WebRTC Leak Test

How to use it

1. Turn on your VPN, then open this page and press Run the test.
2. Wait a few seconds while the page contacts two public STUN servers.
3. Read the verdict. If it says a public address differs, turn the VPN off and on again, then run the test once more.

What the test does

WebRTC lets browsers connect directly to one another, for calls and file sharing. To find a route it gathers candidate addresses: the device's own addresses, and the public address a STUN server reports back. The test starts that gathering with two public STUN servers, Google's stun.l.google.com and Cloudflare's stun.cloudflare.com, and reads the candidates the browser finds.

The public address a STUN server reports is the address your traffic leaves from. If it is not the address our server sees for your request, a VPN may not be carrying all your traffic. The STUN servers see your public address, as they must to answer, and nothing else from this page.

How to stop WebRTC leaks, by browser

Each browser offers different controls, and the steps change between versions. Check the result of this test after every change.

• Firefox: open about:config and set media.peerconnection.ice.default_address_only to true, so WebRTC uses only the default route. Setting media.peerconnection.enabled to false switches WebRTC off altogether, which stops browser calls. Mozilla's wiki describes both settings.
• Edge: Microsoft documents a policy called WebRtcLocalhostIpHandling, set by administrators. Its value AllowPublicInterfaceOnly makes WebRTC use only the public interface. We did not find a setting for ordinary users.
• Brave: its settings include a WebRTC IP option, Default Public Interface Only, described in Brave's documentation. The menu position depends on the version.
• Chrome: we did not find an official setting for ordinary users. Extensions that apply the same limit are the usual route; choose one whose code you trust.
• Safari: we did not verify a setting for WebRTC addresses.
• Any browser: a VPN that blocks WebRTC traffic, or a VPN that routes the whole device, removes the problem at its source. Run this test again afterwards.

What this test does not show

• It does not test every route. A connection can use an address that the STUN servers did not report.
• It cannot tell which network interface a candidate came from, so an address that differs may come from an ordinary connection.
• A hidden .local name stands for a local address the browser did not reveal; the test cannot read it.

Frequently asked questions