WebRTC leak test
WebRTC lets your browser discover its own network addresses to set up calls and video chats — and any website can trigger that discovery silently. This test shows exactly which addresses your browser reveals and whether one of them is your real address behind a VPN or proxy.
Your browser gathers ICE candidates against our own STUN server; every public address in them is compared with the address websites see over HTTP.
Checking
| Type | Address | Port | Protocol | Family | Scope |
|---|---|---|---|---|---|
| srflx | 203.0.113.5 | 51234 | udp | IPv4 | public |
Fix for your browser
Chrome
- Chrome has no switch in its settings. Install an extension that sets the WebRTC IP handling policy — Google's own “WebRTC Network Limiter” exposes it — and choose “Disable non-proxied UDP” (listed there as using your proxy server, forcing UDP through it or falling back to TCP).
- Alternatively use your VPN provider's browser extension if it offers WebRTC protection, or on a managed device the WebRtcIPHandling policy (value disable_non_proxied_udp; Chrome 135+ also accepts per-site rules with WebRtcIPHandlingUrl).
- Local addresses are already hidden: Chrome 74+ replaces them with mDNS names. Chrome for Android and iOS has no equivalent setting; rely on the VPN app's kill switch.
- Re-run this test.
Firefox
- Open about:config and accept the warning.
- Set media.peerconnection.ice.default_address_only to true so only the default route (the VPN while connected) is used, and media.peerconnection.ice.no_host to true to remove local addresses.
- If you browse through a proxy, also set media.peerconnection.ice.proxy_only_if_behind_proxy to true so WebRTC goes through the proxy or not at all.
- To switch WebRTC off entirely set media.peerconnection.enabled to false (browser calls stop working). Firefox already hides local addresses behind mDNS names.
- Re-run this test.
Safari
- Safari has no WebRTC switch. It hands out a STUN (server-reflexive) candidate without any permission prompt and only reveals local candidates — as mDNS names — after a site gets camera or microphone access.
- A leak reported here therefore means UDP left the VPN tunnel: use a VPN with a kill switch and IPv6 support, and avoid proxies for anonymity (they never carry UDP).
- On iPhone and iPad, Lockdown Mode (Settings › Privacy & Security) disables WebRTC entirely, which also stops the leak.
- Do not enable Develop › WebRTC › Disable ICE Candidate Restrictions: it is a developer option that exposes more, not less.
- Re-run this test.
Edge
- Edge has no user-facing switch either. Use an extension that sets the WebRTC IP handling policy to “Disable non-proxied UDP”, or your VPN provider's extension.
- On managed devices set the WebRtcLocalhostIpHandling policy, or in Edge 135+ WebRtcIPHandlingUrl with handling disable_non_proxied_udp for the pattern *.
- Edge on Android and iOS cannot change this; use the VPN app's leak protection.
- Re-run this test.
Brave
- Open Settings › Privacy and security (brave://settings/privacy).
- Under WebRTC IP handling policy choose “Disable non-proxied UDP”. “Default public interface only” also prevents local-address exposure while keeping UDP.
- Brave Shields with fingerprinting protection on already applies the non-proxied-UDP policy; the same option exists in Brave for Android under Settings › Privacy and security.
- Re-run this test.
Other browsers
- Chromium-based browsers (Opera, Vivaldi, Samsung Internet) accept the same extensions and the WebRtcIPHandling policy as Chrome.
- If no setting exists, the VPN app's kill switch or “block WebRTC” option is the fix.
- Re-run this test.
After changing a setting, run the test again: the result should read No leak or Blocked.
Run the WebRTC leak test
The test runs in your browser. It opens a WebRTC connection against our own STUN server (never a third party's), collects the ICE candidates the browser produces, and compares every public address in them with the address websites see over HTTP. It takes under a second; nothing from the candidates is sent to our server.
Your WebRTC IP addresses
Each candidate row shows the address, its type and scope. Only public addresses matter for the verdict; private and mDNS entries reveal your network layout at most, never your identity.
