Privacy
See whether WebRTC reveals a public IP that differs from this page’s address — not only a LAN address.
Updates from your current connection
Methodology: this browser gathers ICE candidates through one STUN server. A public host or STUN (srflx) address in the same family as this page’s IP that does not match is the leak. LAN host addresses are listed separately. mDNS names are ignored. Relay (TURN) is not treated as a public-IP leak.
A LAN host address (for example 192.168.x.x) means this page can see your local network. That is not the same as exposing your real public IP.
A public STUN (srflx) address that differs from this page’s IP is the VPN-relevant leak — the site learned a public address your tunnel was meant to hide. “This page’s IP” is the address used to load SkyPath, which is your VPN exit if the tunnel covers this site.
The automatic leak verdict compares only the same IP family this page loaded over (IPv4 with IPv4, IPv6 with IPv6). A public address in the other family is listed for you to compare; it is not auto-flagged.
mDNS (.local) names are ignored for the verdict. They hide a LAN IP; they do not prove a public IP is safe. Relay (TURN) candidates are not treated as a public-IP leak.
WebRTC enables real-time audio, video, and peer-to-peer connections directly in the browser without plugins.
To establish connections, browsers may query STUN servers for candidate IP addresses — including LAN host addresses and public server-reflexive addresses.
Your VPN can mask the IP this page loads over, while WebRTC still gathers a different public address via STUN. That mismatch is the leak that matters.
Seeing 192.168 or another private host candidate is local-network visibility, not proof your ISP public IP leaked. Privacy browsers and VPN apps often limit ICE candidates to reduce both.
Host is a local interface. A 192.168, 10.x, or IPv6 ULA host address means this page can see your LAN. That is not the same as a public IP leak.
Server-reflexive (srflx) is a public address as a STUN server sees you. Compare it to Public IP on this page. A mismatch in that family is the VPN-relevant leak.
Relay (TURN) is traffic via a turn server, not your ISP address. Peer-reflexive (prflx) is learned from a peer. mDNS names end in .local: this test ignores them for the verdict because they hide the raw LAN IP, not a public leak.
Load this test with the VPN off and note Public IP and Public WebRTC. Connect the VPN, run it again, and both public values should match the VPN exit — not your home ISP.
If Public WebRTC still shows your ISP address after connecting, the tunnel is not covering WebRTC. Enable the VPN’s WebRTC protection or limit ICE candidates in the browser, then re-test. Next, run DNS Leak Test.
This page loads over one IP family. The automatic verdict only compares public WebRTC addresses in that family, so a dual-stack IPv6 STUN address is not treated as a leak just because the page used IPv4.
When the other family appears, we list it and ask you to compare it to the matching VPN exit if you have one. We stay on one STUN server; a second STUN would not change that rule.
Chrome and Edge no longer offer the old chrome://flags “WebRTC IP handling” toggle many guides still describe, and the WebRTC Network Limiter extension is retired. Managed browsers can set the WebRTC IP handling policy (default public interface only, or disable non-proxied UDP). Otherwise use a VPN that includes WebRTC protection.
Firefox: in about:config, media.peerconnection.ice.default_address_only and media.peerconnection.ice.no_host hide LAN host candidates. Setting media.peerconnection.enabled to false turns WebRTC off and breaks in-browser calls.
Safari: limit WebRTC in site settings where available. Prefer hiding IPs over disabling WebRTC unless you never need browser calls. Then re-run this test.
A WebRTC leak is when a page reads ICE candidates and learns an address you did not intend to share. For VPN users, the serious case is a public STUN address that differs from the VPN exit IP — not merely a 192.168 LAN address.
It means the page can see a local network address. That is useful context, but it is not the same finding as a public IP that differs from this page. This test reports those two results separately.
It can. A VPN masks ordinary HTTP requests, but WebRTC may still gather a public address via STUN. Compare Public WebRTC on this page with Public IP. If they differ, treat that as the priority fix.
Disabling WebRTC (for example Firefox media.peerconnection.enabled = false) breaks video and voice calls in the browser. Prefer VPN WebRTC protection or ICE limits that hide addresses without turning WebRTC off.
Use your VPN’s WebRTC protection if it has one. On Firefox, limit ICE host candidates in about:config. On Chrome or Edge, use the WebRTC IP handling policy if you manage the browser — current Chrome does not offer the old flags toggle. Then re-run this test.
No. Some VPNs only tunnel IP traffic. Check whether your VPN or browser explicitly offers WebRTC leak protection.
The automatic leak verdict compares only the IP family this page loaded over. An IPv6 STUN address is listed when the page used IPv4 (and the reverse), so you can compare it yourself. It is not auto-flagged as a leak.
Relay (TURN) means the path used a turn server, not your ISP public IP. mDNS names ending in .local hide a LAN address behind a temporary name. This test ignores both for the public-leak verdict.
SkyPath VPN
SkyPath VPN is free for Android — one tap to connect, no account, no logs.
