WebRTC Leak Test

What Is a WebRTC Leak?

WebRTC (Web Real-Time Communication) is a browser technology that enables peer-to-peer communication for video calls, voice chat, and file sharing directly in the browser without plugins. While WebRTC is incredibly useful, it has a privacy side effect: it can reveal your real IP address to websites, even when you are using a VPN or proxy. This happens because WebRTC uses STUN (Session Traversal Utilities for NAT) servers to discover your IP addresses for establishing peer connections, and this process can bypass VPN tunnels.

How WebRTC Leaks Work

When a website uses WebRTC, your browser makes requests to STUN servers to discover your network interfaces. These requests can reveal both your local (private) IP address and your public IP address. The problem is that these requests happen at the operating system level and may not go through the VPN tunnel. A malicious website could exploit this to discover your real IP address even when you believe you are protected by a VPN. The local IP addresses revealed can also provide information about your network configuration.

Why Should You Care About WebRTC Leaks?

If you use a VPN for privacy, a WebRTC leak defeats the purpose entirely. Websites can see your real IP address alongside your VPN IP, linking your anonymous browsing to your actual identity and location. This is particularly concerning for journalists, activists, whistleblowers, and anyone who relies on VPN anonymity for personal safety. Even casual users who want privacy from advertisers and trackers should be aware that WebRTC leaks can expose their real location.

How to Fix WebRTC Leaks

There are several ways to prevent WebRTC leaks. In Firefox, you can disable WebRTC entirely by setting media.peerconnection.enabled to false in about:config. Chrome and Edge users can install browser extensions like WebRTC Leak Prevent or uBlock Origin, which can block WebRTC requests. Some VPN applications include built-in WebRTC leak protection. Note that disabling WebRTC will break video calling services like Google Meet and Discord that depend on it, so consider using extension-based solutions that allow selective blocking.

Testing for Leaks

This tool creates a WebRTC peer connection with Google's public STUN server and collects all ICE (Interactive Connectivity Establishment) candidates generated by your browser. It then extracts IP addresses from these candidates and compares them with your public IP obtained via a separate API call. If local or private IP addresses are found, or if your public IP differs from what your VPN should show, you may have a leak. Regular testing is recommended, especially after updating your browser, VPN software, or operating system, as updates can sometimes reset WebRTC settings.