WebRTC IP Leak Test: How to Detect and Prevent Real IP Exposure

WebRTC IP Leak Test

You install a Virtual Private Network (VPN), connect to a secure server in Zurich or Amsterdam, open an IP checker, and see the VPN’s IP address. You feel secure.

However, if you visit certain websites, an invisible browser protocol known as WebRTC can quietly transmit your real public IPv4, public IPv6, or internal private IP address directly to the server behind your back — completely bypassing your VPN tunnel or proxy extension.

In this technical guide, we explain the mechanics of WebRTC leaks, demonstrate how to test for them, and show you how to disable WebRTC across all major browsers.

🛡️ Test Your Browser Now: Don’t guess if your identity is protected. Launch our free, instant WebRTC Leak Test Tool to audit your active STUN candidates, detect hidden public IPv4/IPv6 addresses, and verify VPN integrity in real time.

What Is WebRTC and Why Does It Leak Your IP?

WebRTC (Web Real-Time Communication) is a browser technology built into Chromium (Google Chrome, Microsoft Edge, Brave, Opera) and Mozilla Firefox. It allows web applications to facilitate direct peer-to-peer (P2P) video calling, voice chat, and real-time file sharing without installing external plugins.

To establish a direct peer-to-peer connection with another device, your browser needs to know your exact network path. To do this, WebRTC sends out requests to STUN (Session Traversal Utilities for NAT) and TURN servers.

The Vulnerability:

When a web page executes a standard WebRTC JavaScript command:

The browser initiates an Interactive Connectivity Establishment (ICE) candidate discovery.
It queries an external STUN server to discover all network interfaces available on your device.
Because these STUN requests are made at a lower networking layer than standard HTTP requests, many browser-level proxies and misconfigured VPN clients fail to route these UDP packets through the encrypted tunnel.
The STUN server reflects back your true, original public IP address assigned by your ISP, which the webpage’s JavaScript reads in plain text.

[ Browser with VPN Active ]
         │
         ├─── Standard Web Traffic (Encrypted via VPN) ───► [ Website Server ] (Sees VPN IP)
         │
         └─── WebRTC STUN Query (Bypasses VPN Tunnel!) ───► [ STUN Server ] 
                                                                    │
                                            Returns True Residential Public IP!

What Information Does a WebRTC Leak Reveal?

A WebRTC leak can expose three distinct pieces of identifying network data:

Your True Public IPv4 Address: Disclosing your actual ISP, approximate physical city, and geographic region.
Your True Public IPv6 Address: Many VPNs only tunnel IPv4 traffic, leaving IPv6 completely unprotected. WebRTC can expose your globally routable IPv6 address directly.
Your Internal Local Area Network (LAN) IP: Disclosing your local subnet address (such as 192.168.1.45 or 10.0.0.12), which helps trackers fingerprint your specific machine across different browser sessions.

How to Test Your Browser for WebRTC Leaks

Testing your browser takes less than 30 seconds:

Step 1: Establish Your Baseline

Disconnect your VPN or proxy.
Check your public IP on our What Is My IP homepage. Note the IP address and ISP.

Step 2: Connect to Your VPN

Turn on your VPN and select a server in a different city or country.
Verify that our homepage displays the new VPN location and IP.

Step 3: Run the WebRTC Diagnostic Check

💡 Prefer an instant 1-click test? Instead of manually pasting scripts into the developer console, run our automated WebRTC Leak Test Tool which probes multiple STUN endpoints and correlates candidate IPs against your public HTTP gateway.

You can also test WebRTC candidate generation manually right from your browser’s Developer Tools Console (F12 or Ctrl + Shift + I):

Paste the following standard diagnostic script into your console:

const pc = new RTCPeerConnection({
  iceServers: [{ urls: "stun:stun.l.google.com:19302" }]
});

pc.createDataChannel("");
pc.createOffer().then(offer => pc.setLocalDescription(offer));

pc.onicecandidate = (event) => {
  if (!event || !event.candidate) return;
  const ipRegex = /([0-9]{1,3}(\.[0-9]{1,3}){3}|[a-f0-9]{1,4}(:[a-f0-9]{1,4}){7})/i;
  const match = event.candidate.candidate.match(ipRegex);
  if (match) {
    console.log("Found ICE Candidate IP:", match[1]);
  }
};

How to Analyze Your Results:

No Leak (Protected): The console prints only your VPN’s IP address or generic masked mDNS hostnames (.local).
Active Leak (Exposed): The console prints your real residential IP address while your VPN is active. Your identity is compromised.

How to Block and Disable WebRTC in Your Browser

Depending on the web browser you use, you can either disable WebRTC entirely or restrict its candidate discovery policies.

1. In Mozilla Firefox (Native Kill Switch)

Firefox is the only major desktop browser that provides a native, built-in setting to completely shut off WebRTC without needing third-party extensions.

Type about:config in your Firefox address bar and press Enter.
Click Accept the Risk and Continue.
In the search bar at the top, type: media.peerconnection.enabled.
Double-click the preference (or click the toggle button) to switch its value from true to false.
Restart Firefox. WebRTC is now completely disabled.

(Note: Turning this off will disable browser-based Google Meet or Discord calls inside Firefox; use their desktop client apps instead).

2. In Brave Browser (Built-In WebRTC Shield)

Brave has native protection against WebRTC IP leakage built into its privacy settings:

Open Settings (brave://settings/).
Go to Privacy and security → Shields.
Locate WebRTC IP handling policy.
Change the dropdown setting from Default to Disable Non-Proxied UDP.

3. In Google Chrome & Microsoft Edge

Unlike Firefox, Google Chrome and Microsoft Edge do not have a direct about:config toggle to disable WebRTC because it is integral to Google’s communications ecosystem.

To protect Chrome or Edge from leaking your IP:

Use a System-Level VPN with DNS/WebRTC Leak Protection: Instead of using a browser extension proxy, use an OS-level VPN client (WireGuard or OpenVPN) with a strictly enforced Kill Switch and IPv6 leak protection.
Install a Privacy Extension: Extensions such as WebRTC Control or uBlock Origin can block unproxied WebRTC candidate generation. In uBlock Origin, open Settings and enable the checkbox: “Prevent WebRTC from leaking local IP addresses”.

Best Practices to Prevent All IP Leaks

Disable IPv6 if Your VPN Doesn’t Support It: If your VPN provider only routes IPv4, disable IPv6 in your operating system’s network adapter settings to prevent IPv6 bypass leaks.
Always Enable Your VPN’s Network Lock / Kill Switch: If your connection drops for even half a second, a kill switch immediately cuts off your internet access so your real IP is never transmitted over an unencrypted socket.
Regularly Test Your Connection: Periodically run our IP Lookup Tool and DNS Query Benchmark to verify that your DNS requests and IP routing remain strictly inside your intended tunnel.

Frequently Asked Questions

Does an Incognito or Private Window stop WebRTC leaks?

No. Incognito mode only prevents your browser from saving local cookies, history, and cache. WebRTC operates identically in private browsing windows and will still leak your IP.

Will disabling WebRTC break regular browsing?

No. Standard websites, YouTube videos, blogs, online banking, and e-commerce platforms do not use WebRTC. Only real-time browser communication apps (like Google Meet, Zoom web client, or Discord in-browser voice) rely on WebRTC.

Execute Deep WebRTC STUN Leak Diagnostic