Is Your VPN Leaking Your Identity?
We test IPv4, IPv6, DNS servers, and WebRTC to detect if your real identity is exposed - even with a VPN active.
What Is an IP Leak?
An IP leak is any situation where your real IP address reaches a website despite an active VPN connection. The critical detail is that a leak is silent. Your VPN client still shows “Connected”, your traffic still appears encrypted, and a simple “what is my IP” lookup still returns the VPN server’s address. Meanwhile a second channel - DNS, WebRTC or IPv6 - is handing your identity to every site you visit.
This is why a single-number IP check is not a VPN test. A VPN can only be considered working if every channel that can carry your address is either inside the tunnel or blocked. This page checks all five at once.
The Five Ways a VPN Leaks Your Identity
Each of these is an independent failure mode. Passing four and failing one leaves you fully exposed - a single leaking channel is enough to identify you.
| Channel | What leaks | How common |
|---|---|---|
| IPv4 address | Your real public address, seen by every server you contact. | Rare - this is the one thing every VPN gets right. |
| DNS queries | Every domain name you look up, sent to your ISP’s resolver instead of the VPN’s. | Common, especially on Windows. |
| WebRTC | Local and public addresses read straight from the OS network stack by any web page. | Very common in Chromium browsers. |
| IPv6 | Your household’s persistent IPv6 prefix, routed outside an IPv4-only tunnel. | Very common - and almost never tested. |
| Geolocation mismatch | Timezone, language or geolocation API disagreeing with the VPN exit country. | Universal - this is how sites detect VPN use. |
The last row is different in kind from the others. A timezone mismatch does not reveal your IP address, but it does tell a website that you are using a VPN - which is what triggers streaming blocks, payment declines and additional verification steps. Our VPN identity test examines that dimension across eight signals.
Which Leak Test Should You Run?
The test on this page covers every channel at once and is the right starting point for almost everyone. If one row fails, the dedicated pages below go deeper into that specific failure - more diagnostics, platform-specific fixes and the details this summary leaves out.
| If this fails here… | Go deeper | Why |
|---|---|---|
| DNS row | DNS Leak Test | Resolver-by-resolver breakdown, DoH/DoT guidance, the Windows multi-homed resolution fix |
| WebRTC row | WebRTC Leak Test | Full ICE candidate list and per-browser blocking instructions |
| IPv6 row | IPv6 Leak Test | Separate HTTP and WebRTC IPv6 probes, plus per-OS disable steps |
| Geolocation row | VPN Identity Test | Eight coherence signals that tell sites you are on a VPN |
| Nothing fails, but you want more | Kill Switch Test | This page tests the tunnel while it is up; that one tests what happens when it drops |
Testing a Specific VPN?
The test above works with every provider. These pages add the settings that matter for that particular client - where its kill switch lives, how it handles IPv6, and which of its features change what a leak test reports.
How to Read Your Results
Expand any row to see the raw values behind the verdict. Here is what to look for.
- IPv4: the address shown should belong to your VPN provider, not your ISP. Compare the ISP and organisation fields against the provider you are paying.
- DNS: the resolvers listed should belong to your VPN provider or a privacy resolver you chose deliberately. Seeing your ISP’s name here means your browsing history is going to your ISP regardless of the tunnel.
- WebRTC: a private address in the
192.168.x.xor10.x.x.xrange is harmless - that is your local network. A public address that differs from your VPN exit is a genuine leak. - IPv6: either no IPv6 at all, or an IPv6 address belonging to your VPN. Anything else is a leak - see the dedicated IPv6 leak test.
- Geolocation: your browser timezone should match the country of your exit server. A mismatch will not expose your IP, but it marks the session as VPN traffic.
Run the test twice - once with the VPN disconnected, once connected. Any value that stays identical across both runs is travelling outside the tunnel. This is the single most reliable way to interpret an ambiguous result.
How to Fix a Leaking VPN
Fixing DNS leaks
Enable “DNS leak protection” in your VPN client, or set your resolver manually to Cloudflare (1.1.1.1) or Quad9 (9.9.9.9). On Windows, also disable “Smart Multi-Homed Name Resolution”, which deliberately queries every available resolver in parallel and is the root cause of most DNS leaks on that platform.
