Why does WebRTC leak my IP even with a VPN?

WebRTC uses STUN/TURN servers to find candidate IPs for peer-to-peer connections. Modern browsers may report the underlying real IP rather than the VPN-tunnel IP. Most consumer VPNs block this via browser extensions or system-level routing; raw WebRTC behaviour varies.

How do I prevent WebRTC IP leak?

Disable WebRTC in your browser (Brave has a built-in toggle, Firefox via media.peerconnection.enabled=false in about:config) or use an extension. Most VPNs ship a blocker. Disabling WebRTC breaks video chat sites.

Is the leak shown by this tool what an arbitrary website would see?

Yes — this tool uses the same WebRTC APIs any site can use. If you see your real IP here, any site can see it. If only the VPN IP shows, the leak is sealed.

Is anything sent to a server?

The STUN request goes to a public STUN server (Google's) — that's how WebRTC IP discovery works. No third-party logging from this tool.

webrtc · ice · vpn · leak detector · local

Detect WebRTC IP leaks

WebRTC can expose your real IPs even through a VPN. This tester collects ICE candidates and flags anything public.

WebRTC Leak Tester

Total found

ips

Public

leaks

Local

private

Status

gathering…

ice

input · webrtc probe

How the probe works:

Open an RTCPeerConnection with a public STUN server.
Create a no-op data channel to start ICE gathering.
Each candidate yields an IP address — local or public.
If a public IP shows up while a VPN is active, it's a leak.

Nothing is uploaded — STUN is unicast UDP between you and Google's server.

output · candidates

Gathering ICE candidates…

Quick Start

How to test for WebRTC leaks

WebRTC's ICE protocol enumerates every network interface for media routing. That enumeration can betray a real IP even when a VPN is in use.

01
Open the tester
The scan starts automatically — it takes about a second.
Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.
startIANAregistryofflinelive
auto · queryscan · IANA
```
pc.createDataChannel()
```
loaded · IANA bundlespec · ready
02
Read each candidate
Green = local-only (private). Red = public IP exposed.
Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.
readRFC 9110canonicalspec-compliantlive
type · optionslocal · public · live
```
192.168.1.10 · 1.2.3.4
```
options applied · livecanonical
03
Compare with VPN
Toggle your VPN. If public IPs persist, the VPN is not fully blocking WebRTC.
Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.
vpnvalidationlintpitfallslive
vpn · looked upon/off · ready
```
re-scan
```
result · livevalidated
04
Mitigate
Disable WebRTC in your browser, use a stricter VPN, or block via extension.
Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.
fixclipboardMIME-correctblobcurl-ready
ok · copiedready · done
```
webrtc disabled
```
shipped · ready to shipsuccess

Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Use Cases

When to test for WebRTC leaks

VPN audits, privacy reviews, support triage.

VPN verification

Confirm that turning on a VPN actually hides your IP. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

Privacy reviews

Spot what trackers can read about your network. Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

Bug reports

Diagnose WebRTC connectivity for video apps. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

Browser config QA

Verify enterprise browser policies actually disable WebRTC. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

Corporate networks

Confirm VPN split-tunnelling rules behave as expected. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

Geo-restricted apps

Investigate why a service still detects your real region. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready

FAQ

Frequently asked questions

Is this 100% reliable?

It catches the common host/srflx ICE leaks. Some advanced VPNs still expose IPs via TURN or via mDNS hostnames that some browsers reveal.

Does it work in Tor Browser?

WebRTC is disabled by default in Tor Browser, so the tester typically returns no IPs there.

Will this collect or send my IP?

No. The IP appears in your browser via the WebRTC API; it's never sent to our server.

How do I block WebRTC entirely?

Browser flags (about:config in Firefox), enterprise policies, or extensions like uBlock can disable WebRTC peer connections.

Does it work locally?

Yes — the page contacts only a public STUN server. There's no backend.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!