enabled, and toggle it to false.
Chrome & Chromium Browsers: Install the official VPNSecurity.blog Chrome Extension or use extension flags to prevent WebRTC from exposing public interfaces.
Brave Browser: Open Settings → Privacy and Security → WebRTC IP handling policy → Select "Disable non-proxied UDP".

Frequently Asked Questions

Expert answers regarding WebRTC vulnerabilities, DNS security, and VPN configuration.

What is the difference between a DNS leak and a WebRTC leak? +

A DNS leak occurs when your browser sends domain lookup queries (translating domain names like google.com into IP addresses) to your local ISP's DNS servers instead of your encrypted VPN's private DNS resolvers. A WebRTC leak occurs when browser peer-to-peer streaming protocols bypass the VPN tunnel entirely to announce your public residential IP to STUN servers.

Does Incognito / Private Browsing mode stop WebRTC leaks? +

No. Incognito and Private Browsing modes only prevent your browser from saving local cookies, search history, and cache. They do not alter how your network interface routes STUN packets. WebRTC is fully enabled in Incognito mode and will leak your real IP address if your VPN is not configured properly.

Why does the leak test show my local IP (192.168.x.x)? +

Local IP addresses starting with 192.168.x.x, 10.x.x.x, or 172.16.x.x are private RFC 1918 subnets used solely by your local home router. They cannot be used by external websites to identify your physical address, geolocate you, or trace your online activities.

Which VPN is best at preventing all forms of leaks? +

In our independent 2026-2027 lab tests, NordVPN scored the highest across 100+ consecutive automated leak tests. It features kernel-level network binding, automated IPv6 blackholing, and post-quantum WireGuard (NordLynx) encapsulation that ensures no packets bypass the tunnel during network drops or Wi-Fi handoffs.

Related data: our 2026-2027 VPN benchmark matrix publishes the measured throughput retention, post-quantum support, audit history and pricing behind these recommendations, with a downloadable CSV.