Fixing WebRTC leaks
In Firefox, set media.peerconnection.enabled to false in about:config. Chromium browsers offer no built-in switch, so use an extension such as uBlock Origin’s “Prevent WebRTC from leaking local IP addresses” option. Be aware this breaks browser-based video calls.
Fixing IPv6 leaks
Either switch to a provider that tunnels IPv6, or disable IPv6 in your network adapter settings. Disabling it is the more robust option, because it removes the failure mode entirely instead of depending on your client behaving correctly after every update.
Fixing the underlying problem
If several channels leak at once, the cause is usually the client rather than your configuration. Switch the protocol to WireGuard, enable the kill switch, and re-test. If leaks persist, the provider is the problem - verify your kill switch actually works using our kill switch test before trusting it with anything sensitive.
How This Test Works
Everything runs in your browser. We do not require an account, and no result is stored unless you explicitly tick the “share this result” box after the test - and even then we keep the outcome, your VPN provider and exit country, never your IP address.
- IPv4 and IPv6: resolved against separate protocol-specific endpoints, so one cannot mask the other.
- DNS: we trigger lookups for randomised hostnames and observe which resolvers request them, revealing the servers your system actually uses.
- WebRTC: an
RTCPeerConnectionis opened and its ICE candidates are read - the same technique any website can use against you. - Geolocation: your browser’s timezone and locale are compared against the country of the detected exit IP.
Scoring rules are documented on our methodology page.
🧰 Related Leak Tests
Every test runs entirely in your browser - nothing is stored unless you choose to share the result.
IP Leak Test - FAQ
What IP leaks are, how to detect them, and what to do when your VPN fails a check.
What is an IP leak test?
An IP leak test checks whether your real IP address is reaching websites despite an active VPN. Rather than simply displaying one address, a proper test probes every channel that can carry your identity independently of the tunnel: IPv4, IPv6, DNS resolution, WebRTC, and geolocation signals. A VPN is only working if all of them either go through the tunnel or are blocked.
My VPN says connected - why does the test show a leak?
Because “connected” only describes the IPv4 tunnel. DNS queries, WebRTC and IPv6 traffic each use different parts of the operating system, and a client that fails to capture them will still report a healthy connection. This is the normal case rather than an unusual one, which is exactly why a connection indicator is not evidence of privacy.
Is a 192.168.x.x address in the WebRTC row a leak?
No. Addresses in the 192.168.x.x, 10.x.x.x and 172.16-31.x.x ranges are private local network addresses. They cannot be routed over the internet and reveal nothing beyond the fact that you are behind a router, which is true of virtually everyone. Only a public address that differs from your VPN exit address constitutes a WebRTC leak.
How often should I run a leak test?
After any change that touches your network stack: a VPN client update, an operating-system upgrade, a switch to a different server or protocol, or a new browser. These are the moments when leak protection regresses. It is also worth a quick run before doing anything where exposure genuinely matters, since a leak introduced last week produces no visible symptom at all.
Does a DNS leak matter if my IP is hidden?
Yes, and it is one of the most consequential leaks. DNS queries contain the domain name of everything you visit. If those queries go to your ISP’s resolver, your ISP has a complete log of your browsing history - the exact record a VPN is usually purchased to prevent - even though every site you contact sees only the VPN’s address.
Do you store my test results?
Not unless you ask us to. Every check runs in your browser, and by default the results exist only in the page you are looking at - closing the tab discards them. After a test you can tick a box to share the result anonymously for our public VPN database; that is off by default, and if you leave it alone nothing is sent. When you do share, we store the outcome, your VPN provider and exit country - never your IP address.
Why does the geolocation row fail when nothing is leaking?
That row does not detect address leaks - it detects inconsistency. If your browser reports a Berlin timezone while your exit server is in Singapore, no IP has leaked, but the mismatch identifies the session as VPN traffic. Streaming services, banks and fraud-detection systems use precisely this signal, which is why it is reported alongside the leak checks.
Which VPN leaks the least?
Providers with audited WireGuard implementations and firewall-level leak blocking - Mullvad, ProtonVPN and IVPN among them - perform consistently well. But leak behaviour varies by client version and by platform: the same provider can be clean on desktop and leaky on mobile. Test your own setup rather than relying on any provider ranking, including this paragraph.