What is a WebRTC leak?

WebRTC gathers ICE candidates so browsers can connect peer-to-peer. Those candidates can include your real local and public IP addresses, which a website can read in JavaScript even while a VPN is active.

How do I know if my VPN is leaking?

Run the live analyzer with the VPN connected. If the WebRTC module shows a public candidate that differs from the VPN exit IP, or exposes your LAN address, the tunnel is leaking.

How do I stop WebRTC leaks?

Use a VPN client with built-in WebRTC protection, enable your browser's WebRTC IP-handling policy to use the proxy only, or disable WebRTC entirely when you do not need calls.

What is an IP fraud score?

A 0-100 estimate of how suspicious an address looks to anti-fraud systems, built from anonymiser detection, datacentre ranges, carrier CGNAT, missing attribution and mismatches between the IP time zone and the browser time zone.

WebRTC leak test and IP fraud check

A VPN hides the IP in your HTTP requests — it does not automatically hide the addresses WebRTC discovers. This guide explains how leaks happen, how anti-fraud systems score your IP, and how to close the gap.

Updated 18 August 2026

Run the free live test

How WebRTC exposes your real IP

To set up peer-to-peer media, WebRTC asks the operating system for every reachable address and queries STUN servers for the public one. These ICE candidates are available to page JavaScript with no permission prompt. If the VPN only routes browser traffic, or the client does not patch the browser's IP-handling policy, the candidate list can still contain your ISP-assigned address and your LAN address such as 192.168.1.x.

What the network module reports

Public IP, ASN and ISP — resolved server-side so ad blockers cannot break the lookup.
Connection type — mobile carrier SIM, fixed broadband, or hosting/VPN range.
Allocation — dynamic (typically CGNAT mobile) versus static business-style addressing.
Time-zone mismatch — the browser time zone compared with the IP's time zone, a classic proxy tell.
IP fraud score — 0-100 with a per-signal point breakdown.

How anti-fraud systems read your IP

Payment processors, signup flows and ad networks rarely block on IP alone, but a hosting or anonymiser range raises the bar for everything else: more CAPTCHAs, phone verification, or manual review. Residential and mobile addresses score far lower, which is precisely why residential proxy networks exist — and why device fingerprint signals are used alongside the IP.

Fixing leaks

Enable your VPN client's WebRTC or "block leaks" protection.
In Chromium browsers, set the WebRTC IP-handling policy to route only through the proxy.
In Firefox, set media.peerconnection.enabled to false if you never make browser calls.
Re-run the test after each change — the analyzer shows candidates live.

Frequently asked questions

What is a WebRTC leak?: WebRTC gathers ICE candidates so browsers can connect peer-to-peer. Those candidates can include your real local and public IP addresses, which a website can read in JavaScript even while a VPN is active.
How do I know if my VPN is leaking?: Run the live analyzer with the VPN connected. If the WebRTC module shows a public candidate that differs from the VPN exit IP, or exposes your LAN address, the tunnel is leaking.
How do I stop WebRTC leaks?: Use a VPN client with built-in WebRTC protection, enable your browser's WebRTC IP-handling policy to use the proxy only, or disable WebRTC entirely when you do not need calls.
What is an IP fraud score?: A 0-100 estimate of how suspicious an address looks to anti-fraud systems, built from anonymiser detection, datacentre ranges, carrier CGNAT, missing attribution and mismatches between the IP time zone and the browser time zone.

Back to the analyzer