WebRTC leak test
Browsers use WebRTC for video calls, and to set one up they discover your public address directly — around any proxy or badly configured VPN. This test shows what WebRTC reveals and compares it with the address websites see.
When you press Run, your browser asks Cloudflare’s public STUN server (stun.cloudflare.com) which address it sees, exactly as a video-call site would. Nothing is stored, and the result stays on this page.
When you press Run, your browser asks Cloudflare’s public STUN server (stun.cloudflare.com) which address it sees, exactly as a video-call site would. Nothing is stored, and the result stays on this page.
What the test does
- Asks MyIPKit which address your request came from — the address every website sees.
- Opens a WebRTC connection attempt, which asks a STUN server which address it sees, and collects the addresses the browser offers.
- Compares the two, and checks whether your local address is exposed or hidden.
What your IP address reveals covers what a leaked address actually tells someone — less than the warnings suggest, but it is the thing a VPN is meant to hide.
What is a WebRTC leak?
To set up a direct call, the browser asks a STUN server which public address it sees. That request does not go through a browser proxy, and a VPN that does not cover it lets it out directly — so a site using WebRTC can learn the real address the VPN was meant to hide.
How do I stop it?
Most VPN apps have a WebRTC or leak-protection setting; turn it on. In Firefox, media.peerconnection.enabled in about:config switches WebRTC off entirely. In Chromium browsers, Google’s WebRTC Network Limiter extension, or a privacy extension’s WebRTC option, restricts it. Blocking WebRTC also stops video calls in the browser.
Does it matter if I do not use a VPN?
Hardly. Without a VPN, the public address WebRTC reveals is the same one every website already sees.
Why is my local address hidden?
Since about 2019, browsers replace local addresses in WebRTC with random .local names, so sites cannot map your home network. The real address appears only in special cases, such as after you grant a site camera or microphone access.
What does this test send, and where?
One STUN request from your browser to Cloudflare’s public STUN server, and one request to MyIPKit to see which address we see. The result is not stored.