Is Your VPN Leaking Your Identity?
We test IPv4, IPv6, DNS servers, and WebRTC to detect if your real identity is exposed - even with a VPN active.
What Is an IP Leak?
An IP leak is any situation where your real IP address reaches a website despite an active VPN connection. The critical detail is that a leak is silent. Your VPN client still shows “Connected”, your traffic still appears encrypted, and a simple “what is my IP” lookup still returns the VPN server’s address. Meanwhile a second channel - DNS, WebRTC or IPv6 - is handing your identity to every site you visit.
This is why a single-number IP check is not a VPN test. A VPN can only be considered working if every channel that can carry your address is either inside the tunnel or blocked. This page checks all five at once.
The Five Ways a VPN Leaks Your Identity
Each of the first four is an independent failure mode, and one leaking channel is enough to expose your address. The fifth exposes nothing, but tells a site the address is not where you are.
| Channel | What leaks |
|---|---|
| IPv4 address | Your real public address, seen by every server you contact. |
| DNS queries | Every domain name you look up, sent to a resolver outside the tunnel - your ISP’s, or a public one you set yourself - instead of the VPN’s. |
| WebRTC | Local and public addresses read straight from the OS network stack by any web page. |
| IPv6 | Your household’s persistent IPv6 prefix, routed outside an IPv4-only tunnel. |
| Geolocation mismatch | Your browser timezone on a different continent from the VPN exit. |
The last row is different in kind from the others. A timezone mismatch does not reveal your IP address, but it does tell a website that the address is not where you are - one of the signals behind payment declines and extra verification steps. Streaming services can block on the address alone, from lists of datacenter and proxy addresses. Our VPN identity test checks both: whether your address is on those lists, and which browser signals contradict it.
Which Leak Test Should You Run?
The test on this page covers every channel at once, which makes it the place to start. If one row fails, the dedicated pages below go deeper into that specific failure - more diagnostics, platform-specific fixes and the details this summary leaves out.
| If this fails here… | Go deeper | Why |
|---|---|---|
| DNS row | DNS Leak Test | Resolver-by-resolver breakdown, DoH/DoT guidance, the Windows multi-homed resolution fix |
| WebRTC row | WebRTC Leak Test | Full ICE candidate list and per-browser blocking instructions |
| IPv6 row | IPv6 Leak Test | Separate HTTP and WebRTC IPv6 probes, plus per-OS disable steps |
| Geolocation row | VPN Identity Test | Whether your address is on datacenter or proxy lists, and which browser signals contradict it |
| Nothing fails, but you want more | Kill Switch Test | This page tests the tunnel while it is up; that one tests what happens when it drops |
Testing a Specific VPN?
The test above works with every provider. These pages add the settings that matter for that particular client - where its kill switch lives, how it handles IPv6, and which of its features change what a leak test reports.
How does this test differ from dnsleaktest, ipleak, browserleaks or whoer? What each one actually checks, ours included.
How to Read Your Results
Expand any row to see the raw values behind the verdict. Here is what to look for.
- IPv4: the address shown should belong to your VPN provider, not your ISP. Compare the ISP and organisation fields against the provider you are paying.
- DNS: the resolvers listed should sit in the same network as your VPN exit. Your ISP’s name, or a public resolver such as
1.1.1.1, means your lookups are leaving the tunnel - even if you chose that resolver deliberately, this test reports it as a leak. - WebRTC: a private address in the
192.168.x.xor10.x.x.xrange is harmless - that is your local network. A public address that differs from your VPN exit is a genuine leak. - IPv6: either no IPv6 at all, or an IPv6 address on VPN or hosting infrastructure. One on your ISP’s network while IPv4 goes through the VPN is a leak - see the dedicated IPv6 leak test.
- Geolocation: your browser timezone should be on the same continent as your exit server. A mismatch will not expose your IP, but it tells a site the address is not where you are.
Run the test twice - once with the VPN disconnected, once connected. Any address or resolver that stays identical across both runs is travelling outside the tunnel. This is the single most reliable way to interpret an ambiguous result.
How to Fix a Leaking VPN
Fixing DNS leaks
Let your VPN app handle DNS: turn on its own DNS, or “DNS leak protection”, and remove any resolver you set by hand. Setting a public resolver such as 1.1.1.1 yourself does not fix a leak - lookups then go to that resolver’s network instead of your VPN’s, and this test reports exactly that. On Windows, also disable “Smart Multi-Homed Name Resolution”, which deliberately queries every available resolver in parallel and is a known cause of DNS leaks on that platform. The DNS leak guide goes cause by cause, per operating system.
