WebRTC Leak Test
Check whether WebRTC exposes your local or public IP address — even behind a VPN or proxy. The test runs a real peer connection against a public STUN server and reads back every candidate your browser reveals, all in your browser.
Runs locally · nothing uploadedDiscovered IP addresses will appear here after you run the test.
How the test works
WebRTC (Web Real-Time Communication) lets browsers exchange audio, video and arbitrary data peer-to-peer. Before two peers can talk directly it must discover how they are reachable — a process called ICE (Interactive Connectivity Establishment). The browser asks a STUN server “what does my address look like from the outside?” and generates a list of ICE candidates: your local LAN address, your public (server-reflexive) address, and often relayed addresses.
The problem for privacy is that any web page can read these candidates from JavaScript — no permission prompt required. So even if your browser’s traffic is routed through a VPN or SOCKS proxy, a poorly-configured setup can still surface the public IP of your real connection, deanonymising you. This is the classic WebRTC leak.
This tool reproduces exactly what a tracker would do: it creates an RTCPeerConnection pointed at Google’s public STUN server, opens a data channel, calls createOffer() and setLocalDescription(), then collects every ICE candidate that fires. It parses each candidate string for IPv4, IPv6 and mDNS *.local hostnames and classifies them as local, public or mDNS.
Reading the result
If a public IP appears, WebRTC can reveal that address to any site you visit — a genuine leak if you expect a VPN to hide it. If you only see *.local mDNS hostnames (and no public IP), your browser is obfuscating its internal addresses and there is nothing usable to leak. Note that seeing your public IP with no VPN active is expected and harmless; the test is most meaningful while a VPN or proxy is connected.
Frequently asked questions
What is a WebRTC leak?
STUN servers. A web page can read these candidates with JavaScript, so even when you use a VPN or proxy, WebRTC can reveal the IP address underneath it. That mismatch is a WebRTC leak.Does this test upload anything?
RTCPeerConnection, queries Google's public STUN server to discover candidates, and parses the IPs on your device. No addresses are sent to valsec or stored anywhere.I only see .local (mDNS) addresses — is that safe?
*.local mDNS hostnames so pages can't fingerprint your internal network. If that's all you see and no public IP appears, WebRTC isn't leaking a usable address. Seeing a public IP while on a VPN is the real concern.How do I stop WebRTC from leaking my IP?
media.peerconnection.enabled to false in about:config. In Chromium browsers use an extension such as WebRTC Network Limiter, or block udp:// at the firewall. Re-run this test afterwards to confirm.