Browser privacy check

WebRTC Leak Test

Run a browser-based WebRTC check to see whether ICE candidates expose public IP, private IP, hostname, or mDNS-obfuscated connection details in this session.

WebRTC leak guide

How to interpret WebRTC IP candidates

The test gathers browser ICE candidates through Cloudflare’s public STUN service, then compares readable public candidates with the current public-IP baseline. It separates public IPs, private addresses, hostnames, and mDNS-obfuscated values.

How to use the result

  1. Run the test after the VPN or proxy is connected.
  2. Compare only addresses from the same family: IPv4 with IPv4 and IPv6 with IPv6.
  3. Open candidate details when the summary reports a different route or an incomparable family.

What it means

A same-route result means the readable WebRTC candidate matched the public route websites already see. A different same-family address is worth investigating. An IPv6 candidate beside an IPv4 baseline is not automatically a leak.

Important limits

  • No candidate or mDNS-only result is not an anonymity guarantee.
  • Browser and network policy can prevent candidate gathering.
  • The test does not evaluate DNS, account, cookie, or app traffic.
Useful next checks Check IPv4 and IPv6 routesResearch VPN privacy

Common questions

Is a private IP candidate a VPN leak?

Not by itself. Private-network candidates can be normal WebRTC behavior and do not necessarily reveal the public route outside your network.

Why is another address family shown?

Some connections expose both IPv4 and IPv6. Run both public-IP probes before classifying the other family as a mismatch.