IP Leak Test — See What Your Connection Reveals
Run the check to see which IP addresses this browser exposes. A proxy or VPN can be doing its job in one path and leaking in another — this shows you both.
Who this is for: Users who need to confirm a VPN or proxy is not leaking their real address, plus the DNS and WebRTC paths.
Run the leak and fingerprint check →
What an IP leak actually is
You think your traffic exits through one address. Something in the connection disagrees, and a website learns a different one. There is no single leak — there are several independent paths, and any of them can expose an address you did not intend to send.
The four paths that leak
- WebRTC. The browser's real-time communication stack enumerates local and public addresses so peers can connect directly. That enumeration can reveal an address that your proxy does not cover, because it does not always travel through the proxy.
- IPv6. A VPN that handles IPv4 only leaves IPv6 traffic going out over your native connection. If your ISP provides IPv6 and the site supports it, you may reach it over a link the tunnel never touched.
- DNS. Your lookups can go to your ISP's resolver even while your page traffic goes through the tunnel. That tells the resolver — and anyone observing it — which sites you visit, regardless of where your traffic exits.
- Failure to tunnel. A misconfigured split tunnel or a dropped connection sends traffic out directly until you notice. This is the leak people only discover the hard way.
How to test
1. Check the address a site sees. That is the baseline — whatever it says is what any ordinary website will log.
2. Check WebRTC separately. Local-address enumeration shows up here even when the baseline looks clean, which is the whole reason a VPN-only check is not enough.
3. Check IPv6. If you see an IPv6 address while you believe you are on IPv4-only, your tunnel is not carrying it.
4. Check where DNS goes. A resolver in a different country from your exit IP is a signal your lookups are taking a different path than your traffic.
5. Re-test after changing anything. Half the value of a leak test is using it after a configuration change, not just once.
What to do about each leak
- WebRTC: disable it in the browser, or set the browser's WebRTC policy to never expose public addresses. The requirement is that it stops enumerating, not just that it fails sometimes.
- IPv6: either route IPv6 through the tunnel or turn IPv6 off entirely on the client. Doing half of one is the worst option.
- DNS: point the client at a resolver that is inside the tunnel, and verify with a leak test rather than trusting the setting.
- Tunnel failures: enable a kill switch so traffic cannot escape when the tunnel drops.
Why the receiving site cares
Sites that depend on knowing who you are — banks, streaming services, ad platforms, AI tools enforcing regional rules — compare signals rather than trusting one. A mismatched pair of addresses is a classic automation or evasion signature, and it is one of the reasons a perfectly configured proxy still triggers a block. If something is blocking you, a leak test is cheaper than guessing.
Frequently asked questions
What is an IP leak?
Any situation where a website or network observer learns an IP address that your VPN or proxy was supposed to hide. The common paths are WebRTC, IPv6, DNS and tunnel failures.
Does a VPN stop all leaks?
No. A VPN typically covers page traffic. WebRTC can enumerate addresses outside the tunnel, and an IPv4-only tunnel leaves IPv6 traffic untouched unless you handle it explicitly.
How do I know if my real IP is exposed?
Compare the address the site sees with the address your WebRTC and DNS paths reveal. If you see your own ISP's address anywhere while the tunnel is active, that path is leaking.
Is a leak test the same as a fingerprint test?
No. A leak test covers network addresses. A fingerprint test covers what your browser reveals about itself — both matter, and they are checked separately.
Related tools
PureIP — free IP lookup and network diagnostics: IP location, WHOIS, reverse DNS, reputation, blacklists, AI service reachability and global ping.