What is a WebRTC leak?

A WebRTC leak happens when a browser reveals a public IP outside the VPN or proxy route you expected. A WebRTC address that matches the current VPN endpoint is normal, while a private IP or mDNS hostname is not evidence of a public-IP leak.

How do I test for a WebRTC leak?

Run a baseline with the VPN off, save those public addresses, connect the VPN, reload the page, and test again. A saved ISP address appearing only in WebRTC candidates is a strong leak signal.

Does a VPN protect against WebRTC leaks?

A well-configured VPN can route or suppress WebRTC traffic so the browser exposes only the VPN endpoint. Protection depends on the VPN app, browser, extensions, split-tunneling rules, and current connection state, so verify it with an off/on test.

How do I stop WebRTC leaks?

First update the browser and VPN app, remove conflicting proxy or privacy extensions, confirm split tunneling is not excluding the browser, enable the VPN’s leak protection, reconnect, and test again.

Is a private IP or mDNS address a WebRTC leak?

Not by itself. RFC 1918 addresses such as 192.168.x.x and randomized .local mDNS hostnames are not public internet addresses. The important comparison is whether WebRTC exposes an unexpected public IPv4 or IPv6 address.

What is WebRTC Leak Shield?

WebRTC Leak Shield is a name used by browser extensions or VPN features that limit WebRTC address exposure. The label alone does not prove the active route is safe; test before and after enabling it.

Does Brave leak WebRTC IP addresses?

Browser behavior and privacy settings can change, and extensions or enterprise policies can alter ICE gathering. Test the exact Brave profile and VPN connection you use instead of relying on a browser-wide claim.

Should I disable WebRTC completely?

Usually not as a first step. Routing WebRTC through the VPN or limiting address exposure preserves more functionality. Fully disabling WebRTC can break browser calls, screen sharing, voice chat, and peer-to-peer apps.

WebRTC Leak Test: See What IP Your Browser Exposes

Check IPv4, IPv6, ICE candidates, and the NAT path—then compare VPN off and on without granting camera or microphone access.

WebRTC Leak Test Console

Compares normal web-request IPs with browser ICE candidates, then adds NAT path context.

No camera or microphone permission required

Connection path

Reads the IP used for normal HTTPS requests.

WebRTC path

Gathers host, srflx, and relay ICE candidates.

Result

Flags only public addresses outside the expected route.

Quick Answer

A WebRTC leak occurs when your browser exposes a public IP that bypasses the VPN or proxy route you expected. Seeing the same VPN server IP is normal; a private address or mDNS hostname is not proof of a public leak.

What a WebRTC leak test actually checks

WebRTC uses ICE to find routes for browser calls, voice chat, screen sharing, and peer-to-peer data. Those routes can include local host addresses, public mappings learned through STUN, or TURN relays. Our WebRTC, STUN, ICE, and TURN guide explains the negotiation in more depth.

The useful signal is not simply “an IP appeared.” This checker compares the public IP used for ordinary HTTPS requests with public WebRTC candidates. It also lets you save a VPN-off baseline, which is how the test can distinguish a normal VPN endpoint from an ISP address escaping the expected tunnel.

If an address looks unfamiliar, review the difference between a public IP and a private IP. A shared 100.64.0.0/10 address can also indicate an upstream carrier network; use the CGNAT checking guide to confirm that separate condition.

The three-way comparison

Read the verdict in this order.

1. Connection IP

What ordinary HTTPS requests expose.

2. WebRTC public IP

What STUN or ICE exposes to a peer.

3. VPN-off baseline

Which public addresses belong to the unprotected route.

Check your NAT type and public mapping

How to read your WebRTC test

Candidate type tells you how the browser found a route. Address class and the off/on comparison tell you whether that route creates a privacy problem.

ICE candidate	What it means	Leak signal
Host (private or mDNS)	A local/private address or a randomized .local hostname from the browser.	Not a public leak by itself
Server reflexive (srflx)	A mapped address learned from STUN. It may be your ISP address or the VPN endpoint.	Compare it with both paths
Relay (TURN)	Traffic can use a relay instead of advertising a direct peer route.	No direct public address in that candidate

Do not judge by candidate type alone

A public srflx candidate that equals the VPN endpoint is expected. A leak is more likely when it matches the saved ISP baseline but differs from the current connection IP.

How to test a VPN for WebRTC leaks

The off/on method gives the test a known ISP baseline and reduces false alarms from an unfamiliar but legitimate VPN server address.

1
Run a VPN-off baseline
Disconnect the VPN, run the test, and save the public addresses as your VPN-off baseline.
2
Connect your VPN
Open the VPN app, connect to the server you want to use, and wait until the tunnel is ready.
3
Run the WebRTC leak test again
Reload this page and rerun the test so both normal HTTPS and WebRTC use the new network state.
4
Compare the paths
A likely leak exists when a WebRTC public IP matches the VPN-off baseline but differs from the current VPN connection IP.

Expected connection path

The website and STUN service should see the VPN-side route.

Browser

VPN tunnel

Website / STUN

If normal HTTPS uses the VPN IP but WebRTC exposes the saved ISP IP, the two paths have split and the public address is likely leaking outside the expected route.

How to stop WebRTC leaks

Start with the route, not a blanket browser shutdown. Change one layer at a time and rerun the same baseline comparison.

Update and reconnect

Install current browser and VPN app updates, disconnect the tunnel, then connect again.

Check split tunneling

Make sure the browser is not excluded from the VPN route or sent through a separate proxy.

Remove conflicting extensions

Temporarily disable overlapping VPN, proxy, WebRTC, or privacy extensions and retest.

Enable leak protection

Use the VPN app or its official browser extension to keep WebRTC on the protected path.

Preserve browser features when possible

Fully disabling WebRTC can break video calls, screen sharing, voice chat, and peer-to-peer apps. Prefer VPN-side leak protection or limited address exposure, then verify the result.

Optional commercial solution

VPN options with WebRTC leak protection

If a browser-only proxy or manual extension keeps exposing the ISP route, the concrete problem is that not all browser traffic follows one protected path. A full VPN app can route the browser connection and WebRTC together, so websites see the VPN endpoint and you avoid maintaining separate browser rules. These options fit that job.

Best overall for a simple fix

NordVPN

Protects millions of users worldwide
Six independent no-logs assurance engagements
Open-source Linux GUI and CLI
30-day refund window for eligible purchases

WebRTC protection guide Audit proof Refund terms

Get NordVPN

Best open-source option

Proton VPN

100M+ Proton accounts across its privacy ecosystem
Five consecutive annual independent no-logs audits
Open-source VPN apps with public code
30-day refund window for eligible paid-plan purchases

Leak protection features Audit proof Refund terms

Get Proton VPN

Direct WebRTC controls

PureVPN

3M+ users and 17 years in cybersecurity
Fourth consecutive independent no-log assessment
ISO 27001-certified information security program
31-day refund window for eligible initial purchases

WebRTC leak protection Audit proof Refund terms

Get PureVPN

Affiliate disclosure: We may earn a commission when you purchase through links on this page, at no extra cost to you.

WebRTC leak test FAQ

Short answers to the questions that matter before changing browser or VPN settings.

Method and authoritative sources

The checker creates a data-only peer connection, parses ICE candidates, obtains independent HTTPS-visible IPs, and requests NAT context from NAT Checker. It does not request media access or display raw SDP.