GATE 03 · WEBRTC LEAK TEST
Is WebRTC exposing your real IP?
Quick answer: A WebRTC leak happens when your browser reports a different public IP address than the one websites normally see, such as your real address behind a VPN. This test asks your browser for its addresses and compares them with the IP this site sees, then shows whether they match.
This test contacts Google (stun.l.google.com) and Cloudflare (stun.cloudflare.com) STUN servers from your browser. They see your IP address, as any website would.
WebRTC lets browsers connect directly for calls and video. To do that, it can reveal addresses that a VPN or proxy was meant to hide. This test asks your browser which addresses it exposes and compares them with the IP websites see.
SEALED means every public address WebRTC exposed matches your visible IP or sits on the same network as it, or none was exposed. LEAK FOUND means it exposed a public address on a different network. A hidden ".local" address means your browser masked your local network IP.
What the WebRTC leak test checks
WebRTC is a browser feature that lets video calls and file transfers connect directly between devices. To find the best route, the browser collects the network addresses it can be reached on and may ask outside servers, called STUN servers, what public address they see. Websites can ask the browser for the same list through code.
A VPN or proxy is meant to replace your public address with its own. Sometimes WebRTC reports a different public address than the one websites normally see, for example your real address or an IPv6 address your VPN does not cover. That difference is a WebRTC leak. This test asks your browser for its addresses and compares them with the IP the site sees.
How to read the result
- SEALED: every public address WebRTC exposed matches your visible IP or sits on the same network as it, or none was exposed.
- LEAK FOUND: WebRTC exposed a public address on a different network than your visible IP. If you are using a VPN or proxy, this could be your real address.
- A hidden .local address is normal. Modern browsers mask your local network address with a random name ending in .local.
- No addresses at all means WebRTC is blocked or turned off, so it cannot leak.
Common causes and how to fix them
Leaks are most common when a proxy is set only in the browser or in an extension, because WebRTC can send traffic outside the proxy. A VPN that runs for the whole device is less likely to leak, but IPv6 and local network addresses can still show up.
- Use a VPN app that routes all traffic and offers leak protection, and make sure it also handles IPv6.
- Firefox: type about:config in the address bar and set media.peerconnection.enabled to false. This turns WebRTC off, so video calls in the browser will stop working.
- Brave: open Settings, Privacy and security, and set WebRTC IP handling policy to Disable non-proxied UDP.
- Chrome and Edge have no built-in switch. Use an extension that limits WebRTC, and test again afterwards.
- Safari hides local addresses by default.
- Always run the test again after any change, with your VPN or proxy connected.
Frequently asked questions
What is a WebRTC leak?
It is when your browser reports a public IP address through WebRTC that is different from the address websites see through your VPN or proxy. It can reveal your real network.
Does a VPN stop WebRTC leaks?
Often, but not always. A VPN that captures all device traffic usually prevents them. Browser extension proxies and VPNs that skip IPv6 are more likely to leak, so test your own setup.
Should I disable WebRTC completely?
Only if you do not use browser video calls, since many meeting sites rely on it. Limiting WebRTC to the proxied route is a gentler option where your browser supports it.
Is a local IP like 192.168.x.x a leak?
No. Local network addresses are private and do not identify you on the internet. This test treats them as local, and most browsers now hide them behind a .local name.
Why does the test contact Google and Cloudflare?
A WebRTC test needs STUN servers to learn the public addresses your browser uses. This page asks one Google and one Cloudflare STUN server, and they see your IP address as any website would.
Why does the test show an IPv6 address that is different from my IP?
Many connections have both IPv4 and IPv6. If both belong to your provider, the test treats the difference as not a leak. If the address is on a different network than the one websites see, it is flagged.