Fixing WebRTC leaks
In Firefox, set media.peerconnection.enabled to false in about:config - be aware this breaks browser-based video calls. Chrome and Edge: there is no built-in switch. Use an extension that limits WebRTC to the tunnel’s address - check that it supports your browser version - or use Firefox or Brave, which have the setting built in.
Fixing IPv6 leaks
Either switch to a provider that tunnels IPv6, or disable IPv6 in your network adapter settings. Disabling it is the more robust option, because it removes the failure mode entirely instead of depending on your client behaving correctly after every update.
Fixing the underlying problem
If several channels leak at once, look at the VPN client first: one setting there can explain them all. Switch the protocol to WireGuard, enable the kill switch, and re-test. If leaks persist, the provider is the problem - verify your kill switch actually works using our kill switch test before trusting it with anything sensitive.
How This Test Works
The checks run in your browser; which network an address belongs to is looked up by our server with ip-api.com. We do not require an account, and no result is stored unless you explicitly tick the “share this result” box after the test - and even then we keep the outcome, your VPN provider, the exit network, country and city, your browser and OS family, and where your visit came from - never your IP address. The privacy page lists every field.
- IPv4 and IPv6: each address is read separately - the IPv4 one from an endpoint that has no IPv6 address - and our server looks each up on its own, so one cannot mask the other. IPv6 counts as leaking when IPv4 is tunnelled and IPv6 leaves through a consumer network.
- DNS: we trigger lookups for randomised hostnames and observe which resolvers request them, revealing the servers your system actually uses.
- WebRTC: an
RTCPeerConnectionis opened and its ICE candidates are read - the same technique any website can use against you. - Geolocation: your browser’s timezone is compared with the continent of your IPv4 exit. The browser language is shown, not scored.
Scoring rules are documented on our methodology page.
🧰 Related Leak Tests
The tests run in your browser. Where one needs to know whose network an address is on, our server looks it up and keeps no address. Nothing is stored unless you choose to share the result.
📚 Read next
The longer version: what this test is looking for, and what to do with the answer.
IP Leak Test - FAQ
What IP leaks are, how to detect them, and what to do when your VPN fails a check.
What is an IP leak test?
An IP leak test checks whether your real IP address is reaching websites despite an active VPN. Rather than simply displaying one address, a proper test probes every channel that can carry your identity independently of the tunnel: IPv4, IPv6, DNS resolution, WebRTC, and geolocation signals. A VPN is only working if all of them either go through the tunnel or are blocked.
My VPN says connected - why does the test show a leak?
Because “connected” only describes the IPv4 tunnel. DNS queries, WebRTC and IPv6 traffic each use different parts of the operating system, and a client that fails to capture them will still report a healthy connection. This happens without any warning, which is exactly why a connection indicator is not evidence of privacy.
Is a 192.168.x.x address in the WebRTC row a leak?
No. Addresses in the 192.168.x.x, 10.x.x.x and 172.16-31.x.x ranges are private local network addresses. They cannot be routed over the internet and reveal nothing beyond the fact that you are behind a router, which is true of virtually everyone. Only a public address that differs from your VPN exit address constitutes a WebRTC leak.
How often should I run a leak test?
After any change that touches your network stack: a VPN client update, an operating-system upgrade, a switch to a different server or protocol, or a new browser. These are the moments when leak protection regresses. It is also worth a quick run before doing anything where exposure genuinely matters, since a leak introduced last week produces no visible symptom at all.
Does a DNS leak matter if my IP is hidden?
Yes, and it is one of the most consequential leaks. DNS queries contain the domain name of everything you visit. If those queries go to your ISP’s resolver, your ISP has a complete log of your browsing history - the exact record a VPN can be bought to prevent - even though every site you contact sees only the VPN’s address.
Do you store my test results?
Not unless you ask us to. Every check runs in your browser, and by default the results exist only in the page you are looking at - closing the tab discards them. After a test you can tick a box to share the result anonymously for our public VPN database; that is off by default, and if you leave it alone nothing is sent. When you do share, we store the outcome, your VPN provider, the exit network, country and city, your browser and OS family, and where your visit came from - never your IP address. The privacy page lists every field.
Why does the geolocation row fail when nothing is leaking?
That row does not detect address leaks - it detects inconsistency. If your browser reports a Berlin timezone while your exit server is in Singapore, no IP has leaked, but the mismatch tells a site the address is not where you are. Fraud systems can weigh it; streaming services can decide on the address alone, which the VPN identity test checks. That is why it is reported alongside the leak checks rather than as one.
Which VPN leaks the least?
We cannot say yet and will not guess. Our results database names a provider only after 30 shared results, and none has reached that yet. Our lab measures the providers it runs for speed, DNS and exit networks, not IPv6 or WebRTC. Leak behaviour also varies by client version and by platform: the same provider can be clean on desktop and leaky on mobile. Test your own setup.