WebRTC Leaks: How Your Real IP Can Escape a VPN

You connect to a VPN, check that your address changed, and assume you are hidden. But your browser may still be showing your real address to websites through a feature called WebRTC. This is a WebRTC leak.

What WebRTC is

WebRTC is a browser technology for real-time communication such as video calls, voice chat and peer-to-peer file transfer, without plugins. To connect two people directly, each browser needs to know its own public address, so it asks a STUN server. The server replies with the address it sees.

How the leak happens

That request is made by the browser itself, and it can travel outside the VPN tunnel. Any web page can start a WebRTC connection with a few lines of JavaScript, read the addresses the browser gathers, and send them to its own server. You do not see a prompt. If the address returned differs from the one the website sees through your VPN, the page has learned your real one.

Modern browsers hide your local network address behind a random name ending in .local, which helps. The public address is the part that can still leak.

How to test for a leak

1. Connect to your VPN.
2. Open our WebRTC leak test and press Run.
3. Compare the public address WebRTC reports with the address shown under “IP websites see”.

If they match, or WebRTC reports no public address at all, you are fine. If the WebRTC address is different and belongs to your real internet provider, you have a leak. You can look up any address with the IP lookup tool to see who it belongs to.

How to fix it

• Choose a VPN with leak protection. Many VPN apps and browser extensions block or rewrite WebRTC traffic.
• Change your browser setting. Firefox lets you set media.peerconnection.enabled to false on the about:config page, which disables WebRTC completely and will break browser video calls. Brave has a “WebRTC IP handling policy” setting under privacy.
• Use a privacy extension. Reputable extensions can restrict how WebRTC chooses network routes.
• Retest. Run the test again after every change.

What about DNS leaks?

A separate problem is a DNS leak, where your lookups go to your internet provider's resolver instead of the VPN's, revealing the sites you visit. A WebRTC test does not check for this. Use a dedicated DNS leak test that generates unique test hostnames, and make sure your VPN app's DNS protection is enabled. Also confirm your VPN covers IPv6, as explained in IPv4 vs IPv6.

Is WebRTC bad?

No. It makes video calls and voice chat in the browser possible. The risk only matters if you rely on a VPN or proxy to hide your address. See how to change your IP address for your options.