Public IP via STUN
The srflx (server-reflexive) candidate is the address our STUN server saw your UDP packet come from. With a working VPN it equals your VPN address. If it is different, UDP left your device outside the tunnel and the real address is exposed — that is the leak.
Local IP / mDNS candidates
host candidates are your local interface addresses. Current Chrome, Edge, Firefox and Safari replace them with a random ….local mDNS name so sites cannot read your LAN addresses; older browsers and some settings still show 192.168.x.x-style addresses, which exposes your home network layout but not your public identity.
What is a WebRTC leak?
A VPN or proxy intercepts the traffic you send through it; WebRTC asks the operating system for the best route to a STUN server directly, and the operating system may answer through the physical interface. A proxy never carries UDP at all, so for proxy users any public STUN result is by definition outside the proxy. The result is a website learning your real public address while your browser's address bar, cookies and everything else show the VPN. The guide what is WebRTC explains the protocol.
How to stop WebRTC leaks
You can prevent WebRTC from using non-tunneled interfaces or disable it entirely. Disabling breaks video calls in the browser, so prefer the restricting options.
Chrome and Edge
Chrome has no built-in switch. Install an extension that sets the WebRTC IP handling policy to Disable non-proxied UDP (the policy exposed by Chrome's extension API), or use your VPN provider's extension if it offers WebRTC protection. Enterprise administrators can set the WebRtcIPHandling policy centrally.
Firefox
Open about:config. Set media.peerconnection.ice.default_address_only to true to restrict WebRTC to the default route (the VPN when connected), and media.peerconnection.ice.no_host to true to hide local addresses. To disable WebRTC completely set media.peerconnection.enabled to false.
Safari
Safari hides local addresses behind mDNS and only gathers STUN candidates when a page actually sets up a call or data channel. There is no user-facing switch; on iOS, Lockdown Mode blocks WebRTC entirely. If this test reports a leak in Safari, the fix is the VPN's own IPv6/UDP handling rather than a browser setting.
Brave
Settings › Privacy and security › WebRTC IP handling policy: choose Disable non-proxied UDP. Brave Shields already block the most common fingerprinting uses.
Extensions
Extensions that block WebRTC work by setting the same IP handling policy; they cannot do more than the browser allows. Check that an extension does not simply hide the result from this test while the leak continues: after installing one, re-run and confirm the status is blocked or no leak, not merely an empty list.
Frequently asked questions
How do I disable WebRTC?
Firefox: set media.peerconnection.enabled to false in about:config. Chrome, Edge and Brave: set the WebRTC IP handling policy to Disable non-proxied UDP (Brave in its settings, Chrome/Edge through an extension or enterprise policy). Safari has no switch; iOS Lockdown Mode disables it. Re-run this test to confirm.
Is WebRTC a security risk?
WebRTC itself is secure — media and data are encrypted. The privacy issue is address discovery: a page can learn your public and sometimes local addresses without a permission prompt, which matters mainly if you rely on a VPN or proxy to hide them.
Is blocking WebRTC good?
If you use a VPN or proxy and this test shows a leak, restricting WebRTC is the right move. Blocking it completely stops browser-based calls and some conferencing sites; the disable non-proxied UDP policy keeps calls working through the tunnel and is the better default.
What happens when a WebRTC IP leak is detected?
The address exposed by WebRTC is visible to the website — it can log it, geolocate it and combine it with the address seen over HTTP. Nothing is "sent" anywhere by our test; the leak only exists between your browser and sites that choose to collect it. Apply one of the fixes above and re-test.
What does the WebRTC extension do?
A WebRTC extension sets the browser's IP handling policy so that candidates are gathered only through the default (tunneled) route, or not at all. Some also strip local addresses. They cannot encrypt or redirect traffic; a VPN does that.
What is WebRTC Shield?
"WebRTC Shield" and similar names are used by several extensions and by VPN apps for the feature that applies the restricting policy described above. Whatever it is called, confirm it works by re-running this test: the status should read no leak or blocked.
ICE candidates: your browser against stun.checkmyip.com (our own server, UDP and TCP, IPv4 and IPv6); HTTP address: probe.checkmyip.com. The comparison runs in your browser; candidates are never sent to us.