CloakMyIPAddress

WebRTC Leak Test: Check if Your Browser Exposes Your Real IP

Free WebRTC leak test. Learn why WebRTC can expose your real IP address even on a VPN, and how to fix it in Chrome, Firefox, Edge, Safari and Brave.

By CloakMyIPAddress Privacy Desk Published

Disclosure: Some links go to VPN providers via our /go/ links and may earn us a commission in future, at no cost to you. Disclosure

On this page
  1. What WebRTC is
  2. How the leak happens
  3. What browsers changed
  4. How to run the test
  5. How to fix a WebRTC leak
  6. Option 1: Use your VPN’s built-in protection
  7. Option 2: Firefox
  8. Option 3: Chrome and Edge
  9. Option 4: Brave
  10. Option 5: Safari
  11. Option 6: Mobile
  12. Does a WebRTC leak matter?
  13. Reading the results: real examples
  14. A quick note on extensions
  15. Related tests and guides
  16. FAQ
  17. Sources

Last reviewed: 30 October 2026 · By the CloakMyIPAddress Privacy Desk

Live test

Your public IP Checking…

Connection

IPv4
—
IPv6
—
Location
—
ISP / network
—

Leak test

Checks whether WebRTC exposes a different IP than the one websites see, which DNS resolvers handle your lookups, and whether IPv6 takes a different route than IPv4.

Browser

Quick answer: WebRTC is the browser technology behind in-browser video calls. To connect two people it collects your IP addresses, and any website can ask for them with a few lines of JavaScript. If your VPN doesn’t route this through the tunnel, a site can see your real public IP. Run the test above with your VPN on. If it shows an IP that isn’t your VPN’s, fix it with your VPN’s leak protection, a browser setting, or the official extension listed below.

What WebRTC is

WebRTC (Web Real-Time Communication) is a set of web standards that lets browsers exchange audio, video and data directly, without plugins. It powers web versions of Google Meet, Microsoft Teams, Discord, Jitsi and many customer-support chat widgets.

To connect two browsers that are both behind routers, WebRTC uses a process called ICE. Your browser gathers “candidates” — addresses where it might be reachable:

  • Host candidates – your device’s local addresses (e.g. 192.168.1.23).
  • Server-reflexive candidates – your public IP, discovered by asking a STUN server “what address do you see me coming from?”
  • Relay candidates – an address on a TURN relay server.

A website can create a WebRTC connection object and read these candidates without asking you for camera or microphone permission.

How the leak happens

On a VPN, normal web traffic goes through the tunnel, so websites see the VPN’s IP. But if the browser’s STUN request goes out over your regular connection — or the browser reveals interface addresses directly — the server-reflexive candidate is your real public IP. The site can then compare it with the IP it sees for the page and spot the difference.

What browsers changed

The IETF standard RFC 8828 (WebRTC IP Address Handling Requirements) defines modes for limiting what’s exposed. Since around 2019–2020, Chrome, Firefox and Safari hide local host addresses behind random mDNS names ending in .local unless you grant camera/mic access. That fixed most local IP leaks. The public IP leak still depends on whether your traffic, including UDP STUN requests, is forced through the VPN.

How to run the test

  1. Disconnect your VPN, run the test, and note your real public IP.
  2. Connect your VPN (kill switch on) and reload the page.
  3. Run the test again.
  4. Pass: the only public IP shown is your VPN’s. Local entries appear as random .local names or private ranges (10.x, 172.16–31.x, 192.168.x) — those are normal.
  5. Leak: your real public IP from step 1 appears anywhere in the results.
  6. Repeat in each browser you use.

How to fix a WebRTC leak

Option 1: Use your VPN’s built-in protection

Full-device VPN apps generally route all UDP traffic, including STUN, through the tunnel when the kill switch / “block connections without VPN” option is on. Browser extensions from VPN providers can also restrict WebRTC. If your VPN leaks with its app connected and kill switch on, report it to the provider or switch — providers with published independent audits include Proton VPN, NordVPN, Surfshark and ExpressVPN.

Option 2: Firefox

  1. Type about:config in the address bar and accept the warning.
  2. Search media.peerconnection.enabled and set it to false to disable WebRTC entirely, or
  3. Keep WebRTC but limit it: set media.peerconnection.ice.default_address_only to true (only the default route is used) and media.peerconnection.ice.no_host to true (no local addresses).

Disabling WebRTC breaks browser video calls; the second option usually doesn’t.

Option 3: Chrome and Edge

Chrome has no built-in on/off switch. Install Google’s own WebRTC Network Limiter extension from the Chrome Web Store and choose “Use my proxy server (if present)” or the most restrictive option. This forces WebRTC to follow the same route as normal traffic. Edge can use the same extension.

Option 4: Brave

Brave → Settings → Privacy and security → WebRTC IP handling policy → choose “Disable non-proxied UDP”.

Option 5: Safari

Safari exposes WebRTC candidates only after a site is granted camera/microphone access, and hides local IPs by default. Keep camera/mic permissions set to “Ask” (Safari → Settings → Websites → Camera/Microphone) and use a full-device VPN.

Option 6: Mobile

On iPhone and Android, the leak is mostly prevented by using an always-on, full-device VPN (Android: Settings → Network & internet → VPN → ⚙ → Always-on VPN + Block connections without VPN). Firefox for Android also supports about:config.

Does a WebRTC leak matter?

If you use a VPN to keep your location or home IP private from websites, yes — a WebRTC leak defeats that silently. If you use a VPN only to secure public Wi-Fi, the leak matters less, because your traffic is still encrypted. Either way, it takes two minutes to fix.

Reading the results: real examples

What the test showsMeaningAction
Only one public IP, matching the VPN server; local entries as xxxx.localPassNone
A private address like 192.168.1.23Local address visible; not your public IPLow risk; enable mDNS/limit host candidates if you want
A second public IP that matches your home connectionLeakApply the fixes above, re-test
An IPv6 address from your home providerIPv6 leak via WebRTCSee IPv6 leak test
No candidates at allWebRTC disabled or blockedFine for privacy; browser video calls may not work

A quick note on extensions

Many “WebRTC blocker” extensions in browser stores are made by unknown developers. An extension that can read every page you visit is a privacy risk in itself. Prefer browser settings, your VPN provider’s official app or extension, or Google’s own WebRTC Network Limiter, and remove extensions you no longer use.

FAQ

What is a WebRTC leak? A website reading your real IP via the browser’s WebRTC feature despite a VPN.

Should I disable WebRTC? Only if your VPN/browser doesn’t stop the leak; disabling breaks browser video calls.

Do modern browsers still leak? Local IPs are now masked by mDNS; public IP leaks depend on routing.

Sources