VPN Leak Test: Check for IP, DNS & WebRTC Leaks

A one-time check shows IP addresses only at the moment it runs. Our test repeats IPv4, IPv6, DNS and WebRTC checks throughout the run. This helps you spot your original IP address appearing when you switch servers or reconnect your VPN.

A saved baseline lets the test highlight matches with your connection without a VPN. The log shows the sequence of changes and gaps in data. A very brief leak may occur between checks, so having no matches does not guarantee there were no leaks.

Turn off your VPN and click “Save baseline”. Capture takes 30 seconds. Then turn on your VPN, start the test, and try switching servers or reconnecting. Watch for baseline matches and events in the log.

Keep this tab active: browsers may slow down checks in the background. The test also works without a baseline, but it shows address changes without comparing them with your original connection.

A baseline is a saved set of addresses from your connection without a VPN. It helps detect those addresses reappearing while your VPN is on.

The baseline includes public IPv4, IPv6 and WebRTC addresses, and DNS resolver addresses observed during capture. Matches with these addresses are highlighted in red.

Save your baseline with your VPN off. Save a new one if your original network or its addresses change. If you save a baseline with your VPN on, a match may mean you have returned to a previous VPN server, rather than exposed your original connection.

If the test sees your original IPv4 or IPv6 address while your VPN is on and should be hiding it, that is an IP leak. Even a brief appearance means the address was visible to the test server.

For example, your address without a VPN is 198.51.100.10, and your VPN address is 203.0.113.20. If 198.51.100.10 appears again during a server switch, your original IP was exposed. These are example addresses.

This conclusion assumes you saved the baseline with your VPN off and the VPN is meant to protect browser traffic. If you turn off the VPN yourself or exclude your browser from it, seeing your original address is expected. The test cannot tell whether your VPN is on.

No. An IP change alone does not mean a leak. It is normal to get a different exit address when you switch VPN servers.

For example, VPN server A is replaced by VPN server B. Neither address matches your baseline, so your original address was not detected in those responses.

If an IP from a baseline recorded without a VPN appears, your original address has been exposed. If an address is simply unfamiliar, the change alone cannot tell us whether it belongs to your VPN or your original connection.

If the test continues to see your internet provider’s DNS resolvers while your VPN is on, that is a strong sign of a DNS leak, especially if the VPN is supposed to use its own DNS servers.

An exception is when the same third-party DNS service is used both before and after you turn on your VPN, for example through browser, device or VPN settings. Requests to that service may travel through the VPN, so an address match alone does not mean a leak.

A red DNS match means the test detected a DNS resolver from your connection without a VPN. If it belongs to your internet provider, the result is suspicious. If it is a separately configured DNS service, the match may be normal.

No. Multiple DNS addresses alone do not mean a leak. One DNS service may use several resolvers.

For example, different queries during a single test may be handled by different servers belonging to the same service, including both IPv4 and IPv6 addresses.

Look at which DNS services appear. Seeing your internet provider’s DNS instead of the expected VPN DNS is suspicious regardless of the total number of addresses.

The test has not received new observations for at least 2 seconds. This may happen during a VPN reconnection, a network interruption or a problem reaching the test server.

This does not prove that the VPN safely blocked all traffic. There are no observations for that period, so the result is unknown.

No IPv6 address is not itself a leak. What matters is whether IPv6 was available without your VPN.

If IPv6 worked without your VPN but responses stopped after you turned it on, the VPN may be blocking IPv6. If an IPv6 address from your baseline appears while the VPN is on, your original address has been exposed.

No responses do not prove blocking; a connection failure may also be the cause. If no IPv6 address was received even during baseline capture, comparison with your original IPv6 address is unavailable.

With baseline comparison enabled, this is a good result: none of the received observations matched your baseline. But it is not a guarantee that there were no leaks.

The result is more useful if you test server switches and VPN reconnections as well as normal operation.

A brief event may fall between probes or during a gap in observations. Your baseline may be outdated, and WebRTC results depend on browser restrictions. If a check has no baseline data, the absence of matches for that check says nothing about protection.

It means the address appeared again after another IP. A repeated row shows the address returning; it is not a separate leak by itself.

Consecutive responses with the same IP are grouped into one row. For example, A → B → A produces three rows. “Count” shows the number of responses in each row.

The DNS card groups addresses by resolver, and “Count” shows the number of its queries. These counters do not represent the number of separate leaks.

The log shows when the browser recorded an event, with millisecond precision. This helps you relate changes to VPN switches.

DNS observations may arrive with a delay: the log timestamp does not necessarily match the time of the DNS query at the server. Multiple events may be received together.

Yes. The test collects addresses that WebRTC allows the page to see and contacts our STUN server. It does not use your camera or microphone.

A public IP from your baseline appearing while your VPN is on means your original address was exposed, if the VPN was supposed to hide it. Local addresses and .local names are not considered public IP leaks.

If no addresses are received, this does not prove protection: your browser or an extension may restrict WebRTC, or STUN may be unreachable. An older baseline can still compare your original IPv4/IPv6 addresses; save a new baseline to include WebRTC addresses.

Your baseline is saved in your browser, and the test history stays in the open tab. Click “Download results” to keep a copy of the history.

Download the file before refreshing or closing the page, starting a new test or replacing your baseline. Test history is not preserved between runs.

The server temporarily holds DNS events in memory to deliver them to your browser, without persistent result storage. If your browser cannot save the baseline, it is available only on the current page; a storage error will appear in the log.