VPN test: is your VPN working?

Connect your VPN, then press Run the VPN test. The test takes a few seconds: it reads the address websites see, issues DNS lookups for unique hostnames under our own test zone, asks your browser for its WebRTC addresses through our STUN server and fetches a tiny file over IPv4-only and IPv6-only hosts. For the most reliable DNS verdict, run it once before connecting the VPN too — the page then knows your real provider's resolver and can recognize it with certainty.

The verdict card says No leaks found, One thing to fix or Your real address is exposed, and each test below it shows what was observed, which network it belongs to and how confident the verdict is. A Review result means we saw a third-party resolver and cannot tell whether it is your VPN's own DNS (fine) or your ISP's (a leak); the resolver's operator name usually makes that obvious.

A VPN only protects what actually goes through the tunnel. Each test looks at a different path traffic can take around it.

Compares the address seen over HTTP with what the VPN should show. If the verdict names your home or mobile ISP as the operator, the VPN is not carrying your traffic at all — it may be disconnected, in split-tunnel mode or blocked.

Your browser resolves our unique test hostnames; whichever resolvers ask our nameserver for them are the ones handling your DNS. If one belongs to your ISP, or if a public resolver forwards your real network prefix (EDNS Client Subnet), DNS is leaving outside the tunnel. The DNS leak test page runs the 36-lookup extended version.

WebRTC can send UDP packets directly from your network interfaces. We ask your browser to gather its addresses against our own STUN server and compare them with the address websites see. A different public address means WebRTC bypasses the VPN. Details on the WebRTC leak test page.

Many VPNs tunnel IPv4 only. If your connection also has IPv6 and the IPv6 address belongs to a different network than your VPN address, sites that support IPv6 see your real connection. The IPv6 test shows both families.

BitTorrent clients announce an address to trackers independently of your browser, so a browser test cannot prove the client is tunneled. The checks above cover the network paths a client can take (IPv4, IPv6, DNS); a tracker-based check that shows the exact address your client announces is planned for this page.

Most leaks come from one of three settings, and each has a direct fix.

In the VPN app, turn on the option that forces DNS through the tunnel (names vary: DNS leak protection, Use VPN DNS, Block DNS outside tunnel). If the app has no such option, set your system DNS to a public resolver and enable the VPN's kill switch. On Windows, also disable Smart Multi-Homed Name Resolution via group policy, which otherwise queries every interface at once. Re-run the test after each change; the DNS leak test page has per-system steps.

Enable the VPN app's WebRTC protection or browser extension if it offers one. In Firefox set media.peerconnection.ice.default_address_only to true (or disable WebRTC entirely with media.peerconnection.enabled); in Chrome and Edge use an extension that sets the WebRTC IP handling policy to disable non-proxied UDP; Brave has the same setting under Privacy. Full steps per browser on the WebRTC leak test page.

If your VPN cannot tunnel IPv6, the clean fix is a VPN that can. The workaround is disabling IPv6 on the device or in the router while the VPN is in use; most VPN apps offer an IPv6 leak protection switch that does this for you.

Open this page in the browser of the device in question — phone, tablet, laptop, or a browser on a TV — with the VPN connected, and run the test. Because every test runs from the device itself, the result applies to that device only; a VPN on your laptop says nothing about your phone. For a router-level VPN, run the test from any device behind the router. For devices without a browser (consoles, smart TVs), run it from a device on the same network and VPN; the IP and DNS parts apply to the whole network, the WebRTC part does not.