What WebRTC can reveal
WebRTC lets browsers make direct audio, video and data connections. To find a path between peers it gathers ICE candidates: your local network addresses (host candidates) and the public address a STUN server sees (server-reflexive or srflx candidates).
If your VPN routes web traffic but lets this STUN request go out another way, a website could learn your real public IP even with the VPN on.
How to read the result
- Match: the WebRTC public address equals the address our web server saw. With a VPN on, both are the VPN’s address. ✅
- Mismatch: WebRTC exposed a different public address. If one of them is your ISP address, that’s a leak.
- No public address: STUN was blocked by the browser, an extension or a VPN that blocks UDP. Not a leak, but inconclusive.
About “masked” local addresses
Modern Chrome, Edge, Firefox and Safari replace local IP addresses with random .local mDNS names unless a page has camera or microphone permission. If you see something.local (masked), your local address is hidden as intended.
Fixing a WebRTC leak
- Use a VPN app with a system-level tunnel and kill switch, not a browser-only proxy extension.
- Firefox: set
media.peerconnection.enabledtofalseinabout:configif you never use web calls. - Chromium-based browsers: use the VPN’s own extension settings or a WebRTC policy extension to restrict non-proxied UDP.
Privacy note
The test contacts one public STUN server (stun.cloudflare.com) so your browser can learn its public address. Results stay in your browser. Only our standard /api/ip lookup is sent to our server for comparison.