NetDetectHubGet the app

Home / Tools

WebRTC leak test

WebRTC lets browsers make video calls, and to do that it looks up your addresses. This test compares the public IP that WebRTC reveals with the one websites see, and says plainly whether they differ.

How to use it

  1. If you use a VPN or proxy, turn it on first. Then open or reload this page: the test runs by itself and takes about five seconds.
  2. Read the verdict: No WebRTC leak, No public IP exposed over WebRTC or WebRTC leak: your real IP shows up.
  3. Compare IP websites see with IP WebRTC shows, and look at the table under What your browser revealed.
  4. After changing a setting, press Run the test again.

How the test works

Your browser opens a WebRTC connection with only a data channel and asks Cloudflare's public STUN server (stun.cloudflare.com, port 3478) which address it sees. STUN is the same method video calls use to find their public address behind a router. Each address found is an ICE candidate. The page compares them, in your browser, with the addresses websites see (from this site and ipify). No camera or microphone permission is needed, and nothing is stored.

Candidate types in the table
Shown asICE typeWhat it is
This devicehostAn address of your own device. Current browsers usually replace it with a random .local name, shown as (hidden by your browser)
Public (via STUN)srflxThe address your router or VPN presents to the internet, as the STUN server saw it
Relay (TURN)relayAn address of a relay server. This test sets up no TURN server, so you shouldn't see one

Reading the result

  • No WebRTC leak: WebRTC found a public address, but websites already see that one. Nothing extra is exposed.
  • No public IP exposed over WebRTC: the STUN request returned no public address, often because a firewall, VPN or browser setting blocks it.
  • WebRTC leak: your real IP shows up: WebRTC revealed a public address that no website saw. With a VPN on, that's usually your ISP's address getting around the tunnel.
  • Your local network address is visible: a private address such as 192.168.1.20 appeared unmasked. Not your public IP, but it helps fingerprint you.
  • WebRTC is turned off in this browser: the browser offers no WebRTC at all, so nothing can leak through it.

Why leaks happen

RFC 8828 describes the problem: when a VPN lets traffic use more than one network interface (a split tunnel), WebRTC can discover both the VPN's public address and the ISP address the VPN runs over. The RFC defines four modes and says browsers should use mode 2 by default, which follows the operating system's routing table, so media normally takes the same route as web traffic. A VPN that tunnels everything therefore usually passes this test.

Browser-extension VPNs are a weak spot: uBlock Origin's documentation warns that with an extension-based VPN, its WebRTC setting won't stop your ISP address from leaking.

How to fix a leak

  • Use the VPN's own app rather than a browser extension, with its leak protection on if it has one.
  • Turn off split tunnelling for your browser, so all of its traffic goes through the VPN.
  • On managed Chrome, the WebRtcIPHandling policy value disable_non_proxied_udp forces WebRTC through the proxy.

The IPv6 blind spot

A leak here means WebRTC shows an address websites didn't see. If your VPN tunnels IPv4 but not IPv6, sites already see your ISP's IPv6 address, so the test reports no leak while your real address is exposed anyway. Check What is my IP with the VPN on: the IPv6 line should say None or show an address from the VPN.

Questions

Is a .local address a leak?
No. It's a random name the browser made up to hide your local address, a feature called mDNS obfuscation in Chromium-based browsers and desktop Firefox. The table marks it Hidden.
Is it worth turning WebRTC off completely?
Only if you never make video calls or share your screen in the browser. Fixing the VPN set-up keeps both working.
Does this page test for DNS leaks too?
No. A DNS leak is a different problem: name lookups going to your ISP's resolver outside the tunnel. This test only covers WebRTC.
Does the test use the camera or microphone?
No. A data channel needs no permission prompt.
Why is a 100.64.x.x address marked Local network?
Addresses in 100.64.0.0/10 belong to carrier-grade NAT inside your ISP's network. They aren't reachable from the internet, so the test treats them like a home network address.

Sources ·

Results come from public DNS, registry and certificate data and from checks run from Cloudflare's network at the moment you ask. They can differ from what another network sees. How our tools work · Terms of use.