A WebRTC leak can expose your real IP address even while a VPN is running. Here is what causes it, how to test for it, and how to close the gap.
A VPN does not hide your IP address from WebRTC.
You pay for a VPN, switch it on, and reasonably assume your real address is now hidden. For the traffic your browser sends over HTTP, that is usually true. But there is a separate mechanism built into every modern browser that can quietly hand out your real address anyway, straight past the tunnel. It is called a WebRTC leak, and it has caught out a lot of privacy-conscious people.
What WebRTC is doing
WebRTC — Web Real-Time Communication — is the technology behind in-browser video calls, voice chat and peer-to-peer file transfer, all without a plugin. To connect two people directly, each browser has to discover how it can be reached across the internet, and that discovery step is where the leak lives.
To find the best path between peers, WebRTC uses a helper protocol that asks external servers a direct question: from the outside, what does my address look like? The browser gathers a list of possible addresses — called ICE candidates — and that list can include both your local network address and your real public IP, regardless of any VPN.
Why a VPN misses it
A VPN reroutes your traffic through an encrypted tunnel, so the websites you visit see the VPN’s address rather than yours. The problem is that WebRTC’s address discovery can operate at a layer the VPN does not fully cover. The browser may query those helper servers directly and learn your true public IP, then expose it to any script on the page that asks.
The result is a page that sees two different addresses at once: the VPN’s, from your normal traffic, and your real one, from WebRTC. For anyone trying to de-anonymise a visitor, that is the whole game.
How to spot a leak
You do not need to take this on faith. Our WebRTC leak test triggers the same discovery process a tracking script would, lists every address your browser reveals, and compares them against the public IP your ordinary traffic uses — which you can check separately on the what is my IP address tool.
Here is how to read the results with a VPN running:
| What the test shows | What it means |
|---|---|
| Only the VPN’s public IP | No public leak |
| A local address like 192.168.x.x | Your private network address, usually harmless |
| A public IP that is not your VPN’s | A real leak: your true address is exposed |
A local address cannot identify you on the internet, so it is the middle row you can ignore. The last row is the one that matters.
Closing the gap
If the test reveals a leak, you have several options, from simplest to most thorough.
- Disable WebRTC or restrict it. Some browsers, notably Firefox and Brave, let you turn WebRTC off or limit which addresses it may reveal. A reputable extension can do the same in Chrome-family browsers. The trade-off is that video and voice calls in the browser may stop working.
- Use a VPN client with leak protection. Better desktop VPN apps configure the system so WebRTC can only ever see the tunnel’s address. This is often the most reliable fix because it works below the browser.
- Prefer a privacy-focused browser. Browsers built with anonymity in mind handle this correctly out of the box.
A leak matters most if you rely on a VPN to hide where you are, because for a real location an IP address is one of the strongest clues there is. But keep it in proportion: your IP is only one way to be recognised online. Even with every leak sealed, your browser can still be identified by its fingerprint, which owes nothing to your network address. The two problems are separate, and as we explain in what is browser fingerprinting, fixing one does nothing for the other.
So treat a clean test as one box ticked, not a guarantee. That is the point of testing rather than assuming: the leak is either there or it is not, and one page can tell you which. Never assume a VPN hides everything: switch yours on, run the leak test, and confirm with your own eyes that only the address you expect is showing.