What is a WebRTC leak?

Why you should care

A VPN changes the public IP that ordinary websites see. WebRTC is different: pages can ask the browser for connection addresses used in peer-to-peer calls.

If those addresses include your real public IP or a local network address, the VPN’s protection is incomplete for that page — even when your normal “what is my IP” check looks fine.

What WebRTC is

WebRTC is a browser technology for audio, video, and data between peers without plugins. To find a working path, the browser collects ICE candidates — possible addresses a peer might use.

Gathering those candidates often involves a STUN server on the public internet. That process is useful for calls and risky for privacy when a random page can read the same list.

Local vs public exposure

A host candidate is typically a LAN address (for example 192.168.x.x). Seeing it means the page learned something about your local network — useful context, but not the same as outing your ISP public IP.

A server-reflexive (srflx) candidate is a public address as seen from the internet. For VPN users, the important question is whether that public address matches the address the page loaded over — usually the VPN exit if the tunnel covers the site. Leak tests compare the same IP family (IPv4 with IPv4, IPv6 with IPv6); the other family is listed for you to check, not auto-flagged.

mDNS names are not the main story

Many browsers hide raw LAN IPs behind names ending in .local (mDNS). That reduces casual exposure of 192.168 addresses, but it does not fix a public IP leak.

When you read a leak test, treat mDNS as “local identity obscured,” not as proof that nothing sensitive was shared.

What you can do

Prefer browser or VPN settings that limit which IPs WebRTC may share, instead of turning WebRTC off unless you never need browser calls.

Chrome and Edge no longer offer the old chrome://flags WebRTC toggle; managed browsers can set a WebRTC IP handling policy. Firefox can limit ICE host candidates in about:config — turning media.peerconnection.enabled off breaks calls. Some VPN apps include WebRTC protection — use it when available.

After you change a setting, re-run a WebRTC leak test and compare any public candidate to your VPN IP.

How to check

Open a WebRTC leak test while connected to your VPN. Note the public IP the page reports for your connection, then see whether WebRTC listed a different public address.

If only LAN or mDNS names appear, understand what that means for your threat model. If a public address differs from the VPN exit, treat that as the priority fix.

Remember

• A clean “what is my IP” result does not prove WebRTC is safe.
• Disabling WebRTC entirely breaks many in-browser calls — prefer limiting IP exposure.
• Different sites can use WebRTC differently; a test page shows what this browser will reveal to a similar script.
• Re-check after browser or VPN updates.

Related guides