How We Test VPNs

We query ipapi.co/json to retrieve your visible IPv4 address and ISP. If the ISP matches a known VPN or hosting provider, your IP is considered protected.

For IPv6, we query api64.ipify.org - if a public IPv6 address is returned that differs from your VPN IP, a leak is detected.

Pass condition: visible IP belongs to a VPN/hosting ASN, no differing IPv6 detected.

We check whether your DNS resolver is routing through your VPN provider or leaking to your real ISP. We cross-reference the ASN of the DNS resolver against known VPN provider ASNs.

Pass condition: DNS resolver ASN matches a VPN/hosting provider, not a residential ISP.

Using the browser's native RTCPeerConnection API and Google's STUN server (stun.l.google.com:19302), we collect all ICE candidates exposed by your browser.

Local IPs (192.168.x.x, 10.x.x.x) are normal and expected. A leak occurs when a public IP appears that differs from your VPN IP.

Pass condition: no public IP exposed via WebRTC that differs from your visible VPN IP.

Ping & Jitter: We send 5 HEAD requests to cloudflare.com/cdn-cgi/trace and measure round-trip time. Jitter = max minus min of trimmed samples.

Download: We fetch a 10 MB file from speed.cloudflare.com/__down and calculate throughput. Falls back to httpbin.org if Cloudflare is blocked.

Upload: We POST a 2 MB buffer to speed.cloudflare.com/__up and measure throughput.

Ratings: ≥100 Mbps = Excellent · ≥25 = Good · ≥5 = Fair · <5 = Poor

We inspect the current connection using browser APIs: window.location.protocol, performance.getEntriesByType, and navigator properties.

We check: TLS version (1.3 = A, 1.2 = B, older = F), HTTPS enforcement, HSTS header presence, mixed content, and browser fingerprint entropy.

Grading: A (all pass) → B (minor issues) → C/D (degraded) → F (critical failures).

We poll your visible IP every 3 seconds using ipapi.co/json. Your baseline IP is recorded when you start the test.

If the IP changes during the session, we log the event with a timestamp. When you stop the test, we render a verdict: PROTECTED (no leak) or FAILED (real IP exposed).

How to test: Start the test → disconnect your VPN → watch if your real IP appears in the log.

⚠ Known Limitations

• · IP detection accuracy depends on ipapi.co ASN database - some VPN IPs may be misclassified.
• · Speed test results reflect your VPN connection to Cloudflare's nearest PoP, not absolute bandwidth.
• · TLS inspection is limited by what browsers expose via JavaScript - full cipher negotiation details require server-side tools.
• · WebRTC can be disabled by the browser or extensions, causing false "no leak